KVKK-Compliant Websites: What Businesses in Türkiye Must Get Right
Privacy notices, explicit consent, cookie management and data security: a practical checklist for making your website compliant with Türkiye’s KVKK.
If your website has a contact form, a newsletter sign-up or an analytics tool, it processes personal data. In Türkiye, that processing is governed by Law No. 6698 on the Protection of Personal Data (KVKK) — the country’s counterpart to the GDPR. This article explains, in plain language, what a website must do right under KVKK, the most common mistakes and what to watch on the technical side.
Note: This content is general information. For your specific situation, we recommend consulting a legal advisor.
What Personal Data Does a Website Process?
Most businesses only think of form data, but the list is longer:
- Form data: Name, phone, email, message content.
- Technical data: IP address, browser details, server logs.
- Cookie data: Behavioural data collected by analytics, advertising and personalisation cookies.
- Account / order data: Address, billing details, order history.
- Chat data: Messages written to live support or an AI assistant.
The Essentials of a KVKK-Compliant Site
1. Privacy notice
Explain clearly who the data controller is, which data is processed and why, who it is shared with, how it is collected, the legal basis and the rights of the data subject. The notice should be easy to reach from every point where data is collected (below forms, in the footer).
2. Explicit consent — only when needed
Not every processing activity requires explicit consent under KVKK; legal grounds such as performance of a contract or legitimate interest also exist. Consent comes into play for marketing messages, non-essential cookies and some cross-border transfers. Key rule: consent must not be bundled with the privacy notice and must never be collected with a pre-ticked box.
3. Cookie management
Analytics and advertising cookies should not run before the user consents. A good cookie banner offers:
- A "Reject" option as visible as "Accept",
- Category-based preferences (analytics, marketing),
- A way to change the choice later (e.g. a "Cookie settings" link in the footer).
4. Cross-border transfers
If your hosting, email, analytics or AI services are abroad, personal data may be transferred outside Türkiye. This must be disclosed in the privacy notice and the transfer mechanisms set out in the legislation must be followed.
5. Data security and retention
KVKK requires technical and administrative measures, not just text: HTTPS, strong password policies, restricted access, regular backups and deleting unnecessary data after defined periods.
Common Mistakes
- A privacy notice copied from a template that has nothing to do with the business.
- Google Analytics or ad pixels loading before consent.
- A single "I have read and accept the KVKK text" checkbox used for both the notice and consent.
- Form submissions piling up indefinitely in an unprotected inbox.
- No defined channel for data subject requests.
What We Do on the Technical Side
On the sites we build at DijiText, cookies load only after consent, forms are validated on the server and we avoid collecting unnecessary data. On this very site, for example, the message you send through the contact form is used only to get back to you, and analytics tools run only if you allow them. KVKK-ready cookie management is standard in our web design service.
Checklist
- Is your privacy notice up to date and specific to your site?
- Are non-essential cookies blocked before consent?
- Are marketing permissions separate and optional?
- Are services located abroad listed?
- Is form data stored securely and deleted after a set period?
- Is there a channel for data subject requests?
If you would like a technical pre-check of your website, fill in our contact form or message us on WhatsApp (+90 549 511 14 01).
