Data Protection Compliance Programme
Data protection is not a one-off documentation exercise; it is a structure that has to keep pace with changing legislation and changing business processes. Administrative fines under the Turkish Data Protection Law range from TRY 256,000 to TRY 17 million. Alongside them, the prison sentences provided for in the Turkish Criminal Code and the Cybersecurity Law make compliance a personal matter for company management.
A breach rarely begins with a sophisticated cyber attack. It begins with something ordinary: an employee who clicks a phishing e-mail, a candidate pool nobody has deleted in years, a data flow opened to a supplier with no agreement in place, a user who goes to the Authority after receiving no answer to their request. This programme is designed to make those points visible at inventory level and close them.
Stages
Interviews
Employees are first given data protection training to build awareness, after which each department is interviewed individually. Processing activities, the data processed, the purposes of processing, the parties data is transferred to and retention periods are established.
Process review
The agreements, policies, documents and records used in the processes identified during the interviews are obtained and examined. Data maps are produced, and domestic and cross-border data flows are established.
Risk assessment
The company’s data protection risks are identified on the basis of the information gathered. A Risk and Action Report is prepared and presented to management, questions are answered, and the resulting actions are planned.
Compliance actions
Policies and procedures are updated; privacy notices, explicit consent forms and agreements are revised and put into use; technical and organisational measures are documented; the processing inventory and the VERBİS-compliant inventory are produced and the VERBİS notification is filed.
Testing and training
A closing report is prepared once the compliance stage is complete. Roughly two months after the programme ends, an audit is carried out and a separate audit report sets out whether compliance has in fact been achieved.
Areas Reviewed
- Processing activities and data flows
- Domestic and cross-border transfers, standard contractual clauses
- Retention and erasure processes
- KVKK compliance and VERBİS obligations
- GDPR compliance
- ISO 27001 and information security management
- Cybersecurity obligations
- Technical and organisational measures, authorisation matrix
- Employee, candidate, customer, supplier and visitor data
Deliverables
- Personal data processing inventory
- VERBİS-compliant inventory and VERBİS notification
- Risk and Action Report
- Closing and Audit Report
- Personal data protection policy
- Special categories of personal data policy
- Retention and erasure policy, with erasure records
- Privacy notices for employees, candidates, customers, suppliers and visitors
- Explicit consent forms and confidentiality undertakings
- Controller – processor agreement and contractual clauses
- Cookie policy and cookie banner
- Authorisation matrix and documentation of organisational measures
- Data protection training decks
Frequently Asked Questions
Do you handle the VERBİS registration and notification?
Yes. In the compliance actions phase, the personal data processing inventory and a VERBİS-compatible inventory are prepared, and the notification is made on the basis of that inventory. If the company is not required to register with VERBİS, this is also established through the inventory work and reported.
Does the programme cover only KVKK, or GDPR as well?
For companies that offer goods or services to people in the European Union, or monitor their behaviour, GDPR is also in scope. For these companies the inventory, privacy notices and transfer mechanisms are prepared to satisfy both regimes together. The two are largely similar but not identical; differences in particular on legal bases, breach notification and cross-border transfers are addressed separately.
Do we receive ISO 27001 certification at the end of the programme?
No. ISO 27001 certification can only be issued by accredited certification bodies. The programme documents the technical and organisational measures relating to information security management, supporting the company's legal obligations and its readiness for certification. If certification is the goal, the work is planned around it from the start.
How much time do our departments need to set aside?
A one-to-one interview is held with each department at the start of the programme, after which we ask for the contracts, forms and documents mentioned in the interviews. In later phases, departments are expected to put the new documents and processes into use. The data protection training given before the interviews speeds things up by helping departments understand what information is being shared and why.
Would you like to run this programme at your company? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meeting