KVKK is Turkey's Personal Data Protection Law (Law No. 6698). It shares many principles with the GDPR, such as transparency, purpose limitation and data minimisation, and applies to organisations processing personal data in Turkey.

Is using Google Analytics non-compliant?

Not by itself, but analytics cookies generally require consent, must be disclosed in your notices, and international transfer rules must be met. Get legal advice on your setup.

Does a cookie banner need a reject button?

Regulators in both the EU and Turkey expect rejecting non-essential cookies to be as easy as accepting them, so an equally visible reject option is strongly recommended.

GDPR and KVKK Compliant Website: Security Checklist

A KVKK compliant website, or one aligned with the GDPR, takes more than a privacy policy link in the footer. Every point that touches personal data, from contact forms and analytics to server logs and newsletter sign-ups, needs both legal and technical attention. KVKK is Turkey's Personal Data Protection Law and shares many principles with the GDPR. Note: this article is general information, not legal advice; consult a qualified lawyer for your specific situation.

Map the personal data your website processes

Contact, quote and job application forms
Cookies and analytics (IP address, device and behavioural data)
Marketing pixels and ad tags
Newsletter subscriptions and live chat tools
Server and security logs
Customer accounts and portals

Document what is collected, why, on what legal basis and where it is stored. Remember that your agency, hosting provider and SaaS tools may act as data processors, so your contracts with them should cover data security.

Legal checklist for a KVKK compliant website

Privacy notice: who the controller is, purposes, recipients, collection methods, legal bases and user rights.
Separate consent: where explicit consent is required, such as marketing messages, collect it separately and never make it a condition of service.
Cookie policy and consent management: non-essential cookies must not run before consent.
Data subject requests: a clear way for users to exercise their rights.
Registry obligations: in Turkey, check whether you must register with VERBIS, the data controllers' registry.
International transfers: hosting, email, analytics or CRM abroad triggers transfer rules; Turkey updated them in 2024, so review current mechanisms with your lawyer.
Retention policy: define how long form submissions, CVs and logs are kept.

Common cookie consent mistakes

Loading analytics or ad cookies before consent
Offering only "Accept" with no equally easy way to reject
Pre-ticked boxes
No way to change preferences later
An outdated list of tools in the cookie policy

Technically, you need a consent management setup that loads analytics and marketing tags only after consent, and keeps a record of when and for what each consent was given.

Website security checklist

Area	What to check
Transport security	HTTPS everywhere, HSTS, modern TLS configuration
Security headers	Content-Security-Policy, X-Frame-Options, Referrer-Policy
Forms	Server-side validation, bot protection, rate limiting
Authentication	Strong passwords, two-factor authentication, restricted admin access
Dependencies	Regular CMS, plugin and package updates
Storage	Encryption of sensitive data and least-privilege access
Backups	Regular encrypted backups with restore tests

Data minimisation in forms

Do you really need a national ID number or date of birth on a contact form? Data you never collect cannot be breached. Question every field during UI/UX design.

Third-party scripts and breach readiness

Every external script, whether analytics, maps, chat, video or font services, is a potential data transfer. Keep an inventory, remove what you don't need and consider privacy-friendly or server-side alternatives. Prepare a written breach response plan: who is responsible, how incidents are detected and how regulators and individuals are notified. Both the GDPR and Turkish regulatory guidance refer to a 72-hour notification window.

Common technical mistakes

Even with solid legal texts, weak implementation undermines compliance. Mistakes we often see:

Form data living in inboxes: applications and CVs sitting for years in shared mailboxes, with unclear access and retention.
Real data in test environments: copies of the production database on unprotected staging servers.
Public upload folders: documents stored at predictable, publicly accessible URLs.
Verbose error pages: stack traces or database details shown to visitors.
Shared admin accounts: several people on one login makes access impossible to audit.
Forgotten scripts: old analytics or chat tools still running after you stopped using them.

Most of these are avoided at no extra cost with a few good decisions during development.

Keeping compliance sustainable

Update notices whenever you add a new tool or form.
Run a security and compliance review at least once a year.
Adopt privacy by design with your development team.
Handle legal texts with a lawyer and implementation with your engineers.

BernSoftware builds websites with security headers, consent management, secure forms and data minimisation from the start. Explore our web development services, learn more about our Istanbul software company, or contact us for a review of your current site.