Personal data has become one of the most valuable assets of modern startups.

A technology startup may process information relating to customers, employees, job applicants, website visitors, mobile application users, suppliers, investors and business partners from the first day of its operations.

A SaaS company may collect user names, email addresses, IP addresses and usage logs.

A fintech startup may process financial information and identity data.

A health-tech startup may process sensitive health information.

An artificial intelligence company may use personal data to train, test or operate its systems.

An e-commerce startup may process addresses, telephone numbers, purchase histories and payment-related information.

A mobile application may collect location data, device identifiers, photographs, behavioural information and analytics.

Consequently, compliance with Law No. 6698 on the Protection of Personal Data, commonly known as the KVKK, should not be treated as an issue relevant only to large corporations.

Startups can become subject to significant personal data protection obligations from the moment they begin collecting or otherwise processing personal data.

One of the most common misconceptions among startup founders is:

“We are a small company, so the KVKK does not apply to us yet.”

That assumption is incorrect.

Certain obligations—particularly registration with the Data Controllers Registry, or VERBİS—may depend on statutory exemptions and thresholds. However, exemption from VERBİS registration does not mean exemption from the KVKK itself.

A small startup may still be required to:

• identify lawful grounds for processing;
• comply with data-processing principles;
• provide privacy notices;
• protect personal data through technical and administrative measures;
• regulate relationships with processors;
• respond to data-subject applications;
• delete or anonymise data when processing conditions disappear;
• regulate international data transfers;
• and notify qualifying personal data breaches.

This article explains the principal KVKK obligations for startups in Turkey, with particular attention to the rules applicable in 2026.

Does the KVKK Apply to Startups?

Yes.

The KVKK applies to personal data processing falling within its statutory scope regardless of whether the data controller is a large corporation or an early-stage startup.

The first question a startup should ask is whether it is acting as a data controller.

The Personal Data Protection Authority defines a data controller as the natural or legal person that determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. For a company, the legal entity itself will normally be the data controller for processing activities whose purposes and means it determines.

For example, if a startup decides:

• which customer information will be collected;
• why it will be collected;
• how long it will be retained;
• which software systems will be used;
• and with whom the information will be shared,

the startup will normally be acting as the data controller for those activities.

Data Controller and Data Processor Are Different Concepts

Startups should distinguish between the data controller and the data processor.

A SaaS company may be a data controller for:

• its own employees;
• its own customers;
• website visitors;
• marketing leads;
• and job applicants.

At the same time, the same SaaS company may process information on behalf of a corporate customer and therefore act as a processor for that particular activity.

For example:

A startup provides cloud-based HR software to Company A.

Company A uploads its employees’ information into the platform.

Company A determines why employee information is processed.

The SaaS startup provides the technical infrastructure.

Depending on the contractual and factual structure, Company A may be the controller while the startup acts as processor for the customer-hosted information.

This distinction should be analysed processing activity by processing activity rather than attempting to classify the company permanently under a single label.

The First KVKK Obligation: Create a Personal Data Inventory

A startup cannot become compliant without first understanding what personal data it actually processes.

The company should therefore map its processing activities.

The inventory should identify matters such as:

• categories of data subjects;
• categories of personal data;
• purpose of processing;
• legal basis;
• source of data;
• recipients;
• international transfers;
• retention periods;
• security controls;
• and software systems used.

Typical data-subject groups may include:

• customers;
• application users;
• employees;
• candidates;
• freelancers;
• suppliers;
• company representatives;
• investors;
• newsletter subscribers;
• website visitors;
• and support-ticket users.

Without this inventory, privacy notices, retention schedules and data transfer arrangements are likely to be inaccurate.

What Counts as Personal Data?

Personal data is broader than many founders expect.

It is not limited to:

• national identity numbers;
• passport numbers;
• names;
• or telephone numbers.

Information relating to an identified or identifiable natural person can constitute personal data.

Depending on the circumstances, this may include:

• email addresses;
• IP addresses;
• device identifiers;
• customer IDs;
• location information;
• photographs;
• voice recordings;
• transaction history;
• customer-service records;
• user activity;
• CV information;
• salary information;
• and online account identifiers.

