KVKK compliance is a standard part of everything we build.

Why does KVKK concern your website?

Law No. 6698 on the Protection of Personal Data (KVKK) governs the processing of any information that can be used to identify a person. If your website collects names and phone numbers through a contact form, uses an analytics tool to measure visitors or takes newsletter sign-ups, it is processing personal data.

There is an important point that is often overlooked: legal responsibility lies not with the company that built the site, but with you as the data controller. Even if the site was built by an outside firm, the consequences of any gaps come back to your company.

Common KVKK gaps we see on websites

Certain gaps come up again and again on the websites we review in our free preliminary analysis work.

Cookie consent

The most common problem is analytics and advertising cookies loading before the visitor has given consent. Even when a cookie banner appears on screen, Google Analytics, ad pixels or heatmap tools have often already started running in the background. Another common mistake is not offering a "Reject" option at all, or making it harder than "Accept."

Privacy notice

Article 10 of the law requires that people be informed when their data is collected: who is processing the data, for what purpose, to whom it is transferred and what rights the person has. These are the problems we see most often on websites:

• No privacy notice at all, or no link to it next to the form
• Texts copied from another company, still mentioning that company's name
• Missing data controller details or no way to submit a request
• An email address given for requests that is no longer in use

Explicit consent

A privacy notice and explicit consent are different things: the notice informs, while explicit consent is freely given approval for a specific processing activity. Many forms combine the two in a single checkbox, or present the checkbox already ticked. Both are incorrect practice.

Cross-border data transfers

Services that send data to servers abroad, such as analytics tools, external web fonts, and map and chat plugins, are often used without anyone noticing. Article 9 of the law was amended in 2024, and the rules on transfers abroad were reorganized. That is why it matters to know which foreign services your website connects to and to describe them accurately in the privacy notice.

VERBIS

VERBIS (Türkiye's data controller registry) is the Data Controllers' Registry Information System. Companies whose number of employees or annual balance sheet exceeds certain thresholds, and data controllers in certain industries, are required to register. Whether a company has registered can't be verified from the outside, so our reports only include a note saying "you may be subject to the registration obligation," and we recommend that you check your own status.

Administrative fines are updated every year

The administrative fines set out in Article 18 of KVKK are not fixed; they are updated every year by the revaluation rate determined under the Turkish Tax Procedure Law. This means that amounts you see online may be out of date if no year is given.

To give you an idea, here are some of the ranges applied in 2026 (amounts revalued by Tax Procedure Law General Communiqué No. 585):

For current amounts, rely on the official website of the Turkish Personal Data Protection Authority (kvkk.gov.tr) and the communiqué for the relevant year. For a definitive legal assessment, we recommend consulting a legal advisor.

The Globya guarantee

In the websites and software Globya builds, none of these areas is left incomplete or flawed. This is not an add-on service we charge for separately. All our projects are planned according to the current requirements of regulation and technology; KVKK compliance is a standard part of every delivery.

In practice, this means:

• No analytics or advertising cookie loads before consent is given; rejecting is as easy as accepting.
• Every form has the relevant privacy notice next to it; where explicit consent is needed, it is requested separately and the box is left unticked.
• External web fonts and unnecessary connections abroad are removed wherever possible, and the rest are described clearly in the notices.
• Data submitted through forms is stored securely and protected from unauthorized access.
• Privacy and cookie notices are written specifically for your company, not copied from a template.

If you would like to review KVKK compliance on your current website, take a look at our KVKK compliance service, and see where you stand first with a free preliminary analysis. To make a request, use the contact page.