---
title: "How to Achieve KVKK Compliance for an E-Commerce Site? Disclosure Notice, Explicit Consent, Cookies, İYS and Rights Requests: A Practical Guide"
description: "How do you achieve KVKK compliance for an e-commerce site? Learn the steps of the disclosure notice, explicit consent, cookie management, İYS and rights requests in a practical guide."
url: https://www.faprika.com/en/blog/kvkk-compliance
language: en
site: Faprika
---

# How to Achieve KVKK Compliance for an E-Commerce Site? Disclosure Notice, Explicit Consent, Cookies, İYS and Rights Requests: A Practical Guide

> How do you achieve KVKK compliance for an e-commerce site? Learn the steps of the disclosure notice, explicit consent, cookie management, İYS and rights requests in a practical guide.

Anyone who opens an e-commerce site processes personal data every day, whether they realize it or not: the customer's name, address, phone, email, order history, payment information and the traces they leave on the site. As the business that collects, uses and stores this data, **KVKK compliance** (KVKK is the Turkish Personal Data Protection Law), that is, acting in line with the Personal Data Protection Law, is the responsibility not only of large companies but of every store that receives its first order.

This article is structured like a lesson. You will learn step by step what KVKK means for e-commerce, which data is processed on which legal basis, the elements a disclosure notice must contain, the difference between the disclosure notice, explicit consent and commercial message consent, cookie management, how to handle customer rights requests, data security and what to do in case of a breach. With the checking tool in the article, you can measure the current state of your site right away.

*Note: This article is for general information purposes and is not legal advice. The information is based on the Personal Data Protection Law No. 6698 and related regulations as known in October 2026; legislation and Board decisions may change. We recommend having your texts reviewed by a lawyer according to your business.*

Key Takeaway

“KVKK compliance is not about publishing a text; it is knowing which data you collect and why, telling the customer this clearly, and protecting the data. The texts are only the visible face of these three tasks.”

## What Is KVKK and What Does It Mean for an E-Commerce Business?

KVKK is Law No. 6698, which protects the fundamental rights and freedoms of individuals in the processing of personal data and sets out the obligations of those who process data. An e-commerce business is considered a "data controller" because it determines for what purpose and with what means customers' data is processed.

Personal data is any information relating to an identified or identifiable natural person: name, surname, address, phone, email, order history, IP address and behavioral data collected through cookies are the main examples. Information about corporate customers (legal entities) is outside the scope; however, personal information about a company's representative is within scope.

| Concept | Meaning | Its equivalent in e-commerce |
| --- | --- | --- |
| Personal data | Any information that identifies a person or makes them identifiable | Name, address, phone, email, order history, IP address |
| Data subject | The natural person whose data is processed | Customer, member, visitor, newsletter subscriber |
| Data controller | The party that determines the purpose and means of processing the data | The store owner (you) |
| Data processor | The party that processes data on behalf of the data controller | Infrastructure, shipping, payment and email service providers |
| Explicit consent | Consent that relates to a specific matter, is based on information, and is given freely | Consent to use for marketing purposes |

Okumanızı öneririz

E-Ticaret

Hukuku Hakkında Merak Edilenler

## Where and on What Basis Is Personal Data Processed in E-Commerce?

A different piece of data is collected at every step of the customer journey, and each piece rests on a different legal basis or consent. You can process the data needed to deliver an order without explicit consent; using the same data for marketing, however, requires a separate consent.