Therefore, a startup that says:

“We do not collect identity card information, so we do not process personal data”

may still be processing substantial amounts of personal data.

Startups Must Comply With the General Data-Processing Principles

Even where a startup has a lawful basis for processing, it must also comply with Article 4 principles.

These include:

• processing lawfully and fairly;
• ensuring data are accurate and, where necessary, up to date;
• processing for specified, explicit and legitimate purposes;
• ensuring processing is relevant, limited and proportionate to those purposes;
• and retaining data only for the period required by legislation or the processing purpose.

The Personal Data Protection Authority stresses that these principles must form the foundation of every personal data processing activity.

This creates one of the most important compliance rules for startups:

Collecting data because it “may be useful later” is not a sufficient privacy strategy.

Data Minimisation Is Particularly Important for Startups

Suppose a food-delivery application only needs:

• name;
• address;
• telephone number;
• and payment-related information

to deliver an order.

Why would it also request:

• marital status;
• occupation;
• nationality;
• date of birth;
• or identity card copy?

Unless a genuine processing purpose and legal basis exists, unnecessary collection may violate the principles of relevance, limitation and proportionality.

Founders often want to collect as much user information as possible because “data may become valuable”.

Under data protection law, however, unnecessary data can become a liability rather than an asset.

Every additional data category creates:

• security risk;
• storage obligations;
• deletion obligations;
• breach exposure;
• and additional due diligence questions.

Every Processing Activity Needs a Legal Basis

Startups should not assume that every personal data processing activity requires explicit consent.

Article 5 of the KVKK provides several lawful bases.

In addition to explicit consent, personal data may be processed without consent where, for example:

• processing is expressly provided by law;
• processing is necessary to protect life or physical integrity in cases of factual impossibility;
• processing is directly necessary for establishment or performance of a contract;
• processing is necessary for the data controller to comply with a legal obligation;
• the data have been made public by the data subject;
• processing is necessary for establishment, exercise or protection of a right;
• or processing is necessary for the controller’s legitimate interests provided that the fundamental rights and freedoms of the individual are not harmed.

The correct legal basis should therefore be identified separately for every processing purpose.

Consent Should Not Be Used Automatically

A common startup mistake is to obtain consent for everything.

For example:

“By registering, you consent to all processing of your personal data for operation of the platform.”

This approach can be legally problematic.

If processing is genuinely necessary for performing the contract, the appropriate legal basis may be contractual necessity rather than consent.

If employee salary information must be processed because of statutory payroll obligations, the appropriate basis may be legal obligation.

The Personal Data Protection Board expressly emphasised in its 2026 Principle Decision that where a processing activity relies on a lawful basis other than explicit consent, data controllers should not additionally present a consent form for that same processing activity.

A startup should therefore conduct a legal-basis matrix rather than treating consent as a universal solution.

What Makes Explicit Consent Valid?

Where explicit consent is actually required, it must satisfy the statutory definition.

Consent must relate to a specific subject, be based on information and be given freely.

This means consent should not be:

• vague;
• unlimited;
• forced;
• hidden inside general terms;
• or unnecessarily bundled with unrelated processing.

For example:

“I consent to all current and future use of my information by the company and all third parties for all purposes.”

would be a problematic consent model.

The startup should define precisely:

• which data;
• for which purpose;
• for which optional processing activity.

Privacy Notice and Explicit Consent Must Be Separate

This became even more important in 2026.

In its Principle Decision dated 18 February 2026, the Personal Data Protection Board highlighted widespread unlawful practices involving privacy notices and explicit consent forms being combined.

The Board stated, among other things, that:

• the privacy notice must be provided independently of consent;
• where consent is relied upon, the privacy notice and consent text should be prepared separately;
• users should not be asked to “approve” the privacy notice as though the notice itself were a consent mechanism;
• and privacy notices should be tailored to the actual controller instead of copied from another company.

This is particularly important for mobile application onboarding.

A startup should avoid a single checkbox saying:

“I accept the User Agreement, Privacy Notice, KVKK consent, commercial messages, cookies and all data transfers.”

Different legal processes should be separated where necessary.

Startups Have an Obligation to Inform Data Subjects

Article 10 creates an information obligation.

