Frequently asked questions

Any company—local or foreign—that processes personal data of Turkish residents must comply with the Turkish Personal Data Protection Law (KVKK). This includes registering in the VERBIS system and implementing compliant privacy practices. Non-compliance can lead to significant fines.

Yes. Even without a Turkish company, if you collect or process data of Turkish users, you are required to register with VERBIS through a Turkey-based representative (similar to GDPR Art. 27). Kooch offers this Data Protection Representative (DPR) service to handle this obligation on your behalf.

KVKK is Turkey’s data protection law, closely modeled on GDPR but with local differences (e.g., registration obligations, consent rules). Many companies already GDPR-compliant still need adjustments to fully comply with KVKK.

We offer four main packages:

- KVKK Startup Launchpad: Entry compliance (VERBIS, privacy notices, cookie banners).
- KVKK/GDPR Gap Analysis: Full compliance audit + roadmap.
- ISO 27001 Readiness: Documentation and ISMS build for certification.
- Ongoing Compliance Management: Year-round support and DPO-as-a-service.
- Data Protection Representative (DPR): for foreign companies.

- KVKK Launchpad (VERBIS + notices): ~2–4 weeks.
- Gap Analysis: ~4–6 weeks.
- ISO 27001 Readiness: 3–6 months depending on scope.
- DPR service: 1–2 weeks for setup, ongoing support afterward.

- Launchpad: $3K–$5K one-time + $3K/year for maintenance.
- Gap Analysis: $3K–$11K depending on complexity.
- ISO 27001 Readiness: $10K–$20K.
- Ongoing Compliance: $500–$1,500/month.
- DPR: $2,500–$4,000/year.

Penalties under KVKK include fines up to ~TRY 2M (~€60K) per violation. Non-compliance can also block business deals (partners or investors may require proof of compliance) and damage reputation.

Yes. All policies, notices, and agreements are delivered in both Turkish and English, ensuring compliance with regulators and clarity for international stakeholders.

For Turkish law, the equivalent role is covered by our Ongoing Compliance Management package. We provide continuous oversight, regulator liaison, and DSAR handling, similar to a DPO under GDPR.

Not necessarily. If you process Turkish personal data (even for a small user base), you may still fall under KVKK obligations. We’ll assess your case and only recommend services you truly need.

We apply strict internal controls: encrypted communications, least-privilege access, secure file transfer, and documented incident response. We also carry professional liability insurance, so our clients are protected.