Blog
Is your website compliant with Turkish data protection law? Cookies, forms and the privacy notice
Most corporate sites have three gaps: a cookie banner shown to everyone, forms that keep no consent record, and a generic privacy notice. What is required and what is not.
Turkey’s Personal Data Protection Law (KVKK) is not a matter of adding a text; it is a matter of how things work. Still, three visible elements on a site, done right, cover a large part of the obligation without annoying visitors. This article covers the technical side; consult your lawyer for the legal assessment.
Cookies: not every site needs a banner
Cookies strictly necessary for the site to work (session, security, language preference) need no consent. Analytics and advertising cookies do. A site that uses only necessary cookies does not need to greet visitors with a banner; listing them in the cookie policy is enough. If you add analytics the banner comes back, but the script must not load until “accept” is clicked; showing the banner while the script already runs in the background is the most common mistake.
Forms: a consent record, not a checkbox
A link to the privacy notice next to the form; the notice should say what the data is used for and how long it is kept.
A separate, unticked consent for commercial messages (marketing e-mail/SMS); this differs from the information required to provide the service.
The record of consent: which version of which text was accepted, when, and in which form. Ticking a box does not create a record; the system has to write one.
The privacy notice: an inventory, not a template
Generic texts downloaded from the internet rarely match what the site actually does. The notice should be derived from the data the site collects (form fields, server logs, cookies) and where it goes (hosting, e-mail provider, payment institution). Every service with servers abroad is a transfer and must be mentioned.
What is needed behind the scenes
A request channel: what happens when a data subject asks for information or deletion? An e-mail address and a 30-day response process must be defined.
Retention: contact form messages should not sit forever; there should be a mechanism that deletes expired ones.
Versioning: when the text changes, old consents must stay tied to the old version; a new version asks for new consent.
Building these three elements — cookies, form consent, privacy notice — while building the site is far cheaper than adding them later. We use the same structure on our own sites.