When personal data are obtained, the controller must provide information including:

• identity of the controller and, where applicable, representative;
• purposes of processing;
• recipients and purposes of transfers;
• method and legal basis of collection;
• and information regarding the statutory rights of the data subject.

This obligation exists whether the processing is based on consent or another lawful basis.

Therefore:

Privacy notice ≠ consent form.

A privacy notice tells the person what the company is doing.

A consent form obtains permission for a particular activity where consent is the applicable legal basis.

Privacy Notices Must Reflect the Actual Startup

Copying another company’s privacy notice is one of the most common compliance mistakes.

A startup may copy a privacy policy from a large international platform.

The document then states that the startup:

• transfers data to countries it does not use;
• processes categories it never collects;
• relies on legal grounds irrelevant to its business;
• and shares information with nonexistent affiliates.

The Board’s 2026 Principle Decision expressly criticised copied, generic and misleading notices and emphasised that notices must be clear, understandable and adapted to the controller’s actual operations.

Therefore, a privacy notice should be the output of the startup’s data inventory—not a template written before the company understands its data flows.

Special Categories of Personal Data Require Greater Care

Certain information receives stronger protection under the KVKK.

Special categories include data concerning:

• race;
• ethnic origin;
• political opinion;
• philosophical belief;
• religion;
• sect or other beliefs;
• clothing;
• association, foundation or trade-union membership;
• health;
• sexual life;
• criminal convictions and security measures;
• biometric data;
• and genetic data.

Following the reforms that took effect in 2024, Article 6 provides a revised set of lawful conditions for processing special-category data. These include explicit consent and several specifically listed statutory circumstances, such as processing expressly provided by law, certain legal-claims purposes, specified health-related processing and processing necessary for legal obligations in employment, occupational health and safety, social security, social services and social assistance. Additional safeguards determined by the Board remain mandatory.

Why Special Data Matters for Startups

Many startups process special-category information without realising it.

Examples include:

HR Operations

Medical reports provided by employees may contain health data.

Biometric Authentication

Using fingerprints or facial recognition for authentication can involve biometric data.

Health Applications

Fitness, medical and health-tech applications may process health information.

Background Checks

Criminal-record information can constitute special-category data.

Employee Organisations

Trade-union information is specially protected.

Startups processing such data should implement stricter access controls and examine the applicable Article 6 condition carefully.

Startups Must Protect Personal Data Technically and Administratively

Article 12 imposes major data security obligations.

The controller must take all necessary technical and administrative measures to:

• prevent unlawful processing;
• prevent unlawful access;
• and ensure preservation of personal data.

Where personal data are processed by another person on behalf of the controller, the controller is jointly responsible with that processor for the necessary security measures.

This means:

“Our cloud provider caused the breach” is not necessarily a complete defence.

Vendor management is part of KVKK compliance.

What Technical Measures Should a Startup Consider?

The measures should reflect the nature and risk of the data.

Depending on the startup, relevant controls may include:

• multi-factor authentication;
• encryption;
• secure password policies;
• role-based access;
• logging;
• network security;
• firewall protection;
• secure software development;
• patch management;
• penetration testing;
• vulnerability management;
• endpoint protection;
• backups;
• encrypted data transfer;
• database access restrictions;
• API security;
• and regular review of user privileges.

A five-person startup does not necessarily need the same security architecture as a multinational bank.

However, limited resources do not justify having no meaningful security controls.

Administrative Measures Are Equally Important

Cybersecurity is not only an IT issue.

Startups should also establish administrative controls such as:

• employee privacy policies;
• confidentiality agreements;
• incident response procedures;
• access-authorisation procedures;
• vendor assessments;
• employee training;
• data-retention rules;
• internal audit mechanisms;
• onboarding and offboarding procedures;
• and documented responsibilities.

A sophisticated firewall will not protect customer data if a former employee retains administrator access after resignation.

Data Processor Agreements Should Be Reviewed

Startups frequently use third-party providers such as:

• cloud infrastructure companies;
• CRM providers;
• payroll services;
• email platforms;
• analytics providers;
• call centres;
• hosting companies;
• customer support software;
• AI tools;
• and outsourced development providers.

