Together we build Law No. 6698-compliant data inventory, notices, consent, VERBİS registration and breach procedures.
Projects from 120,000 TRY
KVKK compliance is not just about writing text; it requires knowing in which processes, by whom and on which systems data is processed. Our team of lawyers and information security specialists runs the compliance programme under one roof.
Project steps
- Data flow map and inventory
- Privacy notices, consent and cookie management
- Retention and destruction policy, VERBİS registration
- Technical and organisational measures, data processor agreements
- Breach response plan and 72-hour notification exercise
Afterwards
We offer annual compliance audits, staff training and data controller representative services. The same inventory is reused for ISO 27001 and ISO 27701 preparation, so work is not duplicated.
Scope of service
- Data inventory and flow map
- VERBİS registration
- 72-hour breach exercise
- Shared inventory with ISO 27001
KVKK Compliance Consulting — get a quote
Fill in the form and we will get back to you as soon as possible.
Frequently asked questions
What is a SOC service and how does it differ from building our own team?
True 24/7 monitoring needs a shift team of at least 8–10 people, a SIEM licence and detection engineering. A managed SOC provides this capacity on a shared basis; setup drops from months to weeks and cost is typically a third of an in-house team.
Will a penetration test affect our live systems?
Tests follow the rules of engagement approved in the scoping document. Destructive techniques (DoS, data deletion) are not used; risky actions are announced in advance and preferably performed in a maintenance window.
How long does a penetration test take?
A mid-sized web application takes 8–10 working days, a corporate internal network test 10–15. The report is delivered within five working days of test completion; retesting after fixes is included.
What should we do in a KVKK breach?
A data breach must be notified to the Personal Data Protection Board within 72 hours of becoming aware, and to affected individuals within a reasonable time. If you reach us through the incident form we manage forensics and the legal notification together.
Should we pay the ransom after a ransomware attack?
Payment guarantees nothing and encourages attackers. First isolate, verify backups and check for decryptors. The decision belongs to senior management after a legal and business-impact analysis; we provide technical and strategic advice.