What a website must have: legal, technical and commercial.
What a company website must have falls into three groups: legal (a personal data privacy notice, cookie information, the company’s identifying details), technical (a secure connection, a single address, a sitemap, speed and accessibility) and commercial (pages that say what you do, for whom, how you prove it and how to reach you).
A warning up front: the legal section on this page is not legal advice. Which obligation binds you depends on the type of your company, your activity and what the site does; for a binding answer, consult a lawyer and always verify the current requirement with the official source. Below we give the official source next to every legal point; the source list at the end of the page also consists only of official sites.
The technical and commercial sections, on the other hand, are directly our business: in corporate web design projects we build them as part of the deliverable. The general framework is in the guide what to watch for when having a website built.
Does a website need a KVKK privacy notice?
A site that collects personal data through a contact form, a newsletter sign-up or a quote request faces the obligation to inform under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK). According to the summary by the Personal Data Protection Authority, the data controller informs the data subject of the following when obtaining the data:
- The identity of the data controller and, if any, its representative
- The purpose for which the personal data will be processed
- To whom and for what purpose the data may be transferred
- The method and legal basis of data collection
- The rights listed in Article 11 of the Law
The procedure is set out in the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, published in the Official Gazette of 10 March 2018, issue 30356. Rather than copying a ready-made template, the text needs to describe the data the site actually collects; you know best which fields are collected while the site is being built.
When are cookie information and a cookie banner required?
The Authority’s Guide on Cookie Practices (July 2025 edition) classifies cookies by purpose. Cookies strictly necessary for the site to function can rely on processing conditions other than explicit consent; cookies for advertising and behavioral tracking, however, require explicit consent. The guide states two points explicitly: merely having entered the site does not mean consent to cookies has been given; and presenting the “accept”, “reject” and “preferences” buttons of a cookie banner as equal in color, size and font is an example of good practice.
The practical consequence: whether a cookie banner is required depends on which cookies the site uses. So the first task is to measure what the site actually leaves behind. Our own experience: this site uses no cookies and runs no analytics; therefore it has no cookie banner either. The two technical keys left in the browser sit in session storage and are listed by name in the privacy notice. The text and the site’s behavior are compared in the test suite: if the site writes a new key and the text does not mention it, the suite turns red. This text was not written by a lawyer either, and its own record states that its legal adequacy requires a lawyer’s review — having been measured does not mean it is legally sufficient.
Are company details (an imprint) mandatory on the site?
The answer differs by company type and activity; two official regulations come up often. Article 3 of Law No. 6563 on the Regulation of Electronic Commerce requires the service provider, before a contract is concluded via electronic communication tools, to present its identifying details in an up-to-date form that recipients can easily access; the same article also states that the parties may agree otherwise where they are not consumers.
Article 1524 of the Turkish Commercial Code No. 6102, in turn, requires capital companies subject to audit under the fourth paragraph of Article 397 to open a website within three months of registration in the trade registry and to dedicate a specific section of the site to announcements required by law; according to the same article, these provisions do not apply to capital companies not subject to audit. Whether your company falls within this scope is a question for your accounting and legal advisers; the summary here is not legal advice.
Is accessibility a legal requirement?
For some organizations, yes. Presidential Circular No. 2025/10, published in the Official Gazette of 21 June 2025, gives a list ranging from public institutions to banks and private hospitals one year, and service providers engaged in electronic commerce under Law No. 6563 two years; the details are in the guide the Presidential Circular and the Ministry checklist. For a company outside its scope, accessibility can still come up through a customer’s audit or through sales to consumers in Europe.
How can you see the cookies a site uses?
There is a way that requires no technical knowledge. Open your site in a desktop browser, right-click on the page and choose “Inspect”; in the developer tools that open, the “Application” tab lists cookies, local storage and session storage. Repeat the same check after filling in a form: some cookies are only written after an interaction. Every entry you see in the list should have a counterpart in the privacy notice; a cookie mentioned in the notice but absent from the browser, and a cookie present in the browser but not mentioned in the notice, are both a mismatch.
When should the legal texts be updated?
The text should change when the site’s behavior changes: when a new form field is added, when an analytics or advertising tool is installed, when the service that forwards form data changes, when a component from another provider, such as a map, a video or a chat window, is embedded in the site. Most of these changes are made on the software side, and the person who wrote the text never hears about them. That is why, in our method, the privacy notice is not a document written once and forgotten but a part tested together with the site’s behavior. If your site has no such automated test, add a rereading of the text after every software change to the maintenance list.
What must a website have technically?
- Secure connection → every page should open over https, and http requests should be permanently redirected to https.
- Single address → every page should be reachable under a single spelling; the www and non-www versions should be consolidated into the same address.
- Sitemap and robots.txt → tell the search engine which pages exist and which may be crawled.
- Meaningful 404 page → should show a lost visitor a way forward; the old site’s addresses should be part of the redirect plan.
- Speed → with a target measured on real users; the criterion should be written down.
- Accessibility → keyboard navigable, visible focus, sufficient contrast, labeled form fields.
The fourth item is the one most often skipped. In September 2026, 70 of the addresses left out of the index in this site’s Search Console returned 404; the samples tested were addresses left over from the domain’s previous site. If the list of old addresses is not compiled when a new site is built, links earned in the past go to waste.
What must a website have commercially?
- What you do → its own page for every service or product group.
- Who you do it for → sector, scale, market; the visitor should be able to recognize themselves.
- Evidence → work, case studies, certificates; claim and evidence on the same page.
- Who you are → imprint: people, address, history.
- The next step → contact form, quote request, phone; reachable from every page.
How each of these sections should be written for both the human and the machine reader is covered in the guide what a corporate website should look like. Additional rules for manufacturers with a product catalog, a quote flow and sales in several languages are on the B2B website page.
A legal text that does not describe what the site actually does is mere decoration.
If you want to see these answers on your own site, corporate web design delivers design, code and technical SEO from one hand, on a measurable budget.