Turkey's data protection law, KVKK, has been in force since 2016 — yet a large share of corporate websites still carry either no privacy notice at all, or one copied from another site with no relation to the business. That is a double risk: the authority's administrative fines are revalued upward every year, with upper limits now in the millions of lira, and beyond fines, a site that looks careless with data loses customer trust. The good news: on the website side, compliance is systematic rather than complicated. Here is the checklist, item by item. (One important note: this is a technical guide, not legal advice — have your final texts approved by a data protection lawyer.)
1. A Privacy Notice That Is Actually Yours
Every point where your site collects personal data — contact form, sign-up, newsletter, cookies — needs a notice stating clearly which data you process, for what purpose, on what legal basis, and with whom you share it. Texts copied off the internet rarely match your real data flows and are useless in an audit. The notice must be one click away, from the footer.
2. Consent Checkboxes: Separate and Unticked
- Checkboxes must never be pre-ticked — the user ticks them.
- Acknowledging the privacy notice and consenting to marketing messages cannot share one checkbox; separate purposes, separate boxes.
- The form must submit without the optional consents — making the service conditional on consent invalidates the consent.
3. Cookies: a Banner Alone Is Decoration
Since the authority's 2022 cookie guidance, the expectation is clear: non-essential cookies (analytics, marketing pixels) must not run before consent. Most sites we audit have a banner while the cookies load the moment the page opens — that is decor, not compliance. Done properly: "Reject" is as easy to reach as "Accept", preferences can be changed later, and consent records are stored.
4. Technical Security Measures
The law also obliges you to maintain an appropriate level of security:
- HTTPS across the entire site, not just checkout.
- Encrypted transmission and access-controlled storage of form data.
- Strong passwords and two-factor authentication on the admin panel.
- Regular security updates and backups — unpatched platforms leaking data through known vulnerabilities is the most common breach pattern. This discipline is the core of our maintenance and support service.
5. Inventory Your Third-Party Tools
Google Analytics, Meta Pixel, live chat, embedded YouTube, maps — each ships visitor data to its own servers, usually abroad. Inventory every third-party tool on your site, tie each to your privacy notice and cookie consent, and meet the legal conditions for cross-border transfer. Deleting the tools you don't use is the cheapest compliance step there is.
6. Retention and Deletion
"How long do we keep it?" must have a defined answer. If the participant list of a campaign from five years ago is still sitting in your inbox, you are violating the purpose-limitation principle. Set retention periods for form submissions and run a routine that deletes expired data.
7. A Working Request Channel
Data subjects have the right to ask what you hold, and to request correction or deletion. Your site needs a clear channel for such requests — a form or dedicated e-mail — with a statutory response deadline of 30 days and a named owner inside your organisation.
Quick Self-Audit
- Is the privacy notice specific to us, and reachable?
- Are consent boxes unticked and separated by purpose?
- Do analytics or marketing cookies load before consent? (Check via the browser's developer tools.)
- Is the whole site HTTPS, with 2FA on the admin panel?
- Is the third-party tool inventory current?
- Are retention periods defined, and does the request channel work?
Running this list against your current site will surface the gaps quickly. If you are commissioning a new site, the cheapest route is building compliance in from the start rather than patching it on later — our web design projects ship with cookie management, consent flows and the security layer as standard. Curious how your site scores? Contact us and we'll review the technical side together.
