KVKK checklist for online stores

To sell online in Türkiye under the KVKK (Law No. 6698 on the Protection of Personal Data), you need a legal condition for each use of customer data, an information notice (aydınlatma) at collection, explicit consent (açık rıza) in a separate text wherever you rely on it, VERBİS registration unless exempt, consent before non-essential cookies, a safeguard for transfers abroad, answers to requests within 30 days, breach reports within 72 hours, and a deletion routine. Each item follows, with the rule behind it.

This article is general information, not legal advice. Board decisions change over time, so confirm specific questions with a qualified adviser or the Personal Data Protection Authority (KVKK Kurumu).

1. Confirm who the data controller is

The KVKK applies to anyone processing personal data of natural persons by automated means, or by non-automated means within a filing system (Article 2). The data controller (veri sorumlusu) decides the purposes and means of processing; a data processor (veri işleyen) acts on its behalf (Article 3). For a store, the business behind the storefront is the controller; its hosting, email and analytics providers are usually processors.

Inventory each place data enters (checkout, account, newsletter, forms, chat, analytics and ad tags): what you collect, why, who receives it, whether it leaves Türkiye and for how long. Article 4 requires processing to be lawful, purpose-specific, proportionate and no longer than needed.

2. Pick a condition for each purpose, and keep notice and consent apart

Article 5(1) starts from the rule that personal data may not be processed without explicit consent, then lists the cases where consent is not needed (Article 5(2)). Most store processing rests on those cases:

Processing	Usual condition	Notes
Taking, delivering and returning orders	Contract, Art. 5(2)(c)	Only data directly related to the contract.
Invoices and tax records	Legal obligation, Art. 5(2)(ç)	Retention set by the relevant law.
Fraud checks and account security	Legitimate interest, Art. 5(2)(f)	Only if it does not harm the customer's fundamental rights; record your assessment.
Behavioral advertising cookies	Explicit consent	Per the Board's cookie guide.
Special categories, such as health data	Art. 6(3) only	Prohibited unless a listed condition applies.

The information notice is owed whatever the condition (Article 10): the controller's identity, the purpose, to whom and why data may be transferred, the method and legal basis of collection, and the rights under Article 11. Explicit consent is "freely given, specific and informed consent" (Article 3). The Authority treats blanket consent to "any kind of processing" as invalid, puts the burden of proof on the controller, and says withdrawal takes effect once it reaches you.

In principle decision 2026/347 of 18 February 2026, the Board required the two texts to be separate:

Where you rely on consent, put the notice and the consent text under different headings, with a separate statement for each, even on the same page.
Where you rely on another condition, give the notice only; do not also ask for consent.
Ask customers only to confirm they have read the notice, never to "approve" it.
Do not copy another company's texts; write your own in plain language, naming data categories, purposes and legal grounds.

3. Check whether you must register with VERBİS

Article 16 requires controllers to register with the Data Controllers' Registry (VERBİS) before processing, unless the Board grants an exemption. Under Board decision 2018/87 as amended (latest by decision 2025/1572 of 4 September 2025), controllers are exempt with fewer than 50 employees a year and an annual balance sheet total under 100 million Turkish lira, if their main activity is not processing special categories of data; for those whose main activity is, the limits are 10 employees and 10 million lira. Businesses without balance-sheet-basis books are assessed on employee count only (decision 2025/2393).

The Authority's VERBİS Q&A (October 2025) says these thresholds are not considered for controllers established abroad. The registry is public, so what you declare under Article 16(3), including transfers abroad and maximum retention periods, should match your notice.

4. Get cookie consent right

Türkiye has no direct equivalent of the EU ePrivacy cookie rule for ordinary websites; the Authority's cookie guide (Çerez Uygulamaları Hakkında Rehber, 2025 edition) assesses cookies that process personal data under Law 6698. Its advice:

Exempt only the strictly necessary: cookies used solely for transmission, or strictly necessary for a service the user explicitly requested.
First-party analytics may qualify if limited to measuring your own audience, ideally with IP masking and no cross-site tracking.
Advertising cookies need explicit consent. Entering the site is not consent, and consent cannot be bundled into terms of use or a privacy notice.
Equal buttons: "accept", "reject" and "preferences" equal in color, size and font, with consent-based cookies off by default.
Easy withdrawal through a small icon or band, and no cookie wall that makes access conditional on accepting everything.

