Turkey KVKK

Turkey Personal Data Protection Law - VERBIS registration, lawful processing, data subject rights.


Short name	KVKK
Region	Middle East & Africa
Country or scope	Turkey
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers KVKK

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for KVKK.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for KVKK and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`TR-KVKK-12` Data Security Obligations	Controllers must take all necessary technical and organizational measures to prevent unlawful processing and ensure an appropriate security level; verifiable integrity across the software inventory evidences such measures (Law 6698 Art. 12)	Scan
`TR-KVKK-12-5` Breach Notification Readiness	If processed data is obtained by others unlawfully, the controller must notify the data subject and the Board without delay; rapid breach scoping requires known versions across the processing software (Law 6698 Art. 12(5))	Scan
`TR-KVKK-16` VERBIS Registration	Data controllers must register with the Data Controllers' Registry (VERBIS) before processing, declaring identifying details of their processing; a uniquely identified, timestamped SBOM supports registry-grade documentation (Law 6698 Art. 16)	Scan
`TR-KVKK-4` General Principles Including Accuracy	Processing must be accurate, up to date where necessary, and limited to its purpose; applying the same discipline to the processing environment requires components with complete names and versions (Law 6698 Art. 4)	Scan
`TR-KVKK-9` Transfers Abroad Readiness	Personal data may be transferred abroad only with consent or under adequate-protection conditions approved by the Board; determining which systems transfer what requires precisely identifiable components (Law 6698 Art. 9)	Scan
`TR-KVKK-12-2` Joint Security Responsibility with Processors	Where data is processed on the controller's behalf, controller and processor are jointly responsible for the security measures, requiring visibility into the suppliers behind the processing software (Law 6698 Art. 12(2))	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`KVKK-ART4`	Core Data Processing Principles (Art. 4)
`KVKK-ART5`	Lawful Basis for Processing Personal Data (Art. 5-6)
`KVKK-ART9`	Cross-Border Data Transfers (Art. 9)
`KVKK-ART10`	Obligation to Inform Data Subjects (Art. 10)
`KVKK-ART11`	Data Subject Rights (Art. 11)
`KVKK-ART12`	Data Security Obligations (Art. 12)
`KVKK-ART16`	VERBİS Registration (Art. 16)
`KVKK-DPIA-1`	Data Processing Impact Assessment

Policy templates

Written for KVKK:

KVKK: Aydınlatma Metni / Illumination Text
KVKK: Data Subject Application Procedure (Başvuru Prosedürü)
KVKK: Data Breach Notification Procedure

And 22 from the standard set, adapted to KVKK.