KVKK is mandatory for every company that processes personal data, from a one-person sole trader to a large group, because virtually every business handles employee, customer, visitor or website data.
- Duties for everyone: privacy notices, a legal basis for each processing activity, technical and administrative security measures, answering data subject requests, deletion or anonymisation, breach notification and cross-border transfer rules.
- Size and activity-based duties: VERBİS registration depends on Board criteria such as employee numbers, balance sheet totals and whether the main activity involves special category data; registered controllers also need a retention and destruction policy.
- Sector notes: healthcare handles special category data, e-commerce adds commercial messaging rules, finance may face additional regulators, and group companies need a legal basis for intra-group transfers.
Start with a data inventory, notices, VERBİS status, documented security measures, written procedures and staff training. Confirm specifics with your advisers. Racurity supports technical compliance, local cloud options and ISO 27001.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
