How do you design a KVKK-compliant website?

Which rules apply?

The core is Law No. 6698 of 2016. Law No. 7499 amended the provisions on special categories of personal data and on transfers abroad; the amendments took effect on 1 June 2024. Alongside the Law, several secondary regulations and guides of the Personal Data Protection Authority concern a website directly:

• Communiqué on the Obligation to Inform (2018) — content and procedure of the privacy notice
• Communiqué on Applications to the Data Controller (2018) — application channels and deadlines
• Regulation on Erasure, Destruction or Anonymisation (2017) — retention and disposal
• Regulation on Transfers Abroad (2024) — standard contracts and notification
• Guide on Cookie Practices (July 2025) — cookies and consent screens
• Personal Data Security Guide (April 2025) — technical and organizational measures
• Board Principle Decision 2026/347 — privacy notice and consent text kept separate
• Board Decision 2019/10 — breach notification within 72 hours

There are neighbouring rules too. A site that sends newsletters or campaign e-mails must also follow Law No. 6563 on the Regulation of Electronic Commerce and the rules of İYS, Turkey’s commercial electronic message management system. A site that takes orders or concludes contracts must show its trade name, MERSİS number, address and registered e-mail (KEP) address under a “contact” heading, under the 2022 e-commerce regulation. The consent requirement for device access in the Electronic Communications Law, according to the Authority’s cookie guide, binds only electronic communications operators; for an ordinary website the applicable rule is the KVKK.

A note: Turkey’s Medium-Term Programme 2026–2028 aimed to complete the alignment of the KVKK with the EU General Data Protection Regulation (GDPR) in the third quarter of 2026. As of October 2026, no such amendment has been enacted. We have collected which texts a website needs in which situation in our guide what a website must have.

First, an inventory: what does your site actually process?

A privacy notice copied from a template often describes things the site does not do and leaves out what it does. The right order is the reverse: first establish what the site actually processes, then write the text.

The places to look: server and hosting logs (IP address, browser information, requested page), forms, analytics and advertising tags, embedded video, maps and social media content, fonts and scripts loaded from other servers, chat widgets, bot verification (captcha), the content delivery network, and the records kept in the browser: cookies, local storage, session storage.

Seeing the browser side requires no technical knowledge. Open the site in a desktop browser, right-click the page and choose “Inspect”. The “Application” tab shows cookies and storage, the “Network” tab shows which servers the page sends requests to. Repeat the check after filling in a form; some tools load only after an interaction.

The Authority’s cookie guide covers only cookies that process personal data; it gives no separate guidance on techniques such as local storage or pixels. EU rules are broader: under Guidelines 2/2023 of the European Data Protection Board (EDPB), every record kept on the device, local storage included, falls within the ePrivacy rule. So do not limit the inventory to cookies.

The privacy notice: what goes in it?

Article 10 of the KVKK requires the data subject to be informed when personal data is obtained. Article 4 of the Communiqué on the Obligation to Inform lists the minimum content: the identity of the data controller, the purpose of processing, to whom and for what purpose the data may be transferred, the method of collection and its legal basis, and the data subject’s rights under Article 11.

Article 5 of the Communiqué also says how the text is to be written: the legal basis is named after the condition in the Law, general and vague wording is not used, the language is plain and understandable, and the text contains no incomplete, misleading or false information. The burden of proving that the notice was given lies with the data controller.

Timing matters as well. In its Decision 2020/173 and in the cookie guide, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) states that because processing starts with the visit, the notice must be given at the point of entering the site. A complex “privacy statement” that also covers other matters does not replace the notice.

Explicit consent: when is it required, and when should it not be asked for?

The most common mistake is asking for consent for everything. Under the KVKK, explicit consent is not used where another condition in Article 5 applies, such as the performance of a contract, a legal obligation or a legitimate interest. In its Principle Decision 2026/347 the Board required the privacy notice and the consent text to be drafted separately: for processing that rests on a ground other than explicit consent, no consent text is presented; only the notice is given, and if desired, feedback that it has been read is collected.

That is why a mandatory consent checkbox is risky. In Decision 2023/692, collecting consent through a mandatory checkbox while another legal ground existed was found contrary to the principle of good faith, and an administrative fine of 300,000 TL was imposed. In Decision 2024/1361, a contact form also obtained consent to use the data for advertising and marketing; the Board found that this consent did not relate to a specific matter and was not given freely.

Cookies: an information banner or a consent panel?

The Authority’s cookie guide classifies cookies by purpose. Cookies needed to carry out the communication and cookies strictly necessary for a service the user has explicitly requested (session, basket, security, an interface preference chosen by the user) do not require explicit consent. Advertising, personalization and third-party analytics cookies do; the guide accepts without consent only first-party analytics cookies that measure the site’s own audience, produce anonymous statistics and do no cross-site tracking.

