Assess the KVKK role for each activity.

The table shows the technical scope of product tools; it does not assign controller or processor roles. Roles, authority, contracts and applicable duties require separate assessment for each activity.

Vekilaw is developed by Vekilaw. ISO/TSE certificate details have not been published. The MTY Cloud configuration name alone is not evidence of active hosting, data location, transfers or backup acceptance; confirm current service conditions separately.

Read our KVKK privacy notice

Fictional product example: an access request linked to a visible client and an authorised review. This animation does not record a request, download a package or send a reply; the tracking date is not legal deadline or delivery evidence.

1. 01/05

   Choose a client and request

   An authorised user selects a visible client and the access request type. Company/branch scope and receipt information are checked.

2. 02/05

   Record an open request

   The product tracks the recorded UTC receipt time plus 30 days. Legal timing, submission requirements and reply duties need separate assessment.

3. 03/05

   Start handling the request

   An access request must be in progress before a package is available; KVKK management permission, all branches and full case scope are required. Download is not automatic.

4. 04/05

   Prepare a separate package

   An authorised user can download supported linked module data as JSON or JSON+CSV ZIP. This does not promise all document files, person information in every free-text field or a full company backup.

5. 05/05

   Assess reply and completion separately

   Downloading does not send a reply to the client or complete the request. Completing an access request is a separate authorised action; erasure separately requires a blocker/retention plan and explicit confirmation. The example remains in progress.

Data protection requests

Example selection

Data subject: Client ADate received: 06.10.2026

“I request a copy of my personal data.”

Request type

Access and copy of data

UTC tracking date (example)

05.11.2026

Product tracking

UTC receipt + 30 days

Separate package request

• Linked client dataScope example
• Supported module metadataScope example
• JSON optionScope example
• JSON+CSV ZIP optionScope example

Reply and completion: Separate authorised action requiredNo delivery or completion is evidenced by this example

‹›

01/05

Choose a client and request

Distinguishing controller from processor requires looking at who determines processing purposes and means, independent decision authority and instructions. The Board’s 2020/71 summary explains these criteria. A firm, lawyer, partnership or company label alone does not allocate the same role for every operation; assess the activity and actual authority separately.

A processor acts on behalf of a controller under its authority. Providing software, email, cloud, accounting or payment services does not automatically establish that role for every activity. Review the parties’ decision authority and processing scope; individuals whose data is processed, including clients, opposing parties, witnesses or staff, can be data subjects.

The law does not use the word inventory, but privacy notices, retention periods and registry notifications cannot be done without knowing exactly what you process. The content of the registry notification shows it clearly: identity, purpose of processing, data subject groups and data categories, recipient groups for transfers, transfers abroad, security measures and the maximum retention period (Article 16(3)). If you build your inventory under those headings, the same work prepares both your privacy notice and your registry notification.

Start by mapping the firm's data flows: where data comes from, where it sits, who receives it and when it ends. The table below shows typical data groups for a law firm. The basis column is an example; you must assess each processing activity under your own circumstances.

Special categories need extra care. Article 6 treats data on criminal convictions and security measures, health data, and association or union membership as special-category data; it allows their processing only if one of the listed conditions applies and also requires the adequate measures set by the Board. In a law firm these data appear often in criminal cases and in employment and family disputes.

Article 4 lists five principles for processing: lawfulness and fairness, accuracy and, where necessary, being up to date, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purpose, and retention only for the period set by law or needed for the purpose. Every processing activity in the firm must pass these five filters.

Article 5 makes explicit consent the rule and treats the listed conditions as exceptions that allow processing without it. Explicit consent is consent relating to a specific subject, based on information and given freely (Article 3). In a law firm, handling a file usually rests on the power-of-attorney contract, on the establishment, exercise or protection of a right, and on legal obligations. A separate consent form for the engagement itself is therefore mostly unnecessary and invites the argument that consent was not freely given. Keep consent for activities no other basis covers, such as a newsletter.

Professional secrecy is a separate duty. Article 36 of the Attorneyship Law (Law No. 1136) prohibits a lawyer from disclosing what they learn through their work, and the Turkish Bar Association's Professional Rules likewise require professional secrecy to be protected and assistants and trainees to comply with it; check the article number in the current text of the Rules. Finding a KVKK basis for processing never gives you permission to disclose a secret; the two regimes apply together.

Article 10 requires the controller, or the person it authorises, to inform data subjects on five matters when data is collected: the identity of the controller and its representative, the purpose of processing, to whom and for what purpose data may be transferred, the method and legal basis of collection, and the other rights listed in Article 11. The notice is independent of consent and wider than it; having obtained consent does not mean you have informed.

Firms have three natural points for the notice: signing the power of attorney and engagement letter, the enquiry form on the website, and the first phone call or exchange of messages. Prepare a separate notice for employees and trainees. For data not collected from the data subject, such as the opposing party's or a witness's details, the Authority's notice communiqué sets out separately how and when to inform; decide in advance which exceptions you will rely on and write them down. Failing to inform is a ground for an administrative fine (Article 18(1)(a)).

