# KVKK + GDPR DEFICIENCY (GAP) REPORT

Document code: COMP-GAP-01 · Version 1.0 · Classification: Internal
Entity: ....................   Scope (entities / systems): ....................
Prepared by: ..............   Date: ....../....../20....

SEVERITY: [1] critical  [2] high  [3] medium  [4] low
STATUS:   open / in progress / closed
For each area, record the finding, the regime(s) affected, severity, owner, date.

AREA 1 — TRANSPARENCY   (KVKK Art. 10 / GDPR Art. 13-14)
Finding: ........................................................
Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner: ........   Target: ../../20..
Checks: a notice exists per processing; controller identity; purposes; legal
basis; recipients; transfers; retention; data subject rights.

AREA 2 — LEGAL BASIS   (KVKK Art. 5-6 / GDPR Art. 6, 9)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: a lawful basis per purpose; explicit consent only where no other basis;
special-category data handled under the stricter regime.

AREA 3 — DATA SECURITY   (KVKK Art. 12 / GDPR Art. 32)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: technical and organisational measures documented; access control;
encryption where appropriate; processor security back-to-back.

AREA 4 — RECORDS   (VERBİS registration / GDPR Art. 30)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: VERBİS entry current and accurate; Art. 30 records of processing kept.

AREA 5 — TRANSFERS ABROAD   (KVKK Art. 9 / GDPR Art. 44 et seq.)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: each transfer mapped to a mechanism (adequacy / standard contract /
Board-approved BCRs / Board-authorised undertaking / occasional-transfer exception);
KVKK standard contract notified to the Board within 5 business days;
GDPR SCCs completed and a transfer impact assessment where required.

AREA 6 — BREACH RESPONSE   (KVKK Art. 12 / GDPR Art. 33-34)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: a written procedure; notification to the Board (72h per Board decision) and
the EU supervisory authority (72h), and to data subjects where required; a breach register.

AREA 7 — DATA SUBJECT RIGHTS   (KVKK Art. 11, 13 / GDPR Chapter III)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: an application channel; KVKK response within 30 days; GDPR within one month;
identity verification and a response log.

AREA 8 — PROCESSOR CONTRACTS   (veri işleyen / GDPR Art. 28)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: written instructions and security for each processor; GDPR DPA with the
eight Art. 28(3) clauses (see the Article 28 checklist).

AREA 9 — REPRESENTATION & REGISTRATION   (KVKK representative / GDPR Art. 27)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: a foreign controller's VERBİS registration and Turkish representative;
an EU representative where GDPR Art. 3(2) applies.

AREA 10 — IMPACT ASSESSMENT   (GDPR Art. 35; sectoral good practice)
Finding: ........   Regime: KVKK [ ] GDPR [ ]   Severity: [ ]   Owner/Target: ....
Checks: a DPIA for high-risk processing; large-scale special-category or
systematic monitoring flagged.

SUMMARY
Open [1] / [2] items: ....   Remediation plan ref: ....................
Next review: ....../....../20....

This report template is general in nature and does not constitute legal advice.