What is KVKK (Personal Data Protection Law)?
Personal Data Protection Law (KVKK): Pursuant to the Law on Protection of Personal Data No. 6698 published in the Official Gazette No. 29677 on 07.04.2017, KVKK, along with religious beliefs, ethnic origins, language, sect, health, sexual life, association, foundation or union membership, clothing, criminal situations and security measures, biometric and genetic data are also called special personal data.
All forms of processing on data, such as obtaining and storing all or part of this personal data automatically (provided that it is part of any data recording system) or non-automatic means, rearrangement or transfer it to another place, or preventing the use of personal data, are called processing.
KVKK Consultancy: KVKK consultancy is the service needed for the continuous protection and preservation of the data that companies, institutions, and organizations, real or legal persons should be able to maintain their business continuity. The data processed daily by companies go through processes that differ from each other. By taking administrative measures with KVKK solutions in order not to encounter any data problems while going through these processes personal data of individuals are protected by data controllers.
KVKK COMPLIANCE CONSULTANCY
Since the protection of personal data requires KVKK consultancy, compliance processes are carried out with the smallest details in mind. KVKK consultancy can provide consultancy in 3 different ways:
- KVKK Legal (Administrative Measure) Consultancy
- KVKK Process Consultancy
- KVKK Technical Consultancy
Legal (Administrative Measure) Consultancy
It is the KVKK consultancy service that enables companies to take administrative measures and fulfill all legal transactions in accordance with the laws published in the Official Gazette No. 29677 of the institution applying for consultancy service. Legal advisors create the necessary policies together with the data controller.
Since data controllers are the ones who determine the purposes of processing personal data and how it will be processed into the data recording system, they should be one of the most senior management persons of the firm or company.
KVKK consultancy, administrative measures;
- The preparation of the personal data system and the legal fulfillment of all the systems that need to be registered is one of the most basic conditions of being in harmony in the works.
- All processes such as regulating the corporate policy of the institution, organization, or company in accordance with the law, having access permission, ensuring information security, duration of use of personal data, protecting or deleting personal data, and destruction should be specified under administrative measures.
- The works between the data controller and the data controller or between the data controller and the data processor are protected by legal contracts.
- Personal data increases protection law compliance by specifying explicit consent with confidentiality commitments.
- KVKK provides in-house periodic or random audits thanks to legal consultancy.
- Risk analyzes are made with KVKK consultancy services.
- With the addition of provisions in accordance with the law, the employment contract and disciplinary regulation are in the legal process.
- Crisis management within corporate communication, processes of informing real or legal persons, and reputation management are under administrative measures.
- Training and awareness activities with KVKK consultancy
- The process of notifying the necessary information of the institution to the data controller’s registry information system is done under the legal consultancy of KVKK.
KVKK Process Consultancy
It is the stage of organizing and designing the internal processes in the institution in line with the policies created by the legal professionals formed with the protection and consultancy of personal data. All technically necessary inventories are determined in this process and progress is recorded.
With the consultancy of personal data protection law, creating data inventories details and making the detailed report ready for classification (keeping, deletion, legal agreements related to the protection of personal data that the organization should publish, making the legal agreements compatible with the KVKK by going through the documentation process, creating the explicit consent text and clarification texts.) takes its final form and becomes ready.
Technical Consultancy for Personal Data
KVKK consultancy service is the consultancy process that takes place in the light of purely technical information, after the legal and process consultancy, data free from user errors due to manifests and policies.
Since man-made policies can always lead to leaks or open problems, the most dynamic and effective measures of institutions are formed by technical measures. With consultancy and technical measures, authorization matrix and authorization control, access logs, user account management, network, and application security and walling, an encryption technique, control by a penetration test, intrusion detection, and prevention systems log recording processes, creating software to prevent data masking and data loss, backup systems, up-to-date antivirus systems, deleting, destroying or anonymizing data, key management is under technical measures.
One of the most important of the consultancy process is technical consultancy. This is explained in K.V.K.K. No 6698 article 12 as;
The data controller is obliged;
a) To prevent the unlawful processing of personal data,
b) To prevent unlawful access to personal data,
c) To take all kinds of technical and administrative measures to ensure the protection of personal data and to ensure the appropriate level of security.
(2) In the event that personal data is processed by another real or legal person on their behalf, the data controller is jointly responsible along with these persons to take the measures specified in the first paragraph.
(3) The data controller is obliged to carry out or have the necessary audits carried out in their own institution or organization in order to ensure the implementation of the provisions of this Law.
(4) Data controllers and data processors cannot disclose the personal data they have learned to others in violation of the provisions of this Law and cannot use them for purposes other than processing. This obligation continues even after leaving office.
(5) In case the processed personal data is obtained by others illegally, the data controller shall notify the relevant person and the Board as soon as possible. If necessary, the Board may announce this situation on its own website or by any other method it deems appropriate.
Penalties to be Paid in Case of Violation of KVKK
According to Article 18 of the Personal Data Protection Law No. 6698, Section 5 “Crimes and Misdemeanors”:
(1) With The Law administrative fine is imposed upon;
a) From 5,000 Turkish Liras to 100,000 Turkish Liras for those who do not fulfill the obligation to clarify as stipulated in Article 10,
b) From 15,000 to 1,000,000 Turkish liras for those who do not fulfill their obligations regarding data security stipulated in Article 12,
c)From 25,000 Turkish liras to 1,000,000 Turkish liras for those who do not fulfill the decisions given by the Board in accordance with Article 15,
d) From 20,000 Turkish lira to 1,000,000 Turkish liras for those who violate the obligation to register and notify the Data Controllers Registry stipulated in Article 16
(2) Administrative fines stipulated in this article are applied to real persons who are data controllers and legal entities of private law.
In order to stay out of the sanctions of fines in the law with KVKK consultancy, organizations or companies both protect personal data with KVKK expertise and act in accordance with the law by preventing such penalties.
