What does the KVKK Compliance Risk assessment tool do?

It helps you review your company's KVKK compliance status with a 20-question self-assessment. At the end of the assessment, you see a detailed report containing a weighted score, your risk level, and improvement recommendations.

How many questions does the assessment consist of and how is scoring done?

The assessment consists of 20 questions, and each question is scored with a weight. Your total score is calculated based on your answers.

What do you see on the results screen?

You see your instant score and which of the 5 risk levels you are in. The report also provides improvement recommendations.

Why do you ask for my company name?

The company name you enter is used in the generated report. You can write this information in the way you want it to appear in the report.

Does this tool replace an official KVKK audit?

No, this tool is not an official audit; it is intended only for preliminary assessment. You need to evaluate your results with a KVKK expert.

KVKK Risk Assessment Tool

Company Name (used in the report)Rapor Dili / Report Language

Live Score

0/100

Risk: CRITICAL

CRITICAL — your company is not KVKK-compliant. You could face fines of up to 1,000,000 TL in a KVKK audit.

Q1 (weight 5/5). Has your company documented and published a KVKK compliance policy?

Q2 (weight 5/5). Has a data controller/representative been appointed? Are you registered with VERBİS (the Data Controllers' Registry)?

Q3 (weight 4/5). Is a data processing inventory maintained, and was it updated within the last 6 months?

Q4 (weight 4/5). Is a personal data processing notice published on your website (KVKK Art. 10)?

Q5 (weight 4/5). Is there a form/consent system in place for processing activities that require explicit consent?

Q6 (weight 3/5). Is a cookie policy and cookie consent banner active?

Q7 (weight 3/5). Is annual (at least once a year) KVKK training provided to personnel?

Q8 (weight 5/5). Is your data stored encrypted (in transit + at rest)? (TLS 1.3, AES-256)

Q9 (weight 4/5). Is RBAC (role-based access control) implemented? Are access logs maintained?

Q10 (weight 3/5). Do you have a backup and disaster recovery plan, and has it been tested?

Q11 (weight 3/5). Do you have periodic penetration testing performed (at least once a year)?

Q12 (weight 5/5). Is a data breach response plan documented in writing? Is the 72-hour notification protocol ready?

Q13 (weight 4/5). Do your supplier agreements contain KVKK compliance clauses (especially for cloud providers)?

Q14 (weight 5/5). If personal data is transferred abroad, is it based on explicit consent or a Board (Kurul) adequacy decision?

Q15 (weight 4/5). Is there a process in place that responds to data subject requests within 30 days?

Q16 (weight 4/5). Are retention periods defined, and is data whose retention period has expired destroyed?

Q17 (weight 5/5). If you process special category data (health, biometric), are additional safeguards in place (KVKK Art. 6)?

Q18 (weight 3/5). Have employees signed a confidentiality agreement (NDA) and a KVKK awareness acknowledgment?

Q19 (weight 3/5). If a CCTV system is in use, is a notice provided and is the retention period capped (max. 30 days)?

Q20 (weight 3/5). Is there a designated person responsible for tracking KVKK Board decisions and current legislation?

⚠️ Legal Notice

This self-assessment template gives a rough picture of your KVKK compliance status — it is not a definitive legal conclusion. For a detailed compliance analysis, have an independent audit performed by a KVKK expert/lawyer.

KVKK Penalties (Art. 18): Administrative fines ranging from 5,000 TL to 1,000,000 TL. Late data breach notification and inadequate security measures are the most commonly penalized items.

You can also get the downloaded report in English via the "Report Language" selector. The English output is a translation of the Turkish original; in case of any discrepancy, the Turkish text prevails.

Auto-deleted in 7 days

256-bit SSL

Support

Your files are encrypted with SSL and automatically deleted from our servers 7 days after processing.

📖 How to Use

Upload document

Drag-drop or pick file.

Set options

Choose operation and parameters.

Process

Server runs the task.

Download

Get result in your format.

⚖️ This tool is not legal advice — it only provides a draft/summary/information. Always consult a lawyer before making important decisions. KolayDönüştür is not responsible for the legal consequences of any output.

👨‍⚖️ Find a lawyer via the Union of Turkish Bar Associations (barobirlik.org.tr)

Frequently asked questions

No. The form only takes the company name and report language; the same fixed 20-question list is applied to everyone, and there is no industry-specific algorithm.

KVKK Compliance Risk Assessment user reviews

No reviews yet. Be the first to tell others how KVKK Compliance Risk Assessment worked for you.

KVKK Compliance Risk Assessment