Güneş & Güneş
Legal support in KVKK advisory and compliance, personal data processing and transfer, data breaches, applications to the Personal Data Protection Board (Kurul) and litigation.
Legal approach tailored to your need
KVKK regulates the conditions under which personal data may be processed and the rights individuals have over that data. The legal work addresses the actual way things operate, from the collection of data to its sharing and destruction.
As Güneş & Güneş Law Firm, we assess institutions’ compliance work and individuals’ pursuit of their rights as separate needs. At our Antalya-based firm, we determine the scope of applications, advisory work and dispute follow-up according to the file.
Data inventory, privacy notice, VERBİS, contracts and transfers abroad.
Review the compliance scope 02 · INDIVIDUAL RIGHTSApplication to the data controller, complaint to the Board, compensation and litigation options.
Review the application routes 03 · BREACH AND REVIEWData breach notification, preservation of evidence and preparation for a Board review.
Review the breach processKVKK advisory and compliance
Beyond ready-made texts, we take as our basis which data is processed, by whom, for what purpose and for how long. The work below is planned according to the need and the scope of the engagement.
Business units, data categories, processing purposes, legal grounds, recipients and retention periods are examined together. The roles of data controller and data processor are determined on the basis of actual decision-making and operational authority.
Work output: Data flow map, inventory and priority action list.
Notices suited to employee, customer, visitor and candidate processes are prepared. Processing operations that require explicit consent are assessed separately; privacy notices and consent are not designed as texts that can be used in place of one another.
Work output: Process-specific texts, points of presentation and a record-keeping arrangement.
Whether a registration obligation or an exemption applies is assessed with regard to the Data Controllers’ Registry Information System (VERBİS). Consistency is established between the inventory, the registry declarations, and the retention and destruction policies.
Work output: Assessment of the obligation, and the necessary registry and policy work.
Data movements in cloud, email, customer relationship and support services are examined. The applicable transfer mechanism, the roles of the parties and the contractual and notification requirements are addressed together.
Work output: Transfer map, appropriate mechanism and a timeline of steps.
Personnel files, health and biometric data, and camera and access records are assessed. The condition for processing, proportionality, access authorizations and the retention arrangement are determined separately for each process.
Work output: Legal arrangements for human resources processes.
Forms, cookies, analytics, advertising and artificial intelligence tools are examined with regard to the data they collect and sharing with third parties. The aim is for the visible texts to match the preferences and data flows that the technical team actually implements.
Work output: Legal requirements list and implementation checks.
The responsibilities of service providers regarding instructions, confidentiality, security, subcontractors and breach notification are regulated. Audit, return of data and deletion/destruction at the end of the business relationship are reflected in the contract.
Work output: Data processing provisions, contract annexes and allocation of responsibility.
Responses to data subject requests, the Board’s requests for information and documents, defenses and sanctions are assessed legally. Complaints, lawsuits and claims for damages are handled through the routes the specific case requires.
Work output: Application/response file and a dispute follow-up plan.
KVKK compliance requires continuity. Publishing a text or completing a VERBİS registration does not mean that all data processing activities automatically become lawful. New systems, suppliers and business processes must be assessed separately.
Application · Complaint · Litigation
You have rights such as learning whether your data is being processed, requesting information, requesting correction and, once the conditions are met, requesting deletion or destruction. In the event of an alleged violation, an application to the data controller, a complaint to the Board and judicial routes are not the same procedure. [1]
The addressee of the application, the dates of learning and of response, the evidence at hand and the desired outcome must be determined together.
The data and processing concerned, the scope of the request and its grounds are stated clearly, and the date on which the application arrives is recorded. The data controller concludes the application as soon as possible and at the latest within 30 days.
If the request has been rejected, the response is inadequate or no response has been given within 30 days, the complaint route may come into play. As a rule, the 30 days from learning of the response and, in any event, the 60-day limit from the application are taken into account. Non-response and late response are assessed separately. [2]
Lawsuits against Board actions and administrative fines, compensation where the conditions are met, and criminal-law routes are examined separately. Based on the decision, the date of notification and the previous defenses, the competent authority, the time limit for application and the protection that may be sought are determined.
An administrative fine imposed by the Board is not compensation paid to the data subject.
