If you process personal data in Türkiye and in the EU, KVKK and GDPR apply in parallel. This deficiency report sets out, side by side, where you stand against each obligation, scores the severity, and names the owner and date for closing each gap.
Download the report templateA company that processes personal data in Türkiye and offers goods or services into the EU is caught by KVKK (Law No. 6698) and GDPR at the same time. The two regimes line up on most principles but diverge on the details that cause findings: the transfer mechanism, the registry, the breach clock and the representative.
Running two separate audits invites a fix for one regime that breaks the other — a transfer solution valid under GDPR that was never notified to the Turkish Personal Data Protection Board (the Board), or a Turkish privacy notice that does not carry the GDPR disclosures. A single deficiency report maps both columns against one processing inventory.
Its job is not to prove you are perfect; it is to show, with a date and an owner against each gap, that you have assessed yourself. That record of self-assessment is the first document both the Turkish Board and an EU supervisory authority ask for, because accountability is an obligation in its own right.
| Area | KVKK (Law 6698) | GDPR (2016/679) |
|---|---|---|
| Transparency | Privacy notice — Art. 10 | Arts. 13-14 |
| Legal basis | Arts. 5-6 (explicit consent / exceptions) | Arts. 6, 9 |
| Security | Art. 12 + Board decisions | Art. 32 |
| Records | VERBİS registration | Art. 30 records |
| Transfers abroad | Art. 9 — adequacy; standard contract notified within 5 business days; Board-approved BCRs or Board-authorised undertaking; occasional-transfer exceptions | Arts. 44-49 (adequacy / SCC / BCR / derogations) |
| Breach | Art. 12(5) — notify the Board (72h per Board decision) and data subjects | Arts. 33-34 (72h to authority) |
| Subject rights | Art. 11 application; 30-day response | Chapter III; one month |
| Processor | veri işleyen — written instructions | Art. 28 DPA (eight clauses) |
| Representative | Foreign controller: VERBİS + representative | Art. 27 EU representative |
| Impact assessment | Not a general statutory duty | Art. 35 DPIA where high-risk |
Provisions reflect the texts as at the date this page was prepared, including the 2024 amendment to KVKK Art. 9. Confirm against the version in force.
Ten areas, each scored by regime and severity, with an owner and a date. Copy the text or download it as markdown. No sign-up.
# KVKK + GDPR DEFICIENCY (GAP) REPORT Document code: COMP-GAP-01 · Version 1.0 · Classification: Internal Entity: .................... Scope (entities / systems): .................... Prepared by: .............. Date: ....../....../20.... SEVERITY: [1] critical [2] high [3] medium [4] low STATUS: open / in progress / closed For each area, record the finding, the regime(s) affected, severity, owner, date. AREA 1 — TRANSPARENCY (KVKK Art. 10 / GDPR Art. 13-14) Finding: ........................................................ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner: ........ Target: ../../20.. Checks: a notice exists per processing; controller identity; purposes; legal basis; recipients; transfers; retention; data subject rights. AREA 2 — LEGAL BASIS (KVKK Art. 5-6 / GDPR Art. 6, 9) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: a lawful basis per purpose; explicit consent only where no other basis; special-category data handled under the stricter regime. AREA 3 — DATA SECURITY (KVKK Art. 12 / GDPR Art. 32) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: technical and organisational measures documented; access control; encryption where appropriate; processor security back-to-back. AREA 4 — RECORDS (VERBİS registration / GDPR Art. 30) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: VERBİS entry current and accurate; Art. 30 records of processing kept. AREA 5 — TRANSFERS ABROAD (KVKK Art. 9 / GDPR Art. 44 et seq.) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: each transfer mapped to a mechanism (adequacy / standard contract / Board-approved BCRs / Board-authorised undertaking / occasional-transfer exception); KVKK standard contract notified to the Board within 5 business days; GDPR SCCs completed and a transfer impact assessment where required. AREA 6 — BREACH RESPONSE (KVKK Art. 12 / GDPR Art. 33-34) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: a written procedure; notification to the Board (72h per Board decision) and the EU supervisory authority (72h), and to data subjects where required; a breach register. AREA 7 — DATA SUBJECT RIGHTS (KVKK Art. 11, 13 / GDPR Chapter III) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: an application channel; KVKK response within 30 days; GDPR within one month; identity verification and a response log. AREA 8 — PROCESSOR CONTRACTS (veri işleyen / GDPR Art. 28) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: written instructions and security for each processor; GDPR DPA with the eight Art. 28(3) clauses (see the Article 28 checklist). AREA 9 — REPRESENTATION & REGISTRATION (KVKK representative / GDPR Art. 27) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: a foreign controller's VERBİS registration and Turkish representative; an EU representative where GDPR Art. 3(2) applies. AREA 10 — IMPACT ASSESSMENT (GDPR Art. 35; sectoral good practice) Finding: ........ Regime: KVKK [ ] GDPR [ ] Severity: [ ] Owner/Target: .... Checks: a DPIA for high-risk processing; large-scale special-category or systematic monitoring flagged. SUMMARY Open [1] / [2] items: .... Remediation plan ref: .................... Next review: ....../....../20.... This report template is general in nature and does not constitute legal advice.
Most gaps hide exactly where KVKK and GDPR stop agreeing:
They can. KVKK applies to processing connected to Türkiye; GDPR applies where you are established in the EU or you target or monitor people in the EU (Art. 3). A Turkish company selling into the EU, or an EU company processing Turkish data, can be inside both at once.
No. The principles align, but KVKK has its own transfer mechanism, its own VERBİS registry, its own representative rule and its own timelines. A GDPR programme is a strong base, but the KVKK-specific items are assessed separately.
Article 9 moved to a tiered model closer to GDPR: an adequacy decision first; failing that, appropriate safeguards — a standard contract notified to the Board within five business days, binding corporate rules approved by the Board, or a written undertaking authorised by the Board; and finally exceptions for occasional transfers. Explicit consent now survives only as one of those occasional-transfer exceptions, not as a routine transfer basis.
It is a discrete, visible obligation with its own administrative fine, so it usually scores high. It is also one of the first things checked, which is why the report flags registration as its own area.
No. It structures the self-assessment and surfaces the gaps so a review is faster and cheaper. The scoring and the legal conclusions on each finding still need qualified review against your actual systems.