How to Achieve KVKK Compliance for an E-Commerce Site? Disclosure Notice, Explicit Consent, Cookies, İYS and Rights Requests: A Practical Guide

Anyone who opens an e-commerce site processes personal data every day, whether they realize it or not: the customer's name, address, phone, email, order history, payment information and the traces they leave on the site. As the business that collects, uses and stores this data, KVKK compliance (KVKK is the Turkish Personal Data Protection Law), that is, acting in line with the Personal Data Protection Law, is the responsibility not only of large companies but of every store that receives its first order.

This article is structured like a lesson. You will learn step by step what KVKK means for e-commerce, which data is processed on which legal basis, the elements a disclosure notice must contain, the difference between the disclosure notice, explicit consent and commercial message consent, cookie management, how to handle customer rights requests, data security and what to do in case of a breach. With the checking tool in the article, you can measure the current state of your site right away.

Note: This article is for general information purposes and is not legal advice. The information is based on the Personal Data Protection Law No. 6698 and related regulations as known in October 2026; legislation and Board decisions may change. We recommend having your texts reviewed by a lawyer according to your business.

What Is KVKK and What Does It Mean for an E-Commerce Business?

KVKK is Law No. 6698, which protects the fundamental rights and freedoms of individuals in the processing of personal data and sets out the obligations of those who process data. An e-commerce business is considered a "data controller" because it determines for what purpose and with what means customers' data is processed.

Personal data is any information relating to an identified or identifiable natural person: name, surname, address, phone, email, order history, IP address and behavioral data collected through cookies are the main examples. Information about corporate customers (legal entities) is outside the scope; however, personal information about a company's representative is within scope.

Okumanızı öneririzE-Ticaret Hukuku Hakkında Merak Edilenler

Where and on What Basis Is Personal Data Processed in E-Commerce?

A different piece of data is collected at every step of the customer journey, and each piece rests on a different legal basis or consent. You can process the data needed to deliver an order without explicit consent; using the same data for marketing, however, requires a separate consent.

The table is a general framework; each business should map out its own data flow and determine the legal basis according to the process. This work is the first step of KVKK (Turkish Personal Data Protection Law) compliance: the data inventory.

How to Build a Data Inventory

A data inventory is a table showing which personal data is collected where, why it is collected, where it is stored, who it is shared with and how long it is kept. The privacy notice, retention period and security decisions are all based on this table; a business without an inventory cannot know what to disclose.

1. List the points where data is collected: Registration form, order form, contact form, newsletter, live support, cookies, marketplace orders, orders taken by phone.
2. Write down which data is collected at each point: Such as name, phone, address, email, IP.
3. Define the purpose: Order delivery, invoicing, customer service, marketing, analytics.
4. Write down who it is shared with: Shipping, payment provider, accounting, email service, advertising and analytics tools.
5. Define where and for how long it is stored: In which system, for how long, and when it will be deleted.
6. Add security measures: Access authorization, encryption, backups.

What Is a Privacy Notice and What Should It Contain?

A privacy notice is the text through which the data controller informs the data subject when collecting personal data; under Article 10 of the Law, it is mandatory at the time of collection. The text is informative in nature; it is not a consent text.

1. Identity of the data controller: Your company name, address and contact details.
2. Purpose of processing: The purposes for which data will be processed (such as order delivery, invoicing, customer service, marketing).
3. Transfers: To whom (such as shipping, payment provider, accounting) and for what purpose the data may be transferred.
4. Collection method and legal basis: How the data is collected (web form, cookie, phone) and on which legal basis.
5. Rights of the data subject: The rights under Article 11 of the Law and how to exercise them.

The privacy notice must be written in clear and understandable language, be accessible when data is collected, and be visible or reachable via a link at every data collection point (registration form, order page, contact form). Preparing separate short texts for each process instead of one long text for all of them makes it more readable.

We recommend readingWhat Is Privacy? (Glossary)

Are the Privacy Notice, Explicit Consent and Commercial Message Consent the Same Thing?

No. A privacy notice is informational and requires no consent; explicit consent is an approval given for a specific data processing activity, based on information and freely; commercial message consent is the separate permission obtained to send campaign messages to a consumer. The three must be managed in separate texts, with separate boxes and for separate purposes.

The most common mistake is a single box saying "I have read the privacy notice, I accept, and I want to receive campaign messages." This both mixes two different purposes and makes marketing permission a condition of the service.

Okumanızı öneririzİleti Yönetim Sistemi (İYS) Hakkında Bilmeniz Gereken Her Şey

What Should Be Done About Cookies?

