KVKK-Compliant Document Sharing: Turkey's Personal Data Protection Law

What Is KVKK?

KVKK is the abbreviation for Turkey's Personal Data Protection Law (Kişisel Verilerin Korunması Kanunu). Enacted in 2016, this law sets out the fundamental principles and obligations relating to the protection of personal data.

Principles for Protecting Personal Data

Under KVKK, the protection of personal data is governed by the following principles:

• **Lawfulness and compliance with the principle of good faith**: Personal data must be processed as prescribed by law, or in accordance with the law, without harming the fundamental rights and freedoms of the individuals concerned.
• **Being accurate and, where necessary, kept up to date**: Personal data must be accurate, up to date, and belong to the relevant individual.
• **Being processed for specified, explicit and legitimate purposes**: Personal data must be processed for specified, explicit and legitimate purposes.
• **Being relevant, limited and proportionate to the purpose for which it is processed**: Personal data must be relevant, limited and proportionate to the purpose for which it is processed.
• **Being processed in a way that protects the rights of the data subject**: Personal data must be processed in a manner that safeguards the rights of the individuals concerned.

KVKK-Compliant Document Sharing

You can follow these steps for KVKK-compliant document sharing:

1. Determine the purpose of the document sharing: Clearly define the purpose of sharing the document. This purpose should be your reason for sharing the personal data.
2. Identify the personal data involved: Determine which personal data appears in the documents to be shared.
3. Inform the individuals concerned: Notify the relevant individuals of the purpose of the document sharing, the personal data being shared, and their rights.
4. Obtain the consent of the individuals concerned: Make sure the relevant individuals consent to the sharing of their personal data.
5. Take the necessary security measures: Take the necessary security measures while sharing the documents — for example, encryption and access controls.

Practical Steps

• **Encrypt your documents**: Encrypt documents before sharing them. This prevents unauthorized access.
• **Set up access controls**: Restrict access to documents so that only authorized individuals can view them.
• **Use secure communication channels**: Use secure communication channels when sharing documents — for example, secure email services.

Conclusion

KVKK-compliant document sharing is achievable by following the fundamental principles of personal data protection. Define the purpose of the document sharing, inform the individuals concerned, obtain their consent, and take the necessary security measures. By following these steps, you can fulfill your obligations regarding the protection of personal data.