Building software that complies with KVKK

Overview

KVKK compliance is often treated as a matter of legal text, but most obligations are met in code: which data you collect, where you keep it, when you delete it and to whom you transfer it. This training turns the part of Law No. 6698 that falls on software teams into concrete design decisions. We use the data inventory and retention design of our own site and products as examples. The training is not legal advice; please work with your lawyer on legal questions.

Course content

1. The legal framework

• Law No. 6698 and secondary regulations
• Personal data, special categories, anonymous data
• Data controller and data processor
• The law’s general principles (Art. 4)

2. Processing conditions

• Explicit consent and other legal bases (Art. 5)
• Special categories (Art. 6)
• Recording the legal basis next to the code
• Purpose limitation and data minimization

3. Data inventory

• Field, purpose, legal basis, system and period
• Deriving the inventory from code
• Provider and sub-processor list
• Lab: the inventory of an application form

4. Notice and consent in the UI

• Showing the notice in the right place
• The forced-checkbox trap
• Collecting optional consent separately
• Consent records and versions

5. Cookies and analytics

• Strictly necessary and optional cookies
• No third-party requests before consent
• Designing a cookie banner
• Enforcing with a Content Security Policy

6. Retention and deletion

• Attaching a retention period to data
• Deletion, destruction, anonymization
• An automated deletion job
• Copies left in backups and logs

7. Proving deletion

• Designing the audit log
• The deletion record
• Lab: a job that deletes expired records and records it

8. Cross-border transfer

• Transfer rules (Art. 9)
• The legal effect of choosing cloud and SaaS
• Provider inventory: country, role, mechanism
• Architecture options for keeping data in Türkiye

9. Data security

• Technical and organizational measures (Art. 12)
• Access control and least privilege
• Encryption in transit and at rest
• Personal data in logs and traces

10. Data subject rights and breaches

• Rights under Art. 11 and how to serve them
• Finding, exporting and deleting a person’s data
• Technical readiness for a data breach
• Responsibilities inside the team

Schedule

Each module takes about 4 hours, half a day; 40 hours in total.

• Day 1: modules 1 and 2
• Day 2: modules 3 and 4
• Day 3: modules 5 and 6
• Day 4: modules 7 and 8
• Day 5: modules 9 and 10

Prerequisites

• General familiarity with software development
• No legal background needed
• Bringing an example flow from your own product is recommended

Training format

• On site or remote: at your office or in live virtual sessions.
• Hands-on: every day ends with lab sessions where you apply that day’s topic to a working example.
• Lab environment: participants get a prepared working environment and a sample code repository.
• Tailored to your team: content and examples are adapted to your stack after a short call before the training.
• Materials: slides, lab guides and reference code stay with you after the training.