Skip to main content

Information Technology

We provide legal services for our clients in IT sector. We also provide legal advice in relation to information technology law, including but not limited with domain names, data transfer, electronic trade, disclaimers for websites, cookies, secured electronic signature, outsourcing, support services of regulated companies, licensing and regulatory matters, review of IT related agreements, internet issues, privacy and data protection, software license contracts.

F.A.Q.

Am I subject to the Personal Data Protection Law (KVKK)?
  • The Law applies to all natural persons whose personal data are processed and to all natural or legal persons who process such data fully or partially through automatic or non automatic means only for the process which is part of any data registry system set out in the Law. Accordingly, there is no distinction between private corporations and public authorities. Therefore, rules and procedures determined by the Law apply to all institutions and organisations. However, the Law exceptionally does not apply in cases, specificly expressed in Art. 28 of the Law (F.e., processing of personal data by natural persons within the scope of activities related to themselves or family members living together in the same dwelling, processing of personal data for official statistics and research, planning, and statistical purposes after having been anonymised).
  • One of the most commonly misunderstood issues about the Law is the VERBIS (Data Controller Information System) Registry Obligation. Most people in Turkey still believe that they are not subject to the Law, if they are not obliged to be registered to VERBIS. However, only data controllers meeting some key principles as detailed by the Law have an obligation to register in VERBIS. However, being exempt of this obligation does not mean that the Law and its obligations will not apply to the rest of the Data Controllers.
What are the main legal issues to consider when developing an e-commerce web site?
  • Domain Check: Before developing an e-commerce web-site, the domain name should be diligently chosen, to not infringe any intellectual property right.
  • ETBIS (Electronic Commerce Information System) Registration: The Law provides that before performing to conduct e-commerce activities on web-site, the registration over the (“ETBİS”) is required for (i) service providers operating in their own e-commerce environment; (ii) intermediary service providers and (iii) providers resident and conducting e-Commerce activities within Turkey together with providers resident outside of Turkey contracting or ordering through an intermediary service provider.
  • KVKK (GDPR) Requirements: Making your web-site KVKK compliant is necessary and helps to protect users’ data. Therefore, the web-site developer must have a publicly accessible privacy policy that outlines all processes connected with personal data and provide customers with an easily accessible link to your privacy policy and an option to agree to the terms and conditions, including receipt of data process consent (F.e., subscription for newsletters, registry as a member).
  • Cyber Security Measures: Make sure that all security systems you are using to protect your users’ and your company’s data are up to date. Do not forget that any unauthorized access to your network may end up with a lawsuit
My personal data has been processed without my consent, what should I do?
  • If your personal data is processed by a data controller without your consent, you may request the erasure, destruction or anonymization of your personal data from the data controller.
  • In case the data controller should not act on this request or refuse it without justified grounds, you may lodge a complaint to the Personal Data Protection Board. As a result of the examination made upon complaint, the Board may decide that the identified infringements shall be remedied by the relevant data controller and sentence the data controller to pay an administrative fine of 040 TRY to 1.802.636 TRY as well as prison up to 3 years.
  • The right to compensation, based on the general provisions, of those whose personal rights are violated, is reserved.