Vona Hukuk Bürosu v2

Protection of Personal Data

In the modern age, with the effect of technological developments, the data of individuals are processed on different platforms and this involves some risks. For this reason, it has become necessary to establish a legal infrastructure in order to protect personal data. As a matter of fact, with the 20th article of our Constitution, everyone’s right to demand protection of personal data is guaranteed as a constitutional right. In this context, the Personal Data Protection Law (KVKK) numbered 6698 was adopted on 07.04.2016.

The purpose of this law is to discipline the processing of personal data and to collect it unlimitedly, to make it accessible to unauthorized persons, to prevent violation of personal rights as a result of its disclosure or misuse or misuse. For this purpose, by establishing control mechanisms for the processing of personal data, it is aimed to prevent these data from being processed illegally.

The Law does not limit the processing of personal data, on the contrary, it regulates the procedures and principles for the processing of personal data in order to be more competitive in the data-based economy.

The law also stipulated administrative sanctions for those who do not fulfill their registration obligation with VERBIS.

Due to the Covid-19 virus epidemic, which affects our country as well as all over the world, some workplaces are physically closed or remote/rotational working model is applied, therefore data controllers cannot prepare personal data processing inventory and the obligation to register in the Data Controllers Registry (Registry) The period determined for public institutions and organizations to fulfill their registration obligation to the Registry has been extended until 31.03.2021 on the grounds that it could not be fulfilled in due time.
There are many policies and documents that need to be prepared and put into effect in terms of KVKK compliance. Within this scope, Vona Law Firm offers the following services together with its business partner specialized in information services.
Provided Services
A) Creating KVKK Compliance Infrastructure
  • Preparation of Personal Data Processing Inventory
  • Corporate policies (access, information security, use, storage, and disposal, etc.)
  • Contracts (Between Data Controller-Data Controller, Data Controller-Data Processor)
  • Privacy commitments
  • Periodic and/or random audits within the institution
  • Risk analysis
  • Labor Contract, Discipline Regulation (adding provisions in accordance with the Law)
  • Corporate communication (crisis management, informing the board and the relevant person, reputation management, etc.)
  • Law booklet
  • Violation notification form
  • Information document
  • Audit question sets
  • Process reports
  • Authority matrix
  • Authority control
  • Access logs
  • User account management network security
  • Application security encryption
  • A penetration test (to be applied to the central system only)
  • Intrusion detection and prevention systems
  • Log records
  • Data masking
  • Data loss prevention software backup
  • Firewalls
  • Current anti-virus systems
  • Deletion, destruction, or anonymization
  • Key management
  • Website privacy policy
  • Cookie policy

B) Training

  • Employee touching data, IT, HR, accounting, etc.
  • Basic concepts
  • Legislation
  • Sanctions
  • Management and sustainability of personal data security for managers
  • Awareness test

C) Consultancy after Compliance Project

  • Providing on-site technical support when needed
  • Quick response to questions about data protection with comments and answers via e-mail or phone
  • Regular checks on data security
  • Providing legal support in responding to data owner applications
  • Evaluation of contracts  within the scope of KVKK and providing support
  • Regular sending of bulletins containing developments in the field of the Law within the framework of Turkish and EU legislation