The guide warns in both directions. It presents a site that uses only necessary cookies but asks for consent as a bad example: pretending to ask about a choice that does not exist is not in line with the law and the principle of good faith. Where consent is required, the first layer offers “Accept”, “Reject” and “Preferences” in equal color, size and font; cookies that require consent are off on first entry; no “cookie wall” makes use of the site conditional on consent; and withdrawing consent is as easy as giving it.

The Board also enforces this. In Decision 2022/1358 a fine of 300,000 TL was imposed because consent was not obtained for non-essential cookies. In Decision 2024/1361, fines of 250,000 TL for using a non-essential analytics cookie without a consent mechanism on first entry and 15,000 TL for a deficient notice were imposed. The site owner is also responsible for cookies set by a third-party service.

Comparing the July 2025 edition of the guide with the 2022 edition, we found one substantive difference, in the section on transfers abroad: a transfer to a cookie provider abroad is no longer assessed under explicit consent but under the transfer rules of Article 9 of the Law.

Forms and newsletters

The contact form is where a site collects the most data. Ask only for the fields you really need; a mandatory phone or job-title field needs its own reason for processing. Place a link to the privacy notice next to the form. If you use a checkbox, make it an “I have read and understood” confirmation, not “I agree”; recording the confirmation together with the current version of the text is a practical way to meet the burden of proof. Since a free-text field may receive special category data such as health information, add a sentence asking people not to share it.

Newsletters and campaign e-mails follow a separate rule. Under Law No. 6563, commercial electronic messages may be sent only with prior consent. Under the implementing regulation, the consent box may not be pre-ticked, consent may not be made a precondition for goods or services, and consent obtained outside İYS is invalid unless it is registered in İYS within three working days. Messages to merchants and tradespeople may be sent without consent, but their addresses must be registered in İYS and their refusal status checked there.

The Board has issued two further warnings. Under Principle Decision 2025/1072, consent to a contract, permission to process data and consent to commercial messages are not obtained through a single action. According to an announcement of 21 July 2026, contact details obtained from third parties do not provide a direct legal basis for advertising and marketing; a purchased address list is therefore not a solution.

Third-party tools and transfers abroad

Most analytics, map, video, chat, captcha and hosting services are abroad; when your site loads these tools, at least the visitor’s IP address goes to that provider. Since the 2024 amendment, Article 9 of the Law sets an order: an adequacy decision for the destination country; failing that, appropriate safeguards; failing both, only the exceptions listed for incidental cases.

As of October 2026, the Board has not issued an adequacy decision for any country. In practice the most common safeguard is the standard contract published by the Board; once signed, it must be notified to the Authority within five working days. In 2026 the fine for failing to notify ranges from 90,308 TL to 1,806,177 TL. The incidental-transfer exceptions are, as the name says, for one-off cases; they do not cover an ongoing hosting relationship.

In design, the ways to reduce transfers are well known: hosting fonts and scripts on your own server, loading video and maps only when the visitor clicks, and setting up measurement without cookies and, where possible, on your own server. A precedent from the EU: in 2022 the Munich Regional Court held that loading Google Fonts from Google’s server was an unauthorised transfer of the visitor’s IP address, and noted that the font could be served from the site’s own server.

Security, retention and data breaches

Article 12 of the Law requires technical and organizational measures to ensure an appropriate level of security. The Authority’s Personal Data Security Guide, renewed in April 2025, sets them out in tables: encrypted connections, authorisation and access management, logging, backups, up-to-date software, penetration testing, contracts between controller and processor, and risk analysis come first.

An example specific to the web: in Decision 2023/1796, after a system change on a company’s website, a caching configuration exposed members’ names, surnames, membership and phone details to anyone. The Board found that the change had not been tested sufficiently before going live and imposed a fine of 200,000 TL. Testing an update before release is a security measure too.

If a data breach occurs, the Board’s Decision 2019/10 requires notification within 72 hours at the latest after the breach becomes known; the Authority repeated this rule in an announcement of 20 January 2026. The affected people are also informed as soon as reasonably possible.

Retention is part of the design as well: form messages, server logs and backups are kept only as long as needed. Under the erasure regulation, preparing a retention and disposal policy is mandatory only for controllers required to register with VERBİS; but the duty to delete data whose period has expired applies to everyone. The periodic disposal interval may not exceed six months, and a data subject’s erasure request is concluded within 30 days at the latest.

Data subject requests

Article 11 of the Law gives data subjects rights such as learning whether their data is processed and requesting its correction or erasure. Under the Communiqué on Applications, a request may be made in writing, by registered e-mail (KEP), with a secure electronic or mobile signature, or from the e-mail address the data subject previously provided and the controller has on record. The answer is given within 30 days at the latest and, as a rule, free of charge.

On 1 October 2026 the Authority issued a reminder: an answer given by phone or in person does not count as the answer the Law requires; it must be given in writing or electronically. If there is no answer or it is insufficient, the data subject may complain to the Board. On the site, this translates simply: the privacy notice states clearly how and to which address a request can be sent.