Personal data is kept for the period set in the relevant legislation or needed for the purpose of processing (Article 4). When that period ends, or when the reasons requiring processing disappear, data is deleted, destroyed or anonymised either on the controller's own initiative or at the data subject's request (Article 7). Failing to delete is serious: those who do not delete or anonymise data in breach of Article 7 are punished under Article 138 of the Turkish Penal Code (Article 17(2)).

For a law firm the real difficulty is the tension between deletion and retention duties. Tax, commercial and professional retention requirements and limitation periods can stand in the way of acting on a deletion request at once, and Article 7(2) preserves special provisions in other laws. The answer is to tie a retention period and its legal basis to each data group in a written policy in advance. The Regulation on Deletion, Destruction or Anonymisation of Personal Data sets out what the policy must contain and the principles for periodic disposal.

Article 12 obliges the controller to take all technical and administrative measures needed for an appropriate level of security, with three aims: preventing unlawful processing, preventing unlawful access and ensuring the safekeeping of data. In a firm the most concrete form of this is who can reach which file and which action. A firm where everyone has full authority cannot show that it met this duty.

Paragraph 4 of the same article states that controllers and processors cannot disclose personal data they learn in breach of the Law or use it beyond the purpose of processing, and that this duty continues after they leave their post. Put confidentiality clauses into employee and trainee contracts, and close a departing employee's access the same day. We cover role and permission design in a separate guide.

• Guide to roles and permissions in a law firm
• Roles and permissions module

If personal data is processed on your behalf by someone else, Article 12(2) makes you jointly responsible with them for taking the security measures. So sign a written data processing agreement with every software and service provider, covering the subject and scope of processing, security measures, approval of sub-processors, confidentiality, and the return or deletion of data when the contract ends.

Transfers abroad are regulated by Article 9, which Law No. 7499 rewrote in 2024. Under the current regime, a transfer needs one of the conditions in Articles 5 and 6 plus, in order, an adequacy decision; if there is none, appropriate safeguards such as a standard contract, binding corporate rules or an undertaking; and failing that, only the exceptional cases listed, and then only occasionally. A standard contract is notified to the Authority within five business days of signature. Cloud and AI services may involve a transfer abroad depending on server location, so ask providers in writing for their server location and sub-processor list.

• Vekilaw security and KVKK page

Article 12(5) says that if processed personal data is obtained by others through unlawful means, the controller notifies the data subject and the Board as soon as possible. The Personal Data Protection Board's decision no. 2019/10 of 24 January 2019 makes the timing concrete: the Board is notified without delay and within 72 hours at the latest of learning of the breach, and the data subject within a reasonable time as soon as possible. The decision also provides for use of the breach notification form.

Without a plan, 72 hours is very short. A lost laptop, an email sent to the wrong person, ransomware and a compromised account can each be a breach. Decide in advance who decides, who notifies and how evidence is preserved. Criminal offences concerning personal data fall under Articles 135 to 140 of the Turkish Penal Code (Article 17), so recording the incident matters for both remediation and defence.

Article 11 gives data subjects nine rights: to learn whether data is processed, to request information, to learn the purpose, to know the third parties to whom data is transferred, to request correction, to request deletion or destruction, to request that these actions be notified to third parties, to object to an adverse result based solely on automated analysis, and to claim compensation for damage. Requests reach the controller in writing or by other methods the Board sets.

The controller concludes a request free of charge as soon as possible and within thirty days at the latest, depending on its nature; if the action needs a separate cost, the fee in the Board's tariff may be charged (Article 13). The request is accepted, or refused with reasons, and the reply is given in writing or electronically. If the reply is inadequate, the data subject may complain to the Board within thirty days of learning the reply and in any case within sixty days of the request (Article 14).

In a law firm, requests can collide with retention duties, protection of rights and professional secrecy. If a client's deletion request overlaps with a pending case or a tax retention period, you may refuse with reasons; give the reasons in writing. Disclosing one person's data to another remains restricted by the confidentiality duty even when a request gives it as the reason.

• Data migration and KVKK tools

Board decision 2018/32 exempts lawyers operating under Law No. 1136 from registration in the Data Controllers’ Registry. The 2020/429 summary reiterates this distinction. Controller status and registration duties for an activity outside legal practice need separate assessment; do not automatically extend the exemption to every firm structure or other commercial activity.

Exemption from registry registration is not exemption from the rest of the Law. Separately assess applicable privacy-notice, security, data-subject-rights and retention/disposal duties. Check current Authority announcements against your activities and legal structure.

1. 01Having clients sign a consent form without providing a privacy notice.
2. 02Giving every employee full rights on every file.
3. 03Sharing files through personal email and messaging apps.
4. 04Keeping an unlimited archive that never deletes anything.
5. 05Having no data processing agreement with software and cloud providers.
6. 06Not deciding in advance who does what after a breach.
7. 07Leaving a departed employee's access open for weeks.

Tick each item as you finish it. Your ticks are stored only in this browser.