*Görsel: Personal data journey in e-commerce: data collected and legal bases for processing at the membership, order, payment, shipping, marketing and support steps (Every step of the customer journey involves different data and a different legal basis.)*

| Step | Data collected | General basis |
| --- | --- | --- |
| Membership | Name, email, phone, password | Conclusion and performance of the contract; privacy notice |
| Order and delivery | Delivery and billing address, product information | Performance of the contract; legal obligation (invoicing) |
| Payment | Payment information (via virtual POS or payment provider) | Performance of the contract; card data is not stored with you |
| Shipping | Recipient name, address, phone | Performance of the contract; transfer to the data processor |
| Marketing | Email, phone, interests | Explicit consent and commercial message consent |
| Cookies and analytics | Behavioral data, IP address | Consent and privacy notice, except for essential cookies |
| Support | Correspondence, order notes | Performance of the contract; legitimate interest |

The table is a general framework; each business should map out its own data flow and determine the legal basis according to the process. This work is the first step of KVKK (Turkish Personal Data Protection Law) compliance: the data inventory.

## How to Build a Data Inventory

A data inventory is a table showing which personal data is collected where, why it is collected, where it is stored, who it is shared with and how long it is kept. The privacy notice, retention period and security decisions are all based on this table; a business without an inventory cannot know what to disclose.

1. **List the points where data is collected:** Registration form, order form, contact form, newsletter, live support, cookies, marketplace orders, orders taken by phone.
2. **Write down which data is collected at each point:** Such as name, phone, address, email, IP.
3. **Define the purpose:** Order delivery, invoicing, customer service, marketing, analytics.
4. **Write down who it is shared with:** Shipping, payment provider, accounting, email service, advertising and analytics tools.
5. **Define where and for how long it is stored:** In which system, for how long, and when it will be deleted.
6. **Add security measures:** Access authorization, encryption, backups.

Tip

Don't Collect Unnecessary Data

One of the core principles of KVKK is that data be processed in a manner limited to its purpose and proportionate. Remove any information you will not use (such as date of birth or ID number) from the form. Data you never collect is data you never have to protect, never risk breaching and never have to respond about.

## What Is a Privacy Notice and What Should It Contain?

A privacy notice is the text through which the data controller informs the data subject when collecting personal data; under Article 10 of the Law, it is mandatory at the time of collection. The text is informative in nature; it is not a consent text.

*Görsel: The 5 elements of the disclosure notice: identity of the data controller, purpose of processing, recipients and purpose of transfer, collection method and legal basis, rights of the data subject (The five elements a privacy notice must contain.)*

1. **Identity of the data controller:** Your company name, address and contact details.
2. **Purpose of processing:** The purposes for which data will be processed (such as order delivery, invoicing, customer service, marketing).
3. **Transfers:** To whom (such as shipping, payment provider, accounting) and for what purpose the data may be transferred.
4. **Collection method and legal basis:** How the data is collected (web form, cookie, phone) and on which legal basis.
5. **Rights of the data subject:** The rights under Article 11 of the Law and how to exercise them.

The privacy notice must be written in clear and understandable language, be accessible when data is collected, and be visible or reachable via a link at every data collection point (registration form, order page, contact form). Preparing separate short texts for each process instead of one long text for all of them makes it more readable.

We recommend reading

What Is Privacy? (Glossary)

## Are the Privacy Notice, Explicit Consent and Commercial Message Consent the Same Thing?

No. A privacy notice is informational and requires no consent; explicit consent is an approval given for a specific data processing activity, based on information and freely; commercial message consent is the separate permission obtained to send campaign messages to a consumer. The three must be managed in separate texts, with separate boxes and for separate purposes.

*Görsel: The difference between the disclosure notice, the explicit consent text and commercial message consent: purpose, whether consent is needed, and an e-commerce example (The three texts cannot be used in place of one another.)*

|  | Privacy notice | Explicit consent | Commercial message consent |
| --- | --- | --- | --- |
| Purpose | Informing the person | Obtaining permission for a specific processing activity | Obtaining permission to send campaign messages |
| Is consent required? | No; providing it is enough | Yes; separately and of free will | Yes; separate for each message channel |
| Can it be a condition of the order? | Yes, but it is not a mandatory consent | No; it cannot be made a precondition of the service | No |
| Example | "We process your data for order delivery…" | "I consent to the processing of my data for campaign profiling" | "I want to receive campaign SMS and emails" |
| Can the box be pre-ticked? | No box needed | No | No |

The most common mistake is a single box saying "I have read the privacy notice, I accept, and I want to receive campaign messages." This both mixes two different purposes and makes marketing permission a condition of the service.