The startup should determine:

• what personal data the provider receives;
• for what purpose;
• whether the provider acts as processor or independent controller;
• what security commitments exist;
• where the information is stored;
• whether subprocessors are used;
• and whether international transfers occur.

Commercial SaaS contracts should therefore be reviewed from a data protection perspective, not only from a pricing perspective.

International Cloud Services Can Trigger Overseas Data Transfer Rules

This is one of the most important issues for Turkish startups.

A startup may use:

• AWS;
• Google Cloud;
• Microsoft Azure;
• foreign CRM systems;
• foreign analytics software;
• US-based AI services;
• foreign email platforms;
• or overseas customer-support tools.

If personal data are transferred abroad, Article 9 must be considered.

The international data-transfer regime was fundamentally revised in 2024.

The current system has three levels:

1. transfer based on an adequacy decision;
2. transfer based on an appropriate safeguard where no adequacy decision exists;
3. exceptional, non-regular transfers under the limited circumstances specified by law where neither of the first two mechanisms is available.

As of the Authority’s current published guidance, the Board has not yet identified any country as a country providing adequate protection under the adequacy mechanism.

This makes appropriate safeguards particularly important in practice.

Standard Contracts Are Important for Startups Using Foreign Providers

One of the principal international transfer mechanisms is the standard contract published by the Personal Data Protection Board.

Different standard forms exist depending on the parties:

• controller to controller;
• controller to processor;
• processor to processor;
• processor to controller.

The amended Article 9 also recognises binding corporate rules and certain other appropriate safeguard mechanisms.

For many startups using foreign cloud or technology providers, the standard contract may therefore become a central compliance mechanism.

Standard Contracts Must Be Notified Within Five Business Days

Signing the standard contract is not the end of the procedure.

Article 9(5) requires the standard contract to be notified to the Personal Data Protection Authority within five business days following signature. The Authority also provides an electronic Standard Contract Notification Module.

This is an easy procedural obligation to overlook.

A startup may correctly sign the appropriate standard contract and still face compliance exposure if the notification obligation is ignored.

Explicit Consent Is Not a General Solution for Routine International Transfers

The current international transfer framework allows explicit consent in certain exceptional circumstances where the data subject has been informed of possible risks.

However, such transfers fall within the exceptional/occasional transfer framework when adequacy and appropriate safeguards are unavailable.

Therefore, a startup continuously transferring all customer information to a foreign cloud infrastructure should not automatically assume:

“We put overseas transfer consent in the privacy form, so the issue is solved permanently.”

Regular and systematic international transfers should be structured under the appropriate statutory mechanism.

Startups Must Have Retention and Deletion Rules

Another major mistake is keeping personal data forever.

Article 4 requires personal data to be retained only for the duration required by the relevant legislation or processing purpose.

When all processing conditions disappear, the data must be deleted, destroyed or anonymised in accordance with the KVKK framework.

The Regulation on Deletion, Destruction or Anonymisation also provides periodic destruction requirements for controllers required to maintain a personal data retention and destruction policy. Where a controller is not required to have such a policy, deletion, destruction or anonymisation must generally occur within three months after the obligation arises.

A startup should therefore establish retention periods for different categories.

Different Data Require Different Retention Periods

There should not necessarily be a single period such as:

“All personal data are retained for ten years.”

Different records may require different periods.

For example:

• accounting records;
• employee personnel files;
• customer accounts;
• unsuccessful job applications;
• support records;
• security logs;
• marketing records;
• and inactive accounts

may have different legal and operational justifications.

The startup should identify the statutory or legitimate business reason for each period.

When the reason disappears, continued retention can become unlawful.

Do Startups Have to Register With VERBİS?

Not every startup is required to register.

Current exemption criteria are particularly important.

Following the Board’s 4 September 2025 decision, controllers whose principal activity is not processing special-category personal data are exempt from VERBİS registration where they have:

• fewer than 50 annual employees; and
• an annual financial balance-sheet total below TRY 100 million.

The same decision also created an exemption for controllers whose principal activity is processing special-category personal data where they have:

• fewer than 10 annual employees; and
• an annual financial balance-sheet total below TRY 10 million.

