Website compliance with KVKK (Turkey’s Personal Data Protection Law) means informing visitors when their personal data is collected, basing every item of personal data the website collects on a legal ground listed in the Law, taking appropriate security measures, and fulfilling obligations such as VERBİS registration and breach notification when necessary. Explicit consent is only one of these obligations and is required when processing cannot rely on another legal ground, rather than for every form.
This article summarizes the basic points website owners should know, drawing on Law No. 6698 (KVKK) and decisions and announcements published by the Personal Data Protection Authority. It is intended for general information; the website’s specific data processing activities need to be assessed with a lawyer.
Where is personal data processed on a website?
A website processes personal data wherever it obtains information relating to an identifiable person, such as a visitor’s name, phone number, email address, or IP address; compliance work begins by listing these points without omissions. The most common data collection points on corporate websites are:
- Contact and quote request forms
- Membership, login, and order steps (including delivery and billing information on e-commerce websites)
- Newsletter signup boxes and campaign forms
- Job application and resume upload fields
- Live support windows and buttons directing users to messaging applications
- Cookies placed by analytics, advertising, and social media tools
- Server records and access logs kept by security plugins
Four questions are answered for each point: what data is collected, for what purpose it is used, with whom it is shared, and how long it is retained. This inventory forms the basis of both the privacy notice and the choice of legal ground. Technical details, such as which server stores the email sent by a form or where the plugin processing the form saves data, are often clarified using the knowledge of the person who set up the website.
What information should a privacy notice contain?
A privacy notice informs the person whose personal data is processed about who processes the data, for what purpose, on what legal ground, and to whom it may be transferred, and must be provided when the data is obtained. The Authority’s page on the obligation to inform groups the topics required in the text into five items, based on Article 10 of the Law:
- The identity (business name) of the business processing the data (the data controller) and its representative, if any
- The purpose of collecting the data
- The recipient groups with whom the data may be shared and the reason for sharing
- The method by which the data is collected and the legal ground on which it relies
- The person’s rights under Article 11 and how to exercise them
The same page emphasizes that the data subject must be informed in all cases, whether processing relies on explicit consent or not. In practice, a link to a short privacy notice specific to that form is placed immediately below each form. Although a single long “privacy policy” page may seem sufficient, the decision cited in the Authority’s cookie guide states that general notices covering many topics together do not mean the obligation to inform has been fulfilled.
When is explicit consent required?
Explicit consent is required when personal data processing cannot rely on any of the other conditions listed in Articles 5 and 6 of the Law; if a ground such as entering into a contract, a legal obligation, or legitimate interest exists, separate consent is not requested. The Authority’s information page on explicit consent states that consent must relate to a specific subject, be based on information, and be expressed freely; consent obtained through general statements such as “all kinds of data processing activities” is considered invalid.
| Website activity | Possible legal basis | Point to consider |
|---|---|---|
| Responding to a quote request form | Meeting a request before entering into a contract | Data is used only for this response |
| Order delivery and invoicing | Performance of a contract, legal obligation | The retention period is determined by legislation |
| Sending campaign emails | Explicit consent and separate commercial message approval | The checkbox cannot be preselected |
| Behavioral advertising cookies | Explicit consent | Entering the website does not count as consent |
In website KVKK compliance work, this table provides only a common framework; the same activity may rely on a different legal ground on different websites. Requesting consent unnecessarily also creates problems, because consent can be withdrawn, and the activity relying on it must stop as soon as it is withdrawn.
Page contents
Why are information and explicit consent handled separately?
Providing information and obtaining explicit consent are different legal acts, and both must be fulfilled separately for an activity based on explicit consent. The Authority’s cookie guide explicitly states this distinction, referring to subparagraph (f) of paragraph one of Article 5 of the regulation known as the Communiqué on Information Obligations and the Board’s Decision No. 2020/173 dated 27.02.2020. In addition, through its Principle Decision No. 2026/347 dated 18.02.2026 (Official Gazette, 24.03.2026, issue 33203), the Board ruled that for processing based on explicit consent, the privacy notice and explicit consent text must be prepared as separate texts under different headings.
The practical meaning for a web form is simple: a single checkbox such as “I have read and accept the privacy notice” confuses the two acts. In a correct design, the privacy notice is presented as a link or information note; under Principle Decision No. 2026/347, the data subject may only be asked to confirm that they have read the text and been informed, rather than to approve or consent to its statements. If explicit consent is required, a separate, unselected box is provided for each purpose. Allowing the form to be submitted without giving consent shows that consent has not been made a precondition of the service.
Let us identify the website’s data collection points together
During the free initial assessment, the website’s forms, plugins, cookies, and third-party tools are listed from a technical perspective; missing texts and checkboxes are identified and their locations shown. Working with a lawyer on the content of legal texts is recommended, while the technical implementation is carried out together on the website.