VERBİS and the 2026 fines

Registration with VERBİS, the Data Controllers’ Registry, is not mandatory for everyone. Under a Board decision, controllers with fewer than 50 employees a year and an annual balance sheet total below 100 million TL are exempt; for controllers whose main activity is processing special category data, the thresholds are 10 employees and 10 million TL. The exemption covers registration only; the obligations to inform, to secure data and the rest continue.

Administrative fines rise every year by the revaluation rate; figures such as 5,000–100,000 TL in the text of the Law are no longer current. The amounts that apply in 2026:

1. Obligation to inform (Art. 10) · 85,437 – 1,709,200 TL
2. Data security (Art. 12) · 256,357 – 17,092,242 TL
3. Failure to comply with Board decisions (Art. 15) · 427,263 – 17,092,242 TL
4. VERBİS registration and notification (Art. 16) · 341,809 – 17,092,242 TL
5. Notification of transfers abroad (Art. 9/5) · 90,308 – 1,806,177 TL

If your visitors come from the EU

If a site offers services to people in the EU with German or English content, Article 3(2) of the GDPR may apply. Two differences then stand out. The first is the legal basis: in the GDPR, consent, contract and legitimate interest are equal grounds in the same list; in the KVKK, explicit consent is the rule and the other conditions are listed as exceptions. The second is device access: Article 5(3) of the ePrivacy Directive, and in Germany § 25 TDDDG, make every record stored on the device, not only cookies, subject to consent unless it is strictly necessary. The joint guidance of the German data protection authorities requires accept and reject options to be offered with equivalent effect.

On transfers, the EU does not count Turkey among the countries with adequate protection; transfers from the EU to Turkey also need appropriate safeguards. The EU–US Data Privacy Framework, on the other hand, is in force: on 3 September 2025 the EU General Court dismissed the action for annulment brought against it, and an appeal is pending.

The big change on the agenda is the “Digital Omnibus” package proposed by the European Commission in November 2025. It proposes moving the cookie rules into the GDPR, one-click refusal and automatic consent signals from the browser. As of October 2026 the proposal is at committee stage in the European Parliament, and the position of the Council of the EU keeps the cookie rules in the ePrivacy Directive. What applies today are the rules above.

What we did on this site

There is no consent screen on this site, because there is no processing that requires consent. We keep this as a measurement, not a statement:

1. First-party cookies · 0 — no cookie header in page responses
2. Third-party requests on first load · 0 — fonts and scripts on our own server
3. Analytics and advertising tags · none
4. Bot verification (hCaptcha) · loads only when you touch the contact form

On entry there is an information banner without consent language: it says what is processed with the visit and why, and links to the privacy notice; after “Got it” it stays hidden for 12 months and reappears if the text changes. Our cookie and browser storage policy lists every record the site keeps in the browser by name, purpose and duration. Our test suite compares every storage key the code writes with this table in three languages; if the code writes a new key that the table does not mention, the test turns red.

Reading aids (marking the last article read and the guides you have opened) are off by default and work only if the visitor turns them on; pencil highlighting in articles is saved only when you press “Mark”. The contact form has no mandatory consent box; it has an “I have read and understood the privacy notice” confirmation, and the confirmation is added to the message together with the current version of the text. When the form passes through our server, the visitor’s IP address is not forwarded to the form service, and server invocation logs are switched off.

The path we follow in client projects

In a project we start the KVKK work by measuring, not by writing a text:

1. Inventory — we open every page type and the main flows in a browser and list every record kept and every request sent
2. Data flow — we establish the purpose, recipient, country and duration of each record and request
3. Design — we remove unnecessary processing: local fonts, embeds that load on click, cookieless measurement
4. Text — we prepare the technical content of the privacy notice and the cookie table from what was measured; the final legal check is your lawyer’s
5. Test — we add a test to the project that compares the text with the site’s behavior

Checklist

1. Inventory · server, forms, third parties, browser storage — also after filling in a form
2. Privacy notice · identity, purpose, recipients, method, legal basis, rights — reachable on entry
3. Consent · only for processing that needs it, in a text separate from the notice
4. Cookies · information for necessary ones, consent with equal options for the rest
5. Forms · necessary fields, no mandatory consent box, confirmation and text version recorded
6. Newsletter · separate consent, unticked box, İYS registration
7. Third parties · safeguards and notification for transfers abroad
8. Security · encrypted connections, current software, tested releases, backups
9. Retention · periods, disposal, a 72-hour breach plan
10. Requests · channel, 30 days, written answer

KVKK compliance is not a text written once and left alone; it is a state that is measured again as the site changes. This article was written with the rules in force as of 30 October 2026; fines change every year and the EU process is ongoing. It is not legal advice; please confirm it for your own site with a lawyer. If you would like to measure together what your site processes, write to us.