Audit isn't a day,
it's a system that runs daily.

Under KVKK, every data controller has a registration obligation in the Data Controllers Registry Information System (VERBIS). It applies to companies with more than 50 employees per year or annual balance over 100M TL; some exemptions exist below that threshold, but anyone processing special-category data (health, criminal, biometric etc.) must register regardless. Registration is not one-off — it must be updated when processing purposes change. Failing to register attracts administrative fines of 100K-1.5M TL.

They share the same logic but are not identical. KVKK entered force in Turkey in 2016, GDPR in the EU in 2018. Many core principles overlap: purpose limitation, data minimisation, accountability. But GDPR is much stricter — SCCs are required for cross-border transfers, the DPO appointment threshold triggers more often, subject-request deadlines are 30 days, breach notification is 72 hours, and fines can reach 4% of global annual turnover. A Turkish company with EU presence or selling to EU residents must apply both. Our practical advice: design to GDPR, align to KVKK — never the reverse.

If you don't directly sell goods/services into the EU and don't monitor EU residents' behaviour, GDPR may not apply to you directly. But indirect scope is much wider: an EU visitor filling in a form, an EU supplier whose data you process, an EU-based employee — each touches GDPR. On top of that, your B2B customers may contractually require GDPR-grade compliance. Designing at GDPR level while complying with KVKK makes future customer DPIAs much easier. "We don't need it yet" usually costs more later.

Yes — both KVKK Art. 5/1 and GDPR Art. 6 + ePrivacy Directive forbid placing cookies without informed consent. There is an exception for strictly necessary cookies (session, cart); but analytics, marketing and profiling cookies require active opt-in. A banner that loads cookies before you click "Accept", a "Continue" link that counts as consent, trackers that still fire on refusal — all are grounds for fines. Turkey saw dozens of brands fined in 2024 for exactly this. The correct setup: CMP + GTM consent mode + every tracker fired only behind the consent gate.

Under GDPR a DPO is mandatory in three cases: being a public body, having core processing that is large-scale systematic monitoring, or core processing of large-scale special-category data. Outside these it is recommended but optional. KVKK requires a "contact person" — every company on VERBIS must register one with the regulator. The DPO or contact-person role can be filled in-house or taken as DPO-as-a-Service; we run the second model often. No conflict of interest, structural independence and direct reporting to top management are critical.

Within the EU, transfer is free. Outside the EU you need a transfer mechanism: either to a country with an adequacy decision (UK, Switzerland, Japan etc.), or under signed Standard Contractual Clauses (SCCs). For the US you can use vendors certified under the EU-US Data Privacy Framework (2023); for non-certified US vendors, SCCs plus a Transfer Impact Assessment (TIA) are required. From Turkey to the EU, KVKK Art. 9 has no "adequate protection" decision; transfer is by written undertaking + regulator approval or by explicit consent. Setting these up correctly is the single most-missed item in most audits.

Under GDPR, notification to the supervisory authority is mandatory within 72 hours. If "high risk" to subjects, notification to data subjects is required without undue delay. KVKK says "as soon as possible"; in practice the regulator interprets this as 72 hours. Missing the deadline brings a separate fine from the breach itself — often half of the main fine in case decisions. Our runbook: suspected breach → triage within 1h → scope confirmed within 4h → official text drafted within 24h → notification + subject communication within 72h. Without pre-prepared text, contact list and decision tree, you don't make the deadline.

KVKK fines are indexed annually for inflation. For 2024: failure to inform 47K-940K TL, failure to secure data 141K-9.4M TL, failure to comply with a regulator decision 235K-9.4M TL. GDPR has two tiers: minor infringements up to 2% of global annual turnover or €10M; major infringements up to 4% or €20M (whichever is higher). On top, customer churn, contract penalties and brand damage can be many multiples. British Airways was initially proposed at £183M for its 2019 breach, reduced to £20M — small companies don't survive that.