Who must register with VERBİS?
Under Article 16 of the Law, natural and legal persons processing personal data must register with the Data Controllers Registry Information System (VERBİS) before starting data processing; however, the Board may introduce exemptions from this registration obligation based on objective criteria. The exemption most relevant to small and medium-sized businesses is based on employee numbers and annual balance sheet totals.
According to the Authority’s public announcement dated January 12, 2026, under the rule updated by the Board’s Decision No. 2025/1572 dated 04.09.2025, the following data controllers are exempt from registration: those with fewer than 50 employees annually and an annual balance sheet total below 100 million Turkish lira whose main activity is not processing special categories of personal data; and those whose main activity is processing special categories of data but who have fewer than 10 employees annually and an annual balance sheet total below 10 million Turkish lira.
The same announcement also conveys the clarification made by the Board’s Decision No. 2025/2393 dated 25.12.2025: both criteria are required together for data controllers keeping accounts on a balance sheet basis, while only annual employee numbers are considered for those not keeping accounts on a balance sheet basis. The exemption removes only the registry registration obligation; other obligations, such as providing information, data security, and responding to requests, continue unchanged. Since thresholds can change through Board decisions, the Authority’s current announcements should be checked before deciding on registration.
What did the 2024 amendment introduce for international data transfers?
Article 9 of the Law, governing the transfer of personal data abroad, was amended by Law No. 7499, and the new provisions entered into force on 01.06.2024; transfers are now subject to a tiered framework consisting of adequacy decisions, appropriate safeguards, and occasional circumstances. The Authority’s international transfer page explains these three tiers as follows:
- Adequacy decision: If the Board decides that adequate protection exists in a country, specific sectors in that country, or international organizations, a transfer may take place if one of the Law’s processing conditions is met.
- Appropriate safeguards: If there is no adequacy decision, the parties establish safeguards themselves: they sign the standard contract announced by the Board, apply approved binding corporate rules for group companies, or prepare an undertaking approved by the Board.
- Occasional circumstances: If neither route can be used, transfers may take place only in the limited, nonregular circumstances listed in the Law.
For websites, this provision comes into play more often than people assume. Using a hosting service with servers abroad, a form tool storing form data on servers abroad, or foreign-based email marketing or customer relationship software results in personal data being transferred abroad. When the Authority’s page was checked on September 25, 2026, it stated that the Board had not yet designated countries where adequate protection exists.
If there is no adequacy decision, the most common appropriate safeguard is the standard contract announced by the Board. Paragraph five of Article 9 of the Law requires the Authority to be notified within five business days of signing the standard contract, and failure to provide this notification is separately subject to an administrative fine under Article 18 of the Law. Considering the server’s location from this perspective when selecting hosting is one of the aspects of the hosting selection decision beyond speed.
What measures are taken on the website for data security?
Article 12 of the Law obliges the data controller to take technical and administrative measures to prevent unauthorized access to and unlawful use of data and to store it securely; if a service provider processing data is used, responsibility for these measures is shared with that provider. The basic measures specific to a website are:
- Serving all pages over an encrypted connection with an SSL certificate
- Allowing only necessary people to access the administration panel, using strong passwords and two-step verification
- Regularly updating the core software, theme, and plugins, and removing unused plugins
- Not retaining form data longer than necessary or allowing it to accumulate in email inboxes
- Regular, encrypted backups stored off the website
- Keeping records showing who accessed which data
These measures are not one-time tasks; a plugin that is not updated may become a vulnerability over time, and website KVKK compliance breaks down in practice even if it appears complete on paper. WordPress maintenance support for regular updates and backups can be planned from the setup stage.
How does the 72-hour rule work in a data breach?
When it becomes known that personal data has been obtained by others through unlawful means, the Board must be notified without delay and in all cases within a maximum of 72 hours, under the Board’s Decision No. 2019/10 dated 24.01.2019. The Authority’s data breach notification announcement states that the expression “as soon as possible” in Article 12 of the Law is interpreted in this way. The steps of the decision as they apply to website owners can be listed as follows:
- When a breach is discovered, prevent the attack from continuing, change access credentials, and preserve evidence.
- Identify the types of data and the individuals affected.
- Notify the Board using the Personal Data Breach Notification Form published by the Authority; if information cannot be supplied all at once, complete it in stages.
- If notification could not be made within 72 hours, explain the reason for the delay along with the notification.
- After identifying the affected individuals, inform them as soon as reasonably possible.
- Record the breach, its effects, and the measures taken; review a previously prepared breach response plan.
Cleaning a hacked website and closing the vulnerability are the technical side of this process; the steps to follow for a compromised WordPress website are explained on the hacked website recovery page.