Cookies are small files stored in a visitor's browser, and if they process personal data they are subject to the information obligation. Cookies essential for the site to work can be used without permission; analytics, advertising and marketing cookies require informing the visitor and, in most cases, obtaining explicit consent.

• Classify your cookies: Separate essential, preference, analytics and marketing cookies.
• Show a notice to visitors entering the site: Provide a cookie notice explaining the types and purposes of cookies.
• Make refusing easy too: Refusing, or managing preferences, should be as easy as accepting.
• Don't run tracking codes before consent: Analytics and advertising codes should load after the visitor gives consent.
• Record preferences: Log the visitor's choice and the time; you can prove it when needed.
• Publish your cookie policy: Have a page explaining which cookies are used, why, and how to turn them off.

Okumanızı öneririzÇerezler E-Ticaret Sitenizin Sağlığı İçin İyi mi Kötü mü?

What Legal Pages Must an E-Commerce Site Have?

An e-commerce site must have at least the following legal pages and texts: a privacy notice, a privacy policy, a cookie policy, membership or terms of use, a distance sales contract with preliminary information, return and withdrawal terms, payment and delivery terms, and contact information. All of them should be easy to reach from the footer.

We recommend readingWhat Is a Distance Sales Contract?

How Are Customer Rights Requests Handled?

Under Article 11 of the Law, customers have rights such as finding out whether their data is being processed, requesting information, and requesting correction and deletion; the data controller must respond to a request within 30 days at the latest. Where and how requests are to be submitted must be stated in the privacy notice, and the process must be defined in advance.

1. Receive and log the request: Define the request channel (email or form) and give every request a record number.
2. Verify identity: Verify the applicant's identity by reasonable means so that data is not given to someone else.
3. Evaluate the request: Check which data is held in which systems; do not delete data subject to a legal retention obligation (such as invoices).
4. Respond within 30 days at the latest: Notify the applicant in writing of the acceptance or the reasons for rejection.
5. Keep the record: Keep the request and the response as proof.

How Do You Protect Personal Data?

The data controller is obliged to take the necessary technical and administrative measures to prevent personal data from being processed unlawfully, accessed unlawfully or lost. These measures do not require large investments; most rest on a basic routine.

• Use a secure connection: Make sure all pages are served over SSL (https).
• Restrict access: Only the necessary employees should enter the admin panel, with their own accounts and a strong password; use two-step verification.
• Don't store card information: Payment information should be left to the payment system and not kept in order records.
• Take regular backups: Store the backups securely too; prevent unauthorized access.
• Inform your employees: Everyone who handles data should know the confidentiality and sharing rules.
• Sign contracts with service providers: Contracts with companies that process data (infrastructure, shipping, email) should include confidentiality and security terms.
• Delete when necessary: Once the purpose ends and the retention period expires, delete the data or anonymize it.

Okumanızı öneririzE-Ticaret Sitesi Güvenlik Sistemleri

What Changes If Services Abroad Are Used?

The servers of analytics, advertising, email or cloud services are often located abroad; in this case visitor and customer data is transferred abroad, and additional conditions apply to the transfer. These conditions and the permitted routes are regulated in legislation and may change over time.

• List the services you use: Which tool sends which data to servers in which country?
• State it in the privacy notice: Write that data may be transferred abroad, and the purpose.
• Ask the provider: Find out in writing the server location and data protection terms from your service provider.
• Check the current rule: Since transfer procedures can change, confirm the current route with your legal counsel.

What Should Be Done in Case of a Data Breach?

If personal data is seized by unauthorized persons, the data controller must notify the data subjects concerned and the Personal Data Protection Board as soon as possible; according to the Board's decision, notification to the Board must be made within 72 hours of learning of the breach. This is why a response plan must be ready before a breach occurs.

• Stop and contain: Close the vulnerability, cut off the affected access, change passwords.
• Determine the scope: Keep a record of which data, how many people it concerns and when it occurred.
• Notify: Notify the Board and the affected people on time.
• Fix the cause and document it: Take measures to prevent recurrence and record the incident.

The form and details of notification are set by Board decisions and may change; check the current procedure from the Authority's publications and your legal counsel. The obligation of data controllers to register in the registry (VERBİS) also varies according to criteria; learn the current rules for your own situation.

E-Commerce KVKK Compliance Checker

The tool below measures your site's basic readiness for KVKK with twelve items. Tick the items that are ready; the tool shows the percentage you have completed and your priority gaps. The tool is a general preliminary assessment and is not a substitute for legal advice.

