SCH-Legal addresses personal data protection and cybersecurity obligations together. It runs KVKK compliance projects for data controllers and data processors, preparing personal data processing inventories, VERBİS registrations, privacy notices, explicit consent texts and data protection policies. It also assists clients with cross-border data transfers, data processing agreements and proceedings before the Turkish Personal Data Protection Board.
In cyber incidents and data breaches, SCH-Legal provides legal support throughout the response and handles the notifications required under the Cybersecurity Law and the KVKK. It advises on information security policies, security provisions in supplier and cloud agreements and the responsibilities of managers and employees, and represents clients in Board investigations, administrative fine proceedings and post-incident disputes.
What we do
- Inventories, VERBİS registration, privacy notices, consent texts and policies are prepared in KVKK compliance projects
- Cross-border data transfers, data processing agreements and Board applications are handled
- Legal response and notification support is provided from the first hours of a cyber incident or data breach
- Information security policies and supplier and cloud agreements are reviewed and drafted
- Clients are represented in Board investigations, administrative fine proceedings and disputes
Frequently asked questions
Common questions on data protection and cybersecurity
Registration, cross-border transfers, breaches and Board proceedings.
Who has to register with VERBİS?
Data controllers with 50 or more employees a year, or with an annual balance sheet total above the threshold set by the Personal Data Protection Board, must register with VERBİS, the Data Controllers’ Registry. Those whose main activity is processing special categories of personal data, such as private hospitals and clinics, must register regardless of headcount. There is no exemption for data controllers established outside Turkey.
Being exempt from registration does not mean being outside the Law. Small companies still have the same duties to inform, to keep a data inventory and to secure the data.
If we have a data breach, who do we notify and how quickly?
The Personal Data Protection Board, within 72 hours of becoming aware of the breach at the latest. The people affected should also be told as soon as reasonably possible. Organisations within the scope of the Cybersecurity Law may also have to notify the Cybersecurity Directorate.
In practice, most of the 72 hours goes on working out whether the incident actually involves personal data. Companies that prepared a simple response plan beforehand, setting out who checks what, handle this period much more comfortably.
How can we transfer personal data abroad?
Since June 2024 there have been three routes: transfers to countries the Board has found adequate; transfers backed by appropriate safeguards such as standard contracts, binding corporate rules or a written undertaking approved by the Board; and, for occasional transfers, the exceptions listed in the Law.
A standard contract must be notified to the Authority within five business days of signing. Explicit consent, once the most commonly used basis, now only covers occasional transfers. It is not enough for an ongoing cloud or CRM service.
What does a KVKK compliance project cover?
The backbone is the data inventory: what data the company processes, for what purpose, where and for how long. Privacy notices, explicit consent forms, the retention and destruction policy and the VERBİS registration are all prepared on the basis of that inventory. On top of this come updated contracts with data processors, a review of technical and organisational measures, and staff training.
The aim is not a file that goes on the shelf once the project ends, but a company that can update its own inventory whenever a new process or piece of software comes in.
We have received a request for information and documents from the Board. What should we do?
The Law allows 15 days to respond. If you need more time, ask for it with reasons before the deadline passes. The response is not just a matter of sending the documents requested. It works as a defence that explains the company’s compliance position, and it affects both whether an administrative fine is imposed and how large it is.
Team
Our team in this area
View all →
Contact
How can we help?
Tell us briefly about your matter and the relevant team will get back to you.
info@sch-legal.com · +90 212 709 08 50