The Authority subsequently clarified how the criteria apply to controllers that do not maintain books on a balance-sheet basis.

These criteria should be reviewed periodically because the startup may cross the threshold as it grows.

VERBİS Exemption Does Not Mean KVKK Exemption

This point should be emphasised.

A startup may have:

• 8 employees;
• a small balance sheet;
• and no VERBİS registration obligation.

It still needs to comply with other KVKK requirements.

It may still need:

• lawful processing grounds;
• privacy notices;
• data security;
• international transfer mechanisms;
• breach notification;
• deletion processes;
• and responses to data-subject requests.

VERBİS is only one compliance obligation.

Startups Must Respond to Data-Subject Requests

Article 11 grants individuals important rights concerning their personal data.

These include rights to:

• learn whether personal data are processed;
• request information about processing;
• learn the processing purpose;
• learn recipients;
• request correction;
• request deletion or destruction where conditions apply;
• request notification of certain corrections or deletions to recipients;
• object to adverse results arising exclusively from automated analysis;
• and seek compensation for damage caused by unlawful processing.

Startups should create an operational process to receive and respond to these applications.

A privacy notice should not promise a contact mechanism that nobody inside the company monitors.

Requests Should Be Handled Within the Legal Period

Data-subject applications under the KVKK should generally be answered as soon as possible and within the statutory maximum period.

For deletion requests where all processing conditions have ceased, the relevant regulation expressly requires the controller to conclude the request within no more than 30 days.

Accordingly, startups should have a responsible person or team assigned to:

• identify the request;
• verify the applicant where appropriate;
• determine which systems contain relevant data;
• obtain internal information;
• and prepare the legal response.

Trying to design this process only after receiving a complaint creates unnecessary risk.

What Happens If a Startup Suffers a Data Breach?

Data breaches can happen to companies of every size.

Examples include:

• stolen administrator credentials;
• ransomware;
• exposed database backups;
• incorrect email recipients;
• publicly accessible cloud storage;
• compromised API keys;
• employee theft;
• malicious insiders;
• or third-party vendor breaches.

Article 12 requires the controller to notify affected individuals and the Personal Data Protection Board where personal data are unlawfully obtained by others.

The Board interprets the statutory expression “as soon as possible” as requiring notification to the Board without delay and no later than 72 hours after learning of the breach. Affected individuals should also be informed in the shortest reasonable time once they are identified.

A Startup Needs an Incident Response Plan Before a Breach

Seventy-two hours is a short period.

When a breach happens, the company may simultaneously need to determine:

• when the breach began;
• which systems were affected;
• what personal data were exposed;
• how many people were affected;
• whether the attacker still has access;
• whether backups are safe;
• and what notifications are required.

This cannot be managed effectively if nobody knows who is responsible.

A startup should therefore establish an incident response chain before a breach occurs.

The plan may identify:

• technical response team;
• management contact;
• legal adviser;
• data protection contact;
• external cybersecurity specialist;
• communications procedure;
• and evidence-preservation responsibilities.

Employee Personal Data Also Fall Under KVKK

Startups sometimes focus only on customers and forget employees.

An employer may process:

• identity information;
• bank details;
• salary data;
• performance records;
• attendance;
• medical information;
• camera footage;
• access logs;
• email records;
• and emergency contacts.

Employment does not remove privacy rights.

The Board has emphasised that workplace monitoring must balance the employer’s legitimate interests against employee privacy and must consider factors such as prior information, scope of monitoring, necessity, proportionality and whether less intrusive alternatives are available.

Therefore, employee monitoring policies should not simply state:

“The employer may monitor everything at any time.”

Recruitment Data Must Also Be Protected

Candidate information may include:

• CVs;
• employment history;
• telephone numbers;
• references;
• education;
• photographs;
• and salary expectations.

If a candidate is not hired, the startup should consider how long the application information will be retained and for what legal purpose.

Automatically retaining every rejected candidate’s CV indefinitely is difficult to reconcile with storage-limitation principles.

If the startup wants to keep the CV for future opportunities, the relevant processing basis and information process should be considered.

Marketing Creates Separate Data Protection Risks

Growth teams often create significant KVKK exposure.

