We were offered a KVKK compliance package, what should it cover and isn't our lawyer enough on their own?

The project usually runs in three stages. First, you meet with the marketing, accounting, and sales teams to map out what data is being kept. In the second step, the legal basis for this data is reviewed and the legal texts are drafted. In the third step, an IT specialist comes in to check the encryption and access permissions of the database where the data is stored.

We paid 60.000 TL two years ago for a full-package consultancy. What helped us the most was the data inventory spreadsheet. That was how we realized customer data had been sitting forgotten in an old Excel file for 7 years and deleted it. Without that inventory, the documents a lawyer drafts are completely detached from reality.

People who claim a lawyer alone is enough end up scrambling to draft defense statements at the regulator's door once their database leaks online. Just read the Kişisel Verileri Koruma Kurulu penalty bulletins; the fines aren't handed down over wording in your privacy notices, they come from open ports and unauthorized access.

props to your lawyer, very honest of them. there are so many people out there downloading templates off the internet and slapping a law firm stamp on them. i mean claiming youre kvkk compliant without auditing the technical infrastructure is just kidding yourself.

Your annual employee count might be under 50, but does your annual balance sheet total or your primary field of activity push you over the thresholds requiring VERBİS registration? Also, do you store special categories of personal data, such as health or biometric data, in your systems? These details directly determine how urgent the consultancy is.

Instead of paying 80k TL, just get the technical audit and inventory template support from the consulting firm. Fill out the inventory with your own lawyer in 2 weeks. Then patch whatever technical vulnerabilities show up with your existing server host. You'll solve it for half the price.

In our early years, we only had a lawyer draft the legal texts. When a customer sent a data deletion request, nobody could find which servers or backups the data was actually sitting on. The legal counsel said "delete it," but the tech team had no clue where it was. That was the day we realized this doesn't work without an inventory.

Article 12 of the Kişisel Verilerin Korunması Kanunu obligates the data controller to implement both technical and administrative measures regarding data security. While legal texts cover the administrative measures, the audit of technical measures must strictly be conducted by specialists proficient in IT infrastructure.

Thanks a lot, I'll try it today.

I didnt know that.

Saved.

I feel the same way. The biggest time-waster for us was not knowing who had the final say.

Good luck with that.

Good call starting this thread. If 2FA is on, a stolen password alone is useless.

An untested backup is not a backup. If you have questions, write them; I'll answer as best I can.

I went through the same thing.

Here's how it went for us. Don't rely on a single measure; go layer by layer.

Hope this helps.

I'm a small business, let me explain from my side. Most incidents start with a leaked password, not a vulnerability.

Good luck with that.

This thread is archived.

This is exactly what we experienced. Everyone rushing into what is kvkk consulting gets stuck at the same point.