GDPR Compliance Project
Turkish companies offering goods or services to individuals in the European Union may be subject to the EU General Data Protection Regulation (GDPR) even though they are based in Türkiye. We determine whether your company falls within the scope of the GDPR and, if it does, run the compliance work, from the records of processing to transfer mechanisms, alongside your KVKK compliance and with the differences between the two regimes in mind.
What is the GDPR, and why does it matter to Turkish companies?
The GDPR is the general data protection regulation that has applied in the European Union since 25 May 2018. It applies not only to companies established in the EU, but also to companies outside the EU that offer goods or services to individuals in the Union or monitor their behaviour.
An e-commerce site selling to Europe, software serving European users or an app tracking its visitors in Europe may fall within this scope. Breaches of the GDPR can lead to administrative fines of up to 20 million euros or four per cent of global annual turnover.
What are the main differences between the KVKK and the GDPR?
The KVKK was largely inspired by the European directive that preceded the GDPR, but the two regimes are not the same. There are significant differences in areas such as legal bases, the appointment of a data protection officer, records of processing activities, risk assessment in breach notification, transfer mechanisms and registration obligations. KVKK compliance therefore does not automatically ensure GDPR compliance.
Scope
- Running compliance work on obligations under the EU General Data Protection Regulation (GDPR)
- Determining whether the company falls within the scope of the GDPR
- Preparing records of processing activities, privacy notices and privacy policies in line with the GDPR
- Appointing an EU representative and setting up data transfers from the European Union to Türkiye
How We Work
- Determining the scope of the GDPR by reviewing the company’s activities, target markets and points of contact with individuals in Europe
- Comparing existing KVKK work with the GDPR and carrying out a gap analysis
- Setting the records of processing activities, legal bases and retention periods under the GDPR
- Preparing privacy policies, cookie practices, data processing agreements and transfer agreements
- Setting up breach management, data subject requests and, where required, EU representative processes
Team
Frequently Asked Questions
If we comply with the KVKK, are we also compliant with the GDPR?
No. Although the two regimes rest on similar principles, they differ on legal bases, record-keeping and documentation obligations, breach notification and transfers abroad. KVKK compliance is a good starting point; for the GDPR, a gap analysis needs to be carried out on top of it.
Do we need to appoint an EU representative?
Companies that have no establishment in the EU but are subject to the GDPR must, as a rule, appoint a representative in the Union. There is a limited exemption for processing that is occasional, does not include special categories of data on a large scale and poses no risk to individuals; this is assessed according to the company's activities.
Can a customer or group company in Europe send data to Türkiye?
Yes, but since there is no European Commission adequacy decision for Türkiye, the transfer must rely on an appropriate safeguard such as the European Commission's standard contractual clauses. Your European counterpart will usually ask for these clauses at the start of the business relationship.
Is it mandatory to appoint a data protection officer (DPO)?
Not for every company. It is mandatory for companies whose core activities require regular and systematic monitoring of individuals on a large scale, or large-scale processing of special categories of data. Where it is not mandatory, we still recommend designating a person responsible for monitoring compliance.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meetingPublications in this area
- Rights Over a Person’s Image and Photograph 15.10.2024
- Can the Corporate E-mail Histories of Employees Who Leave Their Jobs Be Made Available to Another Employee? – An Evaluation in the Context of the Law on the Protection of Personal Data 06.05.2024
- Deepfake Technology – Legal Challenges and Key Questions 17.11.2023
- Push Notifications in Turkish Law: Legal Obligations and User Rights 25.10.2023