Examples include:

• purchasing marketing lists;
• scraping contact data;
• tracking user behaviour;
• profiling customers;
• combining third-party datasets;
• using advertising pixels;
• and sending personalised campaigns.

Marketing should therefore be reviewed separately from service delivery.

A person’s email address collected to complete an order does not automatically mean every future marketing use is lawful.

The processing purpose, legal basis and electronic communication legislation should all be evaluated.

Cookies and Tracking Technologies Need Separate Analysis

Many startups use:

• analytics cookies;
• advertising cookies;
• conversion pixels;
• session identifiers;
• fingerprinting technologies;
• and mobile advertising identifiers.

These technologies may process personal data.

Cookie compliance should therefore be analysed according to:

• purpose;
• necessity;
• personal data involved;
• legal basis;
• recipient;
• and international transfer.

Simply inserting a sentence in the privacy policy saying:

“We use cookies.”

is not necessarily enough.

The actual tracking architecture needs to match the legal notice and consent mechanism where consent is required.

AI Startups Face Additional KVKK Risks

Artificial intelligence creates particularly significant data protection issues.

An AI startup should ask:

• Does the training dataset contain personal data?
• Where did the data come from?
• What legal basis permits training?
• Were the data collected for another purpose?
• Are special-category data involved?
• Can the data be anonymised?
• Are prompts stored?
• Are customer prompts transferred abroad?
• Does the model memorise personal data?
• Can individuals exercise their rights?
• Which external model provider receives the data?

Using an external generative AI API may also constitute an international data transfer if personal data are sent to infrastructure outside Turkey.

Therefore, AI architecture should be reviewed at design stage rather than after launch.

Privacy by Design Is Particularly Valuable for Startups

Large companies often struggle to replace legacy systems.

Startups have an advantage.

They can design compliance into the product before technical architecture becomes fixed.

For example, a startup can build:

• deletion functionality;
• access controls;
• consent records;
• retention automation;
• privacy notice versioning;
• international transfer mapping;
• data export functionality;
• and audit logs

from the first version of the product.

This is much cheaper than rebuilding the product three years later when an investor or regulator identifies a compliance problem.

KVKK Compliance Is Also an Investment Due Diligence Issue

Venture capital investors increasingly review data protection compliance during legal due diligence.

An investor may ask:

• Is the company registered with VERBİS if required?
• What privacy notices exist?
• What lawful bases are used?
• Does the company transfer data abroad?
• Are standard contracts signed?
• Were the contracts notified on time?
• Has the company experienced a breach?
• Are processor contracts in place?
• Does the startup process health or biometric data?
• How long is customer data retained?
• Are there outstanding complaints before the Authority?

A serious compliance problem can affect:

• valuation;
• closing conditions;
• warranties;
• indemnification;
• escrow;
• or the investor’s decision to proceed.

KVKK Compliance Matters During Startup Acquisitions

The issue becomes even more important in an acquisition.

Imagine a buyer acquiring a digital platform with one million users.

During due diligence, the buyer discovers that:

• customer data were collected using invalid consent;
• privacy notices were copied from another company;
• all user information is stored abroad;
• no Article 9 transfer mechanism exists;
• marketing databases were purchased from unknown sources;
• and historic users cannot be deleted from the system.

The buyer may effectively be acquiring millions of euros of regulatory exposure together with the customer database.

Personal data are valuable only if they were collected and processed lawfully.

What Administrative Fines Apply in 2026?

The administrative fines under Article 18 are increased annually.

According to the Personal Data Protection Authority’s official 2026 penalty table, the applicable ranges include:

• failure to comply with the information obligation: TRY 85,437 to TRY 1,709,200;
• failure to comply with data-security obligations: TRY 256,357 to TRY 17,092,242;
• failure to implement Board decisions: TRY 427,263 to TRY 17,092,242;
• violation of VERBİS registration and notification obligations: TRY 341,809 to TRY 17,092,242;
• failure to comply with the Article 9(5) standard-contract notification obligation: TRY 90,308 to TRY 1,806,177.

The actual penalty within the statutory range depends on the circumstances.

For a startup, however, even the lower end of some penalty ranges can be financially significant.

