The Turkish Personal Data Protection Law (KVKK, Law No. 6698) applies to most business websites, because almost every site collects some personal data: contact forms, newsletter sign-ups, analytics.
Notices and consent
- 1Privacy notice (aydınlatma metni): Explains who processes the data, why, on what legal basis, who it is shared with and the user's rights. Link it next to every form.
- 2Explicit consent only where needed: Don't hide consent inside the privacy notice; ask separately and only for processing that actually requires it.
- 3Cookie banner for optional cookies: Essential cookies (session, language, security) don't need consent; analytics and advertising cookies do. "Reject" must be as easy as "Accept".
Forms
- 1Collect only what you need. If you don't need a phone number, don't ask for it.
- 2Use HTTPS everywhere. Forms must never send data over plain HTTP.
- 3Protect against spam without tracking users unnecessarily.
Storage and security
- 1Decide how long you keep data, and delete it when that time passes.
- 2Limit who can see submissions. Staff accounts should only access what their role requires, ideally with two-factor authentication.
- 3Keep backups encrypted and test that they can be restored.
Third parties
- 1List every external service (email provider, analytics, chat, ads) and mention them in the notice. Services that transfer data abroad need extra attention.
Summary
- Notice next to every form; consent only where required.
- Optional cookies only after consent.
- Minimal data, limited access, encrypted backups.
Have questions about your own site? Contact us.