SEO vs GEO vs AEO: Your Brand Is on Google, but Is It in ChatGPT?
KVKK Compliance on Websites: A 10-Point Checklist
Your website's compliance with KVKK, Türkiye's data protection law, can be reviewed through ten checks covering everything from cookies and forms to third-party tools and data security. Every website that processes personal data is subject to the obligation to inform; for non-essential cookies, explicit consent is generally expected. This list is not legal advice but a checklist to use together with your legal counsel.
When people think of websites and KVKK, the cookie banner usually comes to mind. Yet on a corporate site, personal data is processed at many points, from the contact form to career applications and from analytics tools to embedded videos. The cookie policy is only one part of this picture.
The list below is designed so that marketing, IT, and legal teams can work on it together. For each check, we've also noted who might be responsible.
10 checks for KVKK compliance on your website
# | Check | What to look at | Responsible |
|---|---|---|---|
1 | Cookie inventory | Which cookies are used on the site, for what purpose, for how long, and by whom | IT, marketing |
2 | Cookie policy and privacy notice | Are cookie types, purposes, durations, and rights clearly written | Legal, marketing |
3 | Separate presentation of explicit consent and the privacy notice | Is the consent text separate from the privacy notice | Legal |
4 | Cookie loading before consent | Are non-essential cookies loaded before consent is given | IT |
5 | Preference management | Is rejecting and withdrawing consent as easy as accepting | IT, design |
6 | Forms | Is the privacy notice visible on the form, and is unnecessary data requested | Marketing, legal |
7 | Third-party tools | Is the data flow of analytics, advertising, map, video, and chat tools known | IT, marketing |
8 | Data security | Up-to-date infrastructure, authorized access, encrypted connection, backup | IT |
9 | Agency and supplier relationships | Contract and access management for the agency and hosting provider that access data | Legal, IT |
10 | Request and incident process | Is it written down who does what in the case of data subject requests and data breaches | Legal, IT |
Is KVKK mandatory for a website?
If your website processes personal data through a contact form, career application, newsletter sign-up, cookies, or analytics tools, you fall within the scope of KVKK (Law No. 6698 on the Protection of Personal Data). In that case, you need to inform visitors about which data is processed, for what purpose, and on what legal basis. Which texts and consents are required depends on the data your site actually processes; that's why the first step is an inventory.
How do you prepare a cookie policy and obtain cookie consent?
The Personal Data Protection Authority's Guide on Cookie Practices is the main reference on this topic. The general framework can be summarized as follows: explicit consent is not required for cookies that are strictly necessary for the site to function, but an information notice is expected; other cookies require explicit consent.
The technical counterpart of this framework is three rules:
Consent first, then loading: Non-essential cookies should not be loaded before the user makes a choice.
Easy rejection: Rejecting and withdrawing consent should be as easy as accepting .
Separate texts: Explicit consent and the privacy notice should be presented separately; it has been reported that the Board has issued a principle decision on this
The cookie policy should include cookie types, purposes, retention periods, third-party cookies, and data subject rights. Your legal counsel should approve the text.
Is setting up a cookie banner enough for KVKK compliance?
No. The banner is only the interface. The real question is what's behind the banner: are rejected cookies really not loaded, does the tag management tool work according to consent status, is the preference saved? Verify this with browser developer tools or your IT team's tests. Installing a ready-made banner plugin doesn't make this verification unnecessary.
What does data security cover on the website side?
KVKK requires the data controller to take appropriate technical and administrative measures to protect personal data. For a website, this corresponds to topics such as up-to-date software and infrastructure, encrypted connections, role-based access, backup, and monitoring. If the site has forms that collect personal data, you also need to know where this data is stored and who has access to it.
What should you pay attention to when working with an agency or hosting provider?
If the agency or hosting provider managing your site can access personal data, roles, access limits, and confidentiality need to be clearly written into the contract. General questions for choosing an agency are in our article How to Choose a Web Design Agency.
Is GDPR also required?
If your site also addresses visitors in the European Union, GDPR comes into play as well. Some concepts in KVKK and GDPR are similar but not identical; determine which applies to you with your legal counsel.
Frequently Asked Questions
Is KVKK mandatory for a website?
If your website processes personal data through forms, cookies, analytics, or other means, you fall within the scope of KVKK and need to inform visitors. Which texts and consents are required depends on the data you process; consult your legal counsel.
How do you prepare a cookie policy?
First, take an inventory of the cookies on your site: name, purpose, duration, and who placed them. The policy should present this information in clear language, and a separate explicit consent mechanism should be set up for non-essential cookies. Your legal counsel should approve the text.
Is consent required for strictly necessary cookies?
According to the general framework of the Personal Data Protection Authority's cookie guide, explicit consent is not required for cookies that are strictly necessary for the site to function, but an information notice is expected. Which cookies fall within this scope depends on the specific use.
Is setting up a cookie banner enough for KVKK compliance?
No. The banner is only the interface. Make sure that non-essential cookies aren't loaded before consent is given, that preferences are saved, and that consent can be withdrawn; test this technically.
How does Clockwork handle KVKK in website projects?
Clockwork is an independent digital and creative agency based in Istanbul with 25 years of experience; it is certified to ISO 27001 and ISO 12207. We design and develop websites.
Conclusion
KVKK compliance doesn't end with setting up a banner: inventory, texts, technical verification, data security, and supplier contracts need to be addressed together. Reviewing these ten checks with your marketing, IT, and legal teams in a single meeting is a good start for spotting gaps.
Clockwork is an independent digital and creative agency based in Istanbul with 25 years of experience. Legal texts are prepared by your legal counsel; if you'd like to evaluate the technical side of your site together or plan a new website, explore our services or get in touch with us.