Administrative Fines Are Not the Only Risk

KVKK non-compliance can also create:

• customer claims;
• contractual liability;
• reputational damage;
• cybersecurity costs;
• loss of investor confidence;
• employee disputes;
• termination of commercial agreements;
• and potential criminal-law issues under relevant provisions of the Turkish Criminal Code.

Therefore, compliance should not be evaluated only by comparing the expected fine with the cost of compliance.

For a technology startup, trust can be more valuable than the formal administrative sanction.

A Practical KVKK Compliance Roadmap for Startups

A startup beginning its KVKK compliance process should normally proceed systematically.

1. Identify Data Processing Activities

Map all systems and data flows.

2. Determine Controller and Processor Roles

Do this separately for each business activity.

3. Prepare a Personal Data Inventory

Identify data subjects, data categories, purposes, legal grounds, recipients, retention and transfers.

4. Determine Lawful Bases

Do not rely unnecessarily on explicit consent.

5. Prepare Privacy Notices

Use different notices where necessary for:

• customers;
• employees;
• candidates;
• website visitors;
• and suppliers.

6. Separate Consent Processes

Do not merge consent with privacy notices.

7. Review Special-Category Data

Apply Article 6 and enhanced safeguards.

8. Review Security

Conduct both technical and administrative security analysis.

9. Review Vendors

Identify processors, cloud companies and third-party services.

10. Map International Transfers

Determine where every relevant system stores or accesses data.

11. Establish Article 9 Mechanisms

Use the legally appropriate transfer structure.

12. Check VERBİS

Determine whether registration is required under current thresholds.

13. Establish Retention Rules

Define when information must be deleted, destroyed or anonymised.

14. Establish Data-Subject Request Procedures

Assign responsibility and response deadlines.

15. Establish Breach Response Procedures

Prepare for the 72-hour notification period.

16. Train Employees

Developers, HR personnel, marketing teams and customer-support employees should understand their roles.

17. Review Compliance Regularly

A startup’s data processing changes rapidly.

A privacy structure prepared when the startup has 500 users may be completely inadequate after it reaches five million users.

KVKK Checklist for Startups

Before considering itself KVKK-compliant, a startup should be able to answer:

1. What personal data do we process?
2. Whose data do we process?
3. Why do we process each data category?
4. What is the legal basis for each processing purpose?
5. Are we obtaining unnecessary consent?
6. Are privacy notices and consent texts separate?
7. Are privacy notices accurate?
8. Do we process special-category data?
9. Have enhanced security measures been applied?
10. Who has access to personal data?
11. Are access privileges reviewed?
12. Which vendors process data for us?
13. Do vendor contracts regulate data security?
14. Is personal data transferred abroad?
15. Which international transfer mechanism applies?
16. Have required standard contracts been signed?
17. Have standard contracts been notified within five business days?
18. Are any cloud systems located abroad?
19. Are VERBİS thresholds exceeded?
20. Is VERBİS information current?
21. Do we have retention periods?
22. Can data actually be deleted from production systems?
23. Can data be deleted from backups appropriately?
24. Who handles data-subject applications?
25. Can we respond within the legal period?
26. Do we have a data-breach response plan?
27. Who decides whether the Authority must be notified?
28. Can we detect breaches quickly?
29. Are employee data protected?
30. Are candidate CVs retained indefinitely?
31. Are marketing lists lawfully obtained?
32. Are cookies and analytics tools reviewed?
33. Are AI tools receiving customer or employee information?
34. Is personal data uploaded to external AI platforms?
35. Is compliance reviewed when new products are launched?
36. Could we produce all necessary documents during investor due diligence?

If several of these questions cannot be answered, the startup probably has significant KVKK work remaining.

Frequently Asked Questions About KVKK Obligations for Startups

Does the KVKK apply to a startup with only five employees?

Yes. Company size does not create a general exemption from the KVKK. The startup may qualify for a VERBİS registration exemption, but other KVKK obligations can still apply.

Does every processing activity require explicit consent?

No. Article 5 contains several legal bases other than consent. Where another lawful basis genuinely applies, additional consent should generally not be obtained for the same processing activity.

Does a startup need a privacy notice?

Where the startup acts as controller and obtains personal data, Article 10’s information obligation generally applies.