If third-party cookies send data to companies abroad, Article 9 applies. For how consent reaches ad platforms, see cookie consent and Consent Mode and the glossary entry on Consent Mode.

5. Map every transfer abroad

Law No. 7499, published in the Official Gazette on 12 March 2024, rewrote Article 9, effective 1 June 2024. The regime is layered:

Adequacy decision by the Board for a country, sector or international organization. The Authority states that it has not yet made any.
Appropriate safeguards, for stores usually the Board's standard contracts, adopted on 4 June 2024 (decision 2024/959) in four versions, including controller to processor. A signed standard contract must be notified to the Authority within five business days (Article 9(5)).
Incidental transfers, only for occasional, non-regular transfers when neither applies, for example with explicit consent after the customer is told the risks.

A host, email platform or analytics tool outside Türkiye usually means regular transfers, so plan the safeguard.

6. Answer data subject requests within 30 days

Article 11 gives customers rights to information, correction, erasure, objection to purely automated results, and compensation. Under Article 13 you must conclude a request "at the latest within thirty days" and free of charge, unless it involves extra cost under the Board's fee tariff. The customer may then complain to the Board within 30 days of your reply, and in any case within 60 days of the request (Article 14). Keep one published channel, proportionate identity checks, a deadline log and a tested account export.

7. Report breaches to the Board within 72 hours

Article 12(5) requires the controller to notify the data subject and the Board "within the shortest time" when data is obtained by others unlawfully. The Board's decision 2019/10 of 24 January 2019 reads this as 72 hours from learning of the breach, with affected people told within the shortest reasonable time after you identify them, directly or, failing that, for example on your website. The decision also asks you to use the Board's form and explain any delay, record every breach, require processors to tell you without delay, and keep a reviewed breach response plan. It covers controllers abroad when a breach affects people in Türkiye. See also security as a feature.

8. Set retention periods and a deletion routine

When the reason for processing ends, Article 7 requires you to erase, destroy or anonymize the data on your own initiative or on request; failing to do so can be a criminal matter under Article 17. The Authority notes that a controller with a retention and destruction policy deletes at the first periodic destruction run after the obligation arises. Set a period for each data set, keep it consistent with the maximum periods declared in VERBİS, and automate deletion.

How KVKK differs from the GDPR

If you follow our GDPR checklist for online stores, these are the differences we verified in the texts:

Default rule. The GDPR lists six equal lawful bases (Article 6); the KVKK starts from explicit consent and lists exceptions.
Registration. The GDPR asks for an internal record of processing (Article 30); the KVKK adds a public registry, VERBİS, unless exempt.
Requests. The GDPR allows one month, extendable by two months; the KVKK text sets 30 days with no extension and has no data portability right like GDPR Article 20.
Breaches. The GDPR's 72 hours are in the regulation, with an exception for breaches unlikely to create a risk; the KVKK's come from a Board decision, and Article 12(5) has no such risk threshold.
Transfers. The EU has adequacy decisions; the Board has made none, so standard contracts do most of the work.

Where CIQRA fits

No platform can make a store KVKK-compliant; your notices, consent texts, VERBİS status, contracts and processes remain the data controller's responsibility. What CIQRA provides is groundwork: data hosted in Microsoft Azure data centers in Germany, with AI text processing in the EU data zone, and each store's data kept apart at database level; cookie consent in 40 languages, with no tracking cookies until visitors opt in, cookies listed automatically and consent recorded. Because hosting is in Germany, a store established in Türkiye should treat this as a transfer abroad under Article 9 and plan the safeguard with its adviser. In Türkiye, Reklam5, our official implementation partner, handles sales, TRY invoicing and integration.

FAQ

Does a small online store need to register with VERBİS?

Often not: a controller with fewer than 50 employees and a balance sheet total under 100 million lira, whose main activity is not special-category data, is exempt. Every other KVKK duty still applies.

Can one checkbox cover the privacy notice and marketing consent?

No. Under decision 2026/347 the notice and any consent text must be separate, with separate statements, and customers only confirm they have read the notice.

KVKK checklist for online stores selling in Türkiye (2026)