1. Detailed Information Training on PDPL (KVKK) Compliance Projects

At this stage, the company is provided with detailed information regarding PDPL (KVKK) consultancy. The training covers the purpose of the personal data processing inventory and explains the relationship between the inventory, VERBIS, and the standard contract.

2. Inventory Review

In order for the standard contract to be executed, the following must be assessed: identification of the overseas parties to whom personal data is transferred, the legal basis for the transfer, and the categories of data subjects whose personal data is transferred.

The purpose of the personal data processing inventory is to provide a detailed table showing which personal data processing activities are carried out by the company and to identify any non-compliance with the legislation. In addition, if no non-compliance is identified, it serves as a basis for substantiating the company’s compliance with the legislation.

Data Controller – Data Processor (DC–DP) Checks

Considering the personal data processing inventory previously prepared by the company, it is assessed whether the party involved in the data transfer acts as a data controller or a data processor. Based on the outcome of this assessment, the content of the standard contract to be signed—published on kvkk.gov.tr—is determined.

Preparation of the Standard Contract / Signature Processes

Correspondence is carried out with the parties involved in the data transfer and the contract signature process is initiated. After the overseas recipient party sends the standard contract template, the annex sections of the contract are completed in line with the personal data processing inventory.

Subsequently, the party to whom the data is transferred is contacted and the signature process is carried out.

The executed standard contract is then notified to the Personal Data Protection Authority (KVKK Authority).