IT, Data Protection (KVKK) and Technology Lawyer in Bursa

In today’s economy, where digitalisation has spread to every sector, technology and data-driven processes have become some of companies’ most valuable assets, and they also bring some of the highest legal risks. These disputes cover a wide area, from software and licensing relationships to personal data protection, e-commerce operations and the legal framework of artificial intelligence, and they call for both a technical and a legal perspective. At Neka Legal, we handle technology and data law with a preventive approach that manages risks before they materialise, rather than only defending clients after a dispute arises. We also advise foreign companies processing personal data of individuals in Türkiye on how the Turkish Personal Data Protection Law (KVKK) differs from the GDPR.

KVKK compliance advice

In data security and personal data protection, we serve data controllers and data subjects throughout the compliance process under Law No. 6698 on the Protection of Personal Data (KVKK). Starting from the personal data inventory and mapping of data flows, we provide comprehensive compliance advice covering privacy notices and explicit consent management, retention and destruction policies, registration with the Data Controllers’ Registry (VERBİS) and the structuring of domestic and cross-border data transfers. In data breaches, we play an active role in crisis management, notification to the Board and developing the defence strategy against subsequent penalty and compensation proceedings.

Data security is not just a matter of a compliance document; it is an ongoing management process that must be integrated into all of the company’s business processes. We therefore pay particular attention to placing technical measures within the legal framework, regulating data security and transfer clauses in contracts with cloud service providers and establishing regular internal audit mechanisms.

KVKK compliance steps for companies

1. Data inventory: Determine which personal data the company collects, for what purpose, from whom and with whom it is shared.
2. Privacy notice and explicit consent: Prepare privacy notices for data subjects and identify the processing activities that require explicit consent.
3. Policies: Establish a personal data retention and destruction policy and internal procedures.
4. VERBİS registration: Data controllers subject to the registration obligation register with the Data Controllers’ Registry.
5. Technical and administrative measures: Take security measures such as access rights, encryption, training and confidentiality undertakings.
6. Cross-border transfers: Apply one of the statutory transfer mechanisms for cloud services and foreign suppliers.

Key deadlines under the KVKK

The data controller must respond to a data subject’s request within thirty days of receiving it at the latest (KVKK, Art. 13). The data subject can lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the request (Art. 14). A data breach must be notified to the Board as soon as possible and within seventy-two hours of becoming aware of it at the latest (Art. 12 and Board decision). If data is transferred abroad on the basis of standard contractual clauses, the contract must be notified to the Board within five working days of signature (Art. 9).

The 72-hour deadline is very short. When a data breach occurs, notification may have to be made before the full scope of the breach is understood. Preparing a breach response plan in advance is therefore recommended.

Data breaches and administrative fines

In case of a breach of the KVKK, the Board can impose administrative fines for failures such as breaching the duty to inform, data security obligations, Board decisions and the VERBİS registration obligation. The amounts of the fines are increased every year by the revaluation rate. Unlawfully recording, disclosing or obtaining personal data can also constitute an offence under the Turkish Criminal Code.

We also handle actions for annulment before the administrative courts against administrative fines imposed by the Board, drawing on our knowledge of the Board’s established interpretations.

What can you do if your personal data has been processed unlawfully?

A person whose personal data is processed has the right first to apply to the data controller to learn whether their data is processed, to request its correction or deletion and to claim compensation for damage (KVKK, Art. 11). If the application is rejected, the response is found insufficient or no response is given on time, a complaint can be lodged with the Board. A compensation action can also be filed for the damage suffered, and a criminal complaint can be made to the prosecutor’s office where an offence has been committed.

Artificial intelligence law

Artificial intelligence law is a rapidly developing field whose regulatory framework is still maturing. The development and use of AI systems simultaneously raise many interrelated legal issues, such as the processing of personal data, obligations relating to automated decision-making, the lawfulness of training data and intellectual property rights. At Neka Legal, we advise companies developing AI-based products and services, and businesses using these systems in their operations, assessing the data protection and intellectual property aspects together.

Our main areas of work in this field are assessing the legal compliance of the data sets used in AI applications, compliance with the KVKK provisions on automated decision-making and profiling, ownership and copyright questions over AI outputs, model and software development agreements, and liability and transparency obligations. Together with our clients, we also assess the compliance requirements that international frameworks such as the EU Artificial Intelligence Act and the GDPR create for Turkish companies operating in the EU market.

Software, e-commerce and internet law

We also provide advice and representation on software and licence agreements, SaaS models, e-commerce and commercial electronic message (İYS) compliance, and disputes relating to internet and media law, assessing each file within its own technical and legal circumstances. For the copyright protection of software, see our intellectual property page.

Frequently asked questions

Does every company have to register with VERBİS?

No. The registration obligation depends on the employee and annual balance sheet thresholds set by the Board and on the field of activity. Companies without a registration obligation are still subject to the other obligations under the KVKK.

Is explicit consent required for every data processing activity?

No. Explicit consent is not required where there is another legal basis, such as performance of a contract, a legal obligation or legitimate interest. Obtaining explicit consent unnecessarily can itself create compliance risks.

We have had a data breach. What should we do?

The scope of the breach should be determined quickly, the Board notified within 72 hours at the latest and the affected persons informed within the shortest reasonable time.

Where is a KVKK fine challenged?

Administrative fines imposed by the Board can be challenged by an action for annulment before the administrative court.

Is reviewing employees’ e-mails contrary to the KVKK?

It depends on the circumstances. The employer’s legitimate interest, proportionality and whether employees were informed in advance must be assessed together.

Responsible attorney: Kaan Kaplan

This page has been prepared for general information purposes and does not constitute legal advice. Last updated: 6 November 2026.