KVKK No. 6698
Compliance Project Inventory
Software and Consulting
service

The obligations of data controllers have been determined within the framework of the Personal Data Protection Law No. 6698, the secondary legislation related to this and the decisions made by the Personal Data Protection Board.

In this context, the obligations of data controllers, such as registering in the "Data Controllers Registry Information System" (VERBIS) in accordance with the law, preparing a "Personal Data Processing Inventory" and a "Retention and Disposal Policy", and taking technical and administrative measures regarding personal data security. are available.

It is undeniable that data controllers and data processors must have general knowledge in the field of personal data protection, especially the general principles of processing personal data, which is the source of these obligations, in order to carry out data processing activities in compliance with the above-mentioned legislation.

Therefore,Personal Data Protection AuthorityIn order to facilitate the compliance of data controllers with these obligations, many guides, guides and documents have been prepared and shared at www.kvkk.gov.tr.

Personal Data Protection Authority, also established an information hotline called “DATA Protection Line” (ALO 198) in order to enlighten the data subjects and data controllers and to answer their questions quickly.

These studiesPersonal Data Protection AuthorityIt is also supported on different platforms through awareness raising and information activities regularly carried out by

Personal Data Protection Authorityevaluates and decides whether the data controllers fulfill these obligations from a broad perspective, including many legal and technical aspects, in the examinations made upon complaint or ex officio.

At this pointPersonal Data Protection Authority, that it only considers compliance with the obligations specified in the Law and secondary legislation and that these compliance studies are within the body of the data controller.or with outside support.It should be noted that there is no evaluation of whether it is carried out or not.

Finally, due to the diversity of obligations that data controllers are subject to, it should be taken into account that these obligations can only be fulfilled as a result of an interdisciplinary joint work.

Personal Data Protection AuthorityAs a result of the above-mentioned studies carried out by the Company, the knowledge on the protection of personal data has been increasing rapidly among the citizens, representatives of the private sector and public institutions, and this situation contributes to the general awareness level in the public.

in the upcoming periodPersonal Data Protection Authority; Considering the level of awareness in our country, the expectations of data controllers-data processors-relevant persons, current practice examples in the field of personal data protection, the roles of public institutions within the framework of their powers and duties, it facilitates the fulfillment of their obligations by increasing the institutional capacity of data controllers and data processors and continues to work on a certification mechanism that gives confidence to individuals in the process of processing their personal data.

1) Preparation of Personal Data Processing Inventory

Personal Data Protection Authority, with the "Regulation on the Data Controllers Registry" published
required to prepare an inventory. According to Article 5 of the Regulation on the Data Controllers Registry, “Data controllers who are obliged to register with the Registry are obliged to prepare a Personal Data Processing Inventory. The information to be disclosed to the Registry in Registry applications is prepared based on the Personal Data Processing Inventory.”

With the KVKK Compliance Project, in order to determine the legal responsibility of institutions and organizations
Personal data inventory is created by compiling all data items that have the nature of personal data processed through the KVKK data inventory software application.

For each personal data set in the personal data processing inventory:
• The business process where the Data Set is processed and the departments where personal data is processed,
• Categorizing the processed personal data,
• The method of obtaining the Data Set,
• Detailed determination of data set areas
• Data categories and contact groups
• Special categories of personal data/personal data distinction
• Data acquisition method
• Contact application method,
• Data processing purposes and legal grounds
• Data protection principles and compliance status of the institution using the software with KVKK
• Administrative and technical measures on the data set
• Storage period and destruction method of personal data
• Administrative and Technical measures,
• Domestic and international transfer information will be included.

The smart inventory software we use; It offers comprehensive legal information, an understandable login screen, smart guidance on the screen that facilitates and corrects the user's entry, and functions that facilitate the process of preparing personal data processing inventory.

KVKK - personal data processing inventory software is quite easy to use.
You can create your own personal data processing inventory with the prompts and smart warnings that will appear during data set creation; You can solve all your problems related to KVKK legislation with the support of Consultants and lawyers within the scope of the service.
You can also get technical expert support for inventory recording with software support specialists.

2) Follow-up of the Data Controllers Registry Information System (VERBIS) Record

One of the obligations stipulated by the Personal Data Protection Authority (KVKK) is “Data Protection Authority”.
Those responsible are registered in the Registry Information System.

Real and legal persons who process personal data in accordance with the provisions of the law must register with VERBIS before starting to process personal data.
Accordingly, the relevant real and legal persons, data processing activities on a categorical basis VERBIS
must be declared to the system.

With the VERBIS system, it is explained who the data controllers of real and legal persons are, and the system defines the way and method they will follow about the protection of personal data.
VERBIS registration procedures are carried out with the guidance of our attorney and KVKK experts.

The relevant service is examined in terms of legal, information security and technical infrastructure.
Based on VERBIS records, the technical and legal infrastructure is created by expert lawyers employed in our organization.
In addition, the VERBIS record will be updated when necessary, new data processing activity within the institution.
KVKK will be revised by our experts when it happens.

Therefore, reports in VERBIS format are prepared for registration in VERBIS and they are ready for entry.
will be brought in, the entry to VERBIS will be made together.

4) Authority Matrix and Documentation Studies

Data Classification

▪ Analysis of Workflows
▪ Determination of Authorization Matrix and Job Descriptions on the Basis of Personnel
▪ Preparation of Data Security Policies
▪ Preparation of Disposal Policies
▪ Compliance Audits
▪ Preparation of Clarification Texts Based on All Units and Departments
▪ Preparation of Explicit Consent Texts Based on All Units and Departments
▪ Making Data Controller-Data Processor Agreements,
▪ Re-preparation of Employment Contracts and Confidentiality Agreements within the scope of KVKK,
▪ Determination of administrative and technical measures regarding the processing of personal data and implementation plans.
preparation.

Evaluations of the institutions will be made by us, and it will be carried out by conducting surveys, workshops and meetings with the KVKK committee assigned within the institution, by making document review and sometimes by making systematic observations.

As a result of the meetings;
▪ Deficiencies related to the subjects in the legislation
▪ Recommendations/tasks for rectifying deficiencies
▪ Adaptation roadmap will be prepared

3) Gap Analysis

Your current situation is tested through the Personal Data Inventory.

by your institution
The compliance of the personal data processing activities carried out with the Personal Data Protection Law and the Information Protection principles is analyzed under the following headings.

Data Protection Assurances

▪ Data Protection Policy
▪ Registration in the Data Controllers Registry or revision of the existing registration,
▪ Lawful Processing Procedures
▪ Whether the Data is Processed in Compliance with the General Principles
▪ Data Security

Records Management

▪ Records Management Policy
▪ Legal Follow-up of Domestic and International Data Transfer
▪ Regulation of Security, Access, Destruction Policies

Information security*

▪ Management & Organizational Information Security Measures
▪ Personnel Information Security Awareness and Awareness Trainings
▪ Physical/Environmental Security
▪ Computer and Network Security

* The services offered under the heading of information security are in the nature of procedural guidance. Technical measures (cyber security), hardware/software etc. services are provided by our certified partner companies.

6- Education

Awareness training will be provided to employees in accordance with the Law on Protection of Personal Data No. 6698 and regulations, and awareness of all personnel will be raised within the scope of the KVKK compliance project.

5- Compliance Consulting

Within the scope of personal data inventory, studies will be carried out to harmonize the personal data processing activities of the institutions that receive the Compliance Project in terms of KVKK.

KVKK No. 6698Compliance Project InventorySoftware and Consultingservice

KVKK No. 6698
Compliance Project Inventory
Software and Consulting
service