8 Common Mistakes in KVKK Compliance in E-Commerce

1. Copying another site's text: The data flow, the companies data is transferred to and the purposes won't match yours.
2. Combining the privacy notice and explicit consent in one box: Two separate purposes get mixed up and the consent may be deemed invalid.
3. Making marketing permission a condition of the order: Explicit consent must be given freely.
4. Presenting pre-ticked boxes: A pre-ticked box does not count as free consent.
5. Running tracking codes before consent: Showing a cookie notice is pointless if it does not stop the codes.
6. Collecting unnecessary data: Every field you don't use is an extra burden to protect and respond about.
7. Not defining the rights request process: The 30-day deadline is missed and complaints arise.
8. Not updating the texts: When you add a new tool or service, the privacy notice must be updated too.

E-Commerce KVKK Compliance Checklist

Check the following items before launching the site and at regular intervals.

• Is your data inventory up to date: which data, where, why, for how long?
• Is the privacy notice visible, or reachable via a link, at every data collection point?
• Does the privacy notice contain the five elements listed in the Law?
• Are explicit consent, commercial message consent and the privacy notice presented separately and without mixing?
• Are the consent boxes unticked and not a precondition of the service?
• Does the cookie notice work, is refusing easy, and are tracking codes stopped before consent?
• Are commercial messages sent only to approved recipients, and is İYS (Turkey's commercial message consent registry) registration managed?
• Are the privacy, cookie, return, distance sales and delivery texts in the footer?
• Is there a defined channel for rights requests and a 30-day response process?
• Is your site served over SSL, and is access to the admin panel restricted and protected with two-step verification?
• Is there a contract with service providers that includes privacy and security terms?
• Is a data breach response plan ready, and are the responsible people identified?

Legal Texts, Cookie and Consent Management with Faprika

Preparing the texts and managing consents is the most tiring part of putting KVKK (Turkish Personal Data Protection Law) compliance into practice. Faprika offers the following for this stage (you can see which feature starts in which plan on the e-commerce plans page):

• Ready-made contract and text samples: Sample texts for privacy and security, membership, payment and delivery, warranty and return terms, and the distance sales contract are available on the training pages: Privacy and Security, Membership, Payment and Delivery, Warranty and Return Terms and Distance Sales Contract. The samples are starter templates; adapt them to your business and have your lawyer review them.
• Cookie management module: Collects, stores and logs visitors' cookie preferences; details are on the Cookie Management page. Varies by plan.
• Message management and İYS integration: The Message Management System solution is available for İYS-compliant management of commercial message consents.
• SSL security certificate, backup and maintenance: Included in all plans.
• Message templates: Templates for order and notification emails are edited from the panel.

Frequently Asked Questions

Is KVKK mandatory for e-commerce sites?

Yes. Every e-commerce business that processes customers' personal data such as name, address, phone and email is a data controller, regardless of its size, and is subject to the Law's obligations, especially the disclosure and data security obligations.

What is a disclosure notice and what should it include?

The disclosure notice is the text with which you inform the data subject when collecting data. It must include the identity of the data controller, the purpose of processing, to whom and for what purpose the data may be transferred, the collection method and legal basis, and the rights of the data subject. It is an information text, not a consent text.

Are the disclosure notice and explicit consent the same thing?

No. The disclosure notice is information and does not require consent. Explicit consent, on the other hand, is a separate approval given for a specific processing activity, based on information and with free will. The two should not be combined in the same box, and marketing permission should not be made a precondition of the service.

Is a cookie notice mandatory?

If your site uses analytics, advertising or marketing cookies beyond the necessary ones, you must inform the visitor and in most cases obtain explicit consent. Tracking codes should not run before consent is given, and rejecting should be as easy as accepting.

What should be done if a customer asks for their data to be deleted?

The request is received, identity is verified and the request is answered within 30 days at the latest. Data subject to a legal retention obligation (for example invoice records) is not deleted; the reason is communicated to the applicant, and other data is deleted or anonymized.

What should be done in case of a data breach?

Close the vulnerability and determine the scope, then notify the affected individuals and the Personal Data Protection Board as soon as possible; according to the Board decision, notification to the Board must be made within 72 hours of becoming aware of the breach. Remove the cause and record the incident.

You May Also Like

• E-Ticaret Sitesi Açmak İçin Gerekli Belgeler
• E-Ticarette Siber Güvenlik
• 2FA (İki Faktörlü Doğrulama) Nasıl Kullanılır?
• How to Get a Virtual POS?