A claim for compensation of the loss is subject to separate legal conditions. Sending a consultation request to the firm also does not take the place of an application that must be made to the data controller or the Board.
Data breach and Board review
A file sent to the wrong recipient, unauthorized access or a cyberattack may require a separate assessment with regard to personal data. The first step is to establish when the incident was learned of and which data it affected.
Working method and responsibility
We determine at the outset the scope of the work, the information we need from you and the outputs to be shared. A compliance project and an urgent breach or litigation file are run on different timetables.
Business units, systems, documents and incident history are reviewed. Missing information and priority risks are identified.
Action, responsible person, target date and expected output are matched. Matters requiring a decision are presented to you.
Texts, contracts and applications are prepared; technical and administrative implementations are coordinated with the relevant teams.
In the work undertaken, developments, open actions and decisions expected from you are shared in the agreed manner.
Our firm carries out the legal assessment and the actions it undertakes. Your organization shares the actual data flows and decision-making authority. The technical team implements access, retention, log and security controls. Penetration testing, digital forensics and technical incident response are separate specialist tasks; where necessary, the scope of coordination is determined separately.
The responsible attorney or team is determined when the matter is accepted. You can review professional backgrounds and areas of work on our team page.
Get to know our attorneysAssessment based on actual practice
The situations below are illustrative examples; they are not accounts of actual client files or achieved results.
Identity and contact details, camera recordings, reservation platforms and loyalty programs are examined together. The legally required registration obligation is distinguished from the marketing purpose; the same data is not transferred to every recipient.
For patient or employee health information, reports and biometric applications, the condition for processing and access authorization are assessed. The sensitivity of the data is reflected in the security and retention arrangement.
The data exchange of membership, delivery, support, analytics and advertising tools is determined. Personal data transmitted to a cloud or artificial intelligence provider is also taken into the assessment.
Preparing for the consultation
For the initial application, a short summary of the matter, the status of the parties and any approaching deadline are sufficient. The method for sharing detailed documents is clarified once the need has been determined.
Please do not include identity, health, bank or detailed third-party data in your first message. Necessary documents should be shared by the method our firm will indicate and for the purpose of legal assessment. You can review the privacy notice and our confidentiality and information security statements.
Frequently asked questions
Obligations that are often confused, and the limits of application. The conditions of the specific case are examined separately.
No. An exemption from registry registration does not, by itself, remove all KVKK obligations. The legal basis for processing, the privacy notice, security and data subject requests are assessed separately. Registration status should be determined on the basis of current Board decisions and the characteristics of the organization. [4]
No. The processing conditions in the Law are assessed first; explicit consent is one of them. Where required, consent must relate to a specific subject, be informed and be based on free will. The privacy notice, in turn, is an obligation separate from the processing condition used. Making every operation dependent on a single general approval is not the right approach. [5]
Use depends on the relevant transfer conditions being met. First, which data is transferred to which recipient and country is determined. An adequacy decision, appropriate safeguards and, where the conditions exist, incidental transfer routes are assessed. If a standard contract is used, notification to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) is required within five business days from the completion of the signatures. A regular transfer cannot be left outside the assessment merely by saying “we have obtained an approval.” [6]
Yes. This data falls within the scope of special categories of personal data. Its processing is assessed within the framework of the conditions in Article 6 of the Law and the adequate measures determined by the Board. That data can be collected in the workplace or in an application does not mean it can be processed for every purpose. [7]
The scope of application of the two regulations is not the same. Whether a GDPR review is needed, because of a European Union connection, the target audience and the data flow, is determined separately. Legal work in Türkiye and a review of foreign law or a need for local representation are planned with separate scopes and responsibilities.
Foundations of legal information
This is general information. The assessment of an application or lawsuit is based on the documents of the specific case and the legislation in force on the date of the transaction.
Contact and consultation
You can briefly share your company’s compliance need, your personal data application or your existing dispute.
To share more detailed information or to state your preferred time for a consultation, you can go to the relevant standalone page.
The scope of the legal work, fees and the necessary authorization are determined separately at the stage of accepting the matter.
Sending a message to the firm does not mean that an attorney–client relationship is established or that file and time-limit tracking is undertaken. Review the application and acceptance process.