Months have passed for KVKK compliance, audit costs have risen — who is supposed to audit this?

i experienced the same. the companys operations manager controlled the consultant and got a weekly report saying 'this is done this is left'. then hired an independent auditor and got a 'compliant' certificate.

Who decides if you are 'compliant' with KVKK? The consultant, the auditor, or the Board? Because consultants say 'compliant' but auditors say 'i think so'

edit: fixed a few typos.

There is a 'Data Controller Guide' on the Privacy Board's official website. Download that guide and check the consultant's structures step by step.

Sign a new contract with the consultant, put a written condition 'complete compliance in 6 months'. At the end, hire an independent auditor and get a 'compliant' certificate.

hiring a kvkk consultant = like hiring a chef to see 'how delicious this meal will be'. the consultant does the compliance but the auditor says 'how tasty' it is.

The answer above hits the nail on the head. When we decide without measuring, we always end up in the same place.

Taking measures without an inventory leaves doors you haven't seen open.

There is something to watch out for. The biggest time-waster for us was not knowing who had the final say.

If you have questions, write them; I'll answer as best I can.

Same here.

This thread is archived.

Saved.

there are three things to check when doing this and if you scold false alarms nobody will report again.

when making a decision fisrt look at what data you have on hand.. then this is my opinion Im not claiming its absolute truth.

Here's how it went for us. Everyone rushing into kvkk compliance process gets stuck at the same point.

Hasty decisions become decisions you have to fix six months later. Proven by experience.

It's rare to find an explanation this clear.

my question might sound amateurish, sorry about that and everything goes well for the first three months; problems arise in the fourth.

if you scold false alarms nobody will report again. like if I were you Id go this route.

do you tink this works at any scale? hasty decisions become decisions you have to fix six months later.

the harder it is to reverse a decision the slower you should make it... of course, it variees if your situation is different.

you're right. don't hesitate to ask; those who don't ask always pay more.

just because everyone does it doesnt mean its right. honestly hope this helps.

There is something to watch out for. People defend habits, not processes. Resistance comes from there.

Having backups accessible on the same network and with the same identity makes them part of the target. Hope this helps.

Same here. When making a decision, first look at what data you have on hand.

Proven by experience.