KVKK covers two sides. On one side are all those who process personal data by automated means or as part of a filing system: companies, sole traders, freelancers, associations, foundations, building managements and public bodies. These are data controllers, while service providers acting on their instructions (payroll firms, cloud hosts, call centres) are data processors and are also covered.
On the other side are the protected natural persons: customers, employees, candidates, visitors and contact persons at business partners. Data about legal entities, such as a company’s trade name or tax number, is not personal data.
- Exceptions include purely household activities, anonymised official statistics, certain artistic, historical, literary or scientific uses, and some public security and judicial activities.
- Being exempt from VERBİS registration does not mean being exempt from KVKK.
- Foreign controllers and cross-border transfers have specific rules that have recently changed.
This is general information; confirm with your lawyer. Racurity supports the technical side of compliance, including data inventory and local cloud options.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