How should data subject requests be answered?
Article 11 of the Law grants individuals rights such as learning whether their data is processed and requesting its correction or deletion, and Article 13 requires these requests to be resolved as soon as appropriate to their nature, without exceeding thirty days. For website KVKK compliance, this means clearly stating in the privacy notice which channel requests should use and establishing a system in which incoming requests will not be lost.
For small businesses, the most practical solution is to designate a separate email address for requests and record each incoming request with date, subject, and outcome columns. When a deletion request is received, remember that the data must be removed not only from the form inbox but also from email archives, customer tables, and backups.
Where do cookies fit into this picture?
When data relating to identifiable individuals is processed through cookies, cookie use is also a data processing activity assessed under KVKK, and the information and legal-ground rules above apply here too. The Authority’s guiding document on this subject is the Guidelines on Cookie Practices; distinguishing cookies essential to website operation from advertising and marketing cookies, designing the consent panel, and transmitting consent signals to advertising platforms form a subject broad enough for a separate article.
Common mistakes in KVKK compliance
The most common mistake is publishing a privacy notice copied from another website without examining your own data processing activities at all; if the text does not describe what actually happens on the website, the obligation is not considered fulfilled. Other frequently encountered mistakes include:
- Combining information and explicit consent in a single checkbox
- Presenting the marketing permission checkbox preselected
- Failing to mention anywhere in the text that foreign-based tools are used
- Keeping form data indefinitely in an email inbox
- Assuming a VERBİS exemption without checking
- Never having prepared a breach response plan
Compliance is not a task completed once and then left alone: when a new form, plugin, or marketing tool is introduced on the website, the inventory and texts are updated too. Planning these points from the start when building a corporate website requires less effort than making corrections afterward; the setup process is explained on the corporate web design page.
Let us set up forms and checkboxes correctly
For those curious about their existing website’s status, those who want to plan KVKK correctly from the start when building a new website, and those who want to address gaps immediately, the first step is a technical review of the website’s data collection points. The legal content of the texts is clarified with a lawyer; forms, checkboxes, and security settings are implemented and tested on the website.
Related guides
Frequently asked questions
Does every website need a privacy notice?
If the website collects personal data such as names, phone numbers, or email addresses, information must be provided when the data is obtained. Providing information is mandatory in all cases, whether processing relies on explicit consent or not.
Is explicit consent required for every form?
No, explicit consent is required only if processing cannot rely on one of the other legal grounds listed in the Law. Activities such as responding to a quote request can often rely on another legal ground; a lawyer should assess the specific situation.
Who is exempt from VERBİS registration?
Under the rule updated by the Board’s Decision No. 2025/1572, those with fewer than 50 employees annually and an annual balance sheet total below 100 million TL whose main activity is not processing special categories of data are exempt from registration. For those whose main activity is processing special categories of data, the thresholds are 10 employees and 10 million TL.
How is the VERBİS threshold applied to businesses not keeping accounts on a balance sheet basis?
According to the Board’s Decision No. 2025/2393 dated 25.12.2025, only the annual employee number criterion is considered for these businesses. For those keeping accounts on a balance sheet basis, the employee number and balance sheet criteria are required together.
Does hosting a website on a server abroad cause a KVKK issue?
If the server is abroad, personal data is transferred abroad and the rules in Article 9 of the Law apply. If there is no adequacy decision, an appropriate safeguard such as a standard contract must be provided, and the Authority must be notified of the contract within five business days of signing.
How soon must a data breach be reported?
Under the Board’s Decision No. 2019/10, the breach is reported to the Board without delay and no later than 72 hours after it becomes known. Affected individuals are informed as soon as reasonably possible after they are identified.
How soon must a data subject request be answered?
Under Article 13 of the Law, the request must be resolved within thirty days. As a rule, this is free, but if processing requires additional cost, the fee in the Board’s tariff may be charged.
Call us
Call us for detailed information.
Let us call you!
Share your number and let us call you!
Our other services
- › Corporate web design
- › E-commerce website development
- › SEO optimization
- › WordPress website development
- › Google advertising management
- › WordPress speed optimization
Service areas
- › Web design in Sakarya
- › Web design in Tekirdağ
- › Web design in Bursa
- › Web design in Beşiktaş
- › Web design in Şişli
- › Web design in Tuzla
- › Web design in Ümraniye
- › Web design in Kadıköy
- › Web design in Istanbul
- › Web design in Ankara
- › Web design in Ataşehir
- › Web design in Üsküdar
- › Web design in Kartal
- › Web design in Maltepe
- › Web design in Pendik
- › Web design in Kocaeli
- › Web design in İzmir
- › Web design in Antalya
