What is KVKK, and what does it mean for your ERP?

KVKK is short for Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), published in Turkey’s Official Gazette on April 7, 2016. The same abbreviation is used for the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), which enforces the law.

The law aims to protect fundamental rights and freedoms, above all the right to privacy, when personal data is processed. It also sets the procedures and principles that anyone processing personal data must follow. Personal data means any information relating to an identified or identifiable natural person.

Which data in an ERP is personal data?

An ERP holds more personal data than most people expect. It includes employee records, customers and vendors who are private individuals, and the names, phone numbers, and email addresses of contact persons at companies. Leads, user accounts, and session logs count too.

Article 6 of the law treats some categories, such as health data, criminal convictions, and biometric and genetic data, as special categories of personal data. Processing them is subject to stricter conditions. A health report in an employee’s personnel file and a criminal record certificate that shows convictions both fall into these categories.

The data controller’s main obligations

A business that enters data into its ERP is the data controller, because it decides why and how the data is processed. The law’s main obligations are:

• Informing data subjects (Article 10): when data is collected, the person is told who the data controller is and why the data is processed. They’re also told to whom it may be transferred, how it’s collected, the legal basis, and their rights.
• Data security (Article 12): appropriate technical and administrative measures are taken to prevent unlawful processing of and access to data and to keep it safe.
• Erasure, destruction, and anonymization (Article 7): once the reason for processing no longer applies, data is erased, destroyed, or anonymized, on the controller’s own initiative or at the person’s request.
• Requests (Article 13): a data subject’s request is resolved within 30 days at the latest.
• Registration (Article 16): unless an exemption set by the Personal Data Protection Board applies, data controllers register with the Data Controllers’ Registry before they start processing data.
• Transfers abroad (Article 9): under an amendment that took effect on June 1, 2024, adequacy decisions, appropriate safeguards, and incidental transfers apply, in that order.

KVKK in IWB

IWB includes features for the software side of these obligations. Compliance itself rests with the data controller, through its own processes and records.

• Individual contacts, contact persons, and user accounts can be anonymized. When a contact is anonymized, its personal fields are erased and the record becomes read-only; its fields on service orders and returns (RMAs) are masked too.
• In Human Resources, when a former employee’s retention period has ended, you clear their identity details after entering a reason; the cleanup doesn’t run on its own. National ID numbers and IBANs are hidden on employee records by default and can be viewed only with a separate permission.
• The Security Log records who viewed sensitive details on an employee record.
• Sensitive fields are hidden or masked by role.
• Leads in CRM keep the data source, the date the person was informed, and the version of the privacy notice (aydınlatma metni) they received.
• Attendance tracking doesn’t collect biometric data.

To generate an answer, IWB AI sends your question and the relevant records to an AI provider; the provider is named on the FAQ page. If the service is located outside Turkey, this is a transfer of personal data abroad and must be covered in your privacy notice. If you install IWB on your own server, the database and files stay on that server.