Can the privacy notice and explicit consent form be combined?

The Board’s 18 February 2026 Principle Decision requires these concepts to be treated separately. Where consent is relied upon, the notice and consent text should be presented separately.

Does every startup have to register with VERBİS?

No. Current exemptions depend on employee numbers, financial balance-sheet thresholds and whether the controller’s principal activity involves special-category personal data.

If the startup is exempt from VERBİS, is it exempt from KVKK?

No. VERBİS exemption concerns only the registry obligation.

Can Turkish customer data be stored on foreign servers?

Potentially, but the international transfer must comply with Article 9. Since the Authority currently states that no country adequacy determination has yet been made, appropriate safeguards such as standard contracts are particularly important for many regular transfers.

How quickly must a personal data breach be notified?

The Board interprets “as soon as possible” as notification to the Board without delay and within no more than 72 hours after learning of the breach.

Can a startup keep customer data forever?

No. Retention must comply with the storage-limitation principle, and data must be deleted, destroyed or anonymised when all relevant processing conditions disappear.

Are employee data protected by KVKK?

Yes. Employees are data subjects and employment does not remove their personal data protection rights.

Conclusion: What KVKK Obligations Must Startups Comply With in Turkey?

KVKK compliance for startups is much broader than placing a generic privacy policy on a website.

A startup that processes personal data must first understand its actual data flows and determine why, how, where and for how long each category of information is processed.

The company should then build its compliance framework around the core requirements of Turkish data protection law.

These include:

• compliance with general processing principles;
• identification of lawful processing conditions;
• proper use of explicit consent;
• fulfilment of the information obligation;
• additional protection for special-category personal data;
• technical and administrative security measures;
• proper management of processors;
• lawful domestic and international transfers;
• VERBİS registration where required;
• retention and destruction procedures;
• response to data-subject requests;
• and timely personal data breach notification.

For startups, one of the most important principles is that consent should not be used as a substitute for legal analysis.

The first question should not be:

“How do we obtain user consent?”

It should be:

“What lawful basis applies to this particular processing activity?”

Similarly, a startup should not assume that using a major international cloud provider automatically makes foreign storage compliant.

Following the 2024 reform of Article 9, regular international data transfers should be analysed under the adequacy, appropriate safeguards and exceptional-transfer framework. Standard contracts have become particularly important and, where used, must be notified to the Authority within five business days of signature.

The 2026 regulatory environment also demonstrates that documentation quality matters.

The Personal Data Protection Board expressly warned against combining privacy notices with consent texts, copying other companies’ notices and using vague descriptions of purposes and legal bases.

For founders, this means that KVKK compliance cannot be achieved through a collection of generic templates.

The documents must correspond to the actual product.

If the startup changes:

• its business model;
• cloud provider;
• mobile application;
• marketing tools;
• AI infrastructure;
• customer type;
• data categories;
• international operations;
• or employee systems,

the privacy framework may also need to change.

This becomes particularly important during investment.

A venture capital investor is unlikely to be satisfied merely because the startup has a document called “KVKK Policy”.

The investor may want to know:

Was the customer database collected lawfully?

Are international transfers compliant?

Can users’ data actually be deleted?

Are employees properly informed?

Are processors contractually controlled?

Has the company suffered any personal data breaches?

Does the startup process biometric, health or other special-category information?

Is VERBİS registration required?

Can the startup demonstrate compliance rather than merely claim it?

These questions directly affect company risk and therefore company value.

The safest approach is to make privacy compliance part of product design from the beginning.

A startup should not wait until:

• a customer complains;
• the Personal Data Protection Authority begins an investigation;
• a major data breach occurs;
• an investor opens a due diligence data room;
• or an international buyer requests compliance documents.

Building privacy controls while the company is small is generally easier and less expensive than correcting millions of historic records after rapid growth.

For Turkish startups, KVKK compliance should therefore be treated not simply as a regulatory burden but as part of the company’s corporate governance, cybersecurity, investment readiness and digital trust infrastructure.

A startup that understands where its personal data come from, why they are processed, where they are stored, who receives them and when they are deleted is not only more legally compliant.

It is also better prepared for growth, investment and international expansion.