Data & Technology

Data security and the protection of personal data have been among our core practice areas since Konsorsiyum was founded. We design compliance work so that it does not disrupt how an organisation actually operates, and we run the whole process with a single team - from inventories and policies to agreements, and from the urgent decisions of a breach to Board investigations and annulment actions.

Solutions

Data Protection Compliance Programme A programme that maps the company's data processing end to end and closes its KVKK and GDPR obligations in one run — from the processing inventory and VERBİS notification to cross-border transfers and erasure. 6 weeks Details Cybersecurity Compliance Programme A programme that makes the company's information assets and critical systems visible at inventory level and closes its obligations under the Cybersecurity Law and the Information and Communication Security Guide in one run — from gap analysis to an incident response plan. 6 weeks Details Legal Navigation Advisory that builds a new project's legal foundation from the outset, stays inside the team throughout, guides decisions as they are taken, and hands over a risk map at close. Project duration Details

Services

Data Protection (KVKK) Compliance Project Bringing the company's personal data processing activities into line with the Personal Data Protection Law and meeting VERBIS obligations. Details Cybersecurity Law Compliance Establishing the company's obligations under the Cybersecurity Law and bringing its information systems and processes into line with them. Details Data Inventory and Mapping Building a personal data processing inventory from scratch or updating an existing one. Details Data Processing Agreements and Policies Putting controller-processor relationships on a contractual footing and reviewing supplier and employee agreements against data protection law. Details Cross-Border Data Transfers Designing cross-border data transfer processes and managing standard contractual clause procedures. Details Information Security and Data Breach Management Establishing information security policies, determining technical and administrative measures and managing data breach processes. Details Commercial Messaging and IYS Compliance Compliance work on Message Management System records, commercial message consents and the use of marketing data. Details GDPR Compliance Project Compliance work in relation to obligations under the European Union General Data Protection Regulation. Details Artificial Intelligence Compliance and Policies Structuring the company's strategy for the use of artificial intelligence and preparing the internal policies that go with it. Details Crypto Regulation and Compliance Advisory Regulatory monitoring and compliance advice for crypto-asset companies and virtual asset service providers (VASPs). Details Licensing for Crypto-Asset Platforms Managing licensing processes for crypto-asset platforms and meeting the applicable regulatory and compliance obligations. Details Data Subject Applications and Board Investigations Managing data subject applications and providing advisory and representation services in Personal Data Protection Board investigations. Details Litigation Against Board Decisions Annulment actions against Board decisions and representation of companies in administrative court proceedings. Details

Team

Ali Gül Founding Partner

Buse Yüceer Associate

Burcu Kulotu Associate

Frequently Asked Questions

Is VERBİS registration mandatory for data protection compliance?

Not for everyone. The obligation depends on the company's headcount and balance sheet size, and on whether its main activity involves processing special categories of data; the thresholds are updated by the Authority. A company below the thresholds is exempt from registration, but every other obligation under the law continues to apply. Which category a company falls into cannot be answered reliably without an inventory exercise.

Do we need explicit consent for every processing activity?

No. Explicit consent is only one of the legal bases in the law. Where another basis applies — performance of a contract, compliance with a legal obligation, or legitimate interests — consent is not required. Relying on consent unnecessarily in fact increases risk: because consent can always be withdrawn, the basis for continuing to process that data can disappear.

We use cloud services. Does that count as a cross-border transfer?

If the servers are abroad, or the provider can access the data from abroad, in most cases yes. This is the most common way companies transfer data without realising it: a significant share of e-mail, HR, CRM and file-sharing services fall within scope. Which transfer mechanism applies, and whether a notification is required, is assessed separately for each service.

How quickly must we report a data breach?

The window is short: the Authority must be notified as soon as possible after the breach comes to light, and the individuals concerned must also be informed. If it is not already written down who does what, the hours lost at the moment of a breach turn directly into a breach of obligation. This is why an incident response plan is one of the most important outputs of a compliance programme.

Once the compliance work is finished, is that the end of it?

No. New software, a new department, a new supplier or a new campaign changes the inventory and makes compliance go stale. That is why our compliance programme does not end with a closing report but with an audit carried out afterwards — and the inventory has to be kept alive from then on.

Do you need support in this area? Schedule a meeting with us — the first meeting is free of charge.

Schedule a meeting