Okumanızı öneririz

İleti Yönetim Sistemi (İYS) Hakkında Bilmeniz Gereken Her Şey

## What Should Be Done About Cookies?

Cookies are small files stored in a visitor's browser, and if they process personal data they are subject to the information obligation. Cookies essential for the site to work can be used without permission; analytics, advertising and marketing cookies require informing the visitor and, in most cases, obtaining explicit consent.

- **Classify your cookies:** Separate essential, preference, analytics and marketing cookies.
- **Show a notice to visitors entering the site:** Provide a cookie notice explaining the types and purposes of cookies.
- **Make refusing easy too:** Refusing, or managing preferences, should be as easy as accepting.
- **Don't run tracking codes before consent:** Analytics and advertising codes should load after the visitor gives consent.
- **Record preferences:** Log the visitor's choice and the time; you can prove it when needed.
- **Publish your cookie policy:** Have a page explaining which cookies are used, why, and how to turn them off.

Okumanızı öneririz

Çerezler

E-Ticaret

Sitenizin Sağlığı İçin İyi mi Kötü mü?

## What Legal Pages Must an E-Commerce Site Have?

An e-commerce site must have at least the following legal pages and texts: a privacy notice, a privacy policy, a cookie policy, membership or terms of use, a distance sales contract with preliminary information, return and withdrawal terms, payment and delivery terms, and contact information. All of them should be easy to reach from the footer.

| Page | What is it for? | Where is it shown? |
| --- | --- | --- |
| Privacy notice | Information about data collection | At every data collection point and in the footer |
| Privacy policy | How data is protected and used | Footer, membership and payment pages |
| Cookie policy | Types of cookies and how to manage them | Footer and cookie notice |
| Membership / terms of use | Rules for using the site | Registration form and footer |
| Distance sales contract and preliminary information | Terms of the sale and the right of withdrawal | At the payment step, with a checkbox |
| Return and withdrawal terms | Rules for returns, cancellations and exchanges | Footer and product pages |
| Payment and delivery terms | Delivery time, shipping and payment methods | Footer and payment step |

We recommend reading

What Is a Distance Sales Contract?

## How Are Customer Rights Requests Handled?

Under Article 11 of the Law, customers have rights such as finding out whether their data is being processed, requesting information, and requesting correction and deletion; the data controller must respond to a request within 30 days at the latest. Where and how requests are to be submitted must be stated in the privacy notice, and the process must be defined in advance.

*Görsel: Rights request process: receiving the request, identity verification, evaluation, responding within 30 days at the latest and keeping records (The five steps of a customer rights request and the 30-day deadline.)*

1. **Receive and log the request:** Define the request channel (email or form) and give every request a record number.
2. **Verify identity:** Verify the applicant's identity by reasonable means so that data is not given to someone else.
3. **Evaluate the request:** Check which data is held in which systems; do not delete data subject to a legal retention obligation (such as invoices).
4. **Respond within 30 days at the latest:** Notify the applicant in writing of the acceptance or the reasons for rejection.
5. **Keep the record:** Keep the request and the response as proof.

## How Do You Protect Personal Data?

The data controller is obliged to take the necessary technical and administrative measures to prevent personal data from being processed unlawfully, accessed unlawfully or lost. These measures do not require large investments; most rest on a basic routine.

- **Use a secure connection:** Make sure all pages are served over SSL (https).
- **Restrict access:** Only the necessary employees should enter the admin panel, with their own accounts and a strong password; use two-step verification.
- **Don't store card information:** Payment information should be left to the payment system and not kept in order records.
- **Take regular backups:** Store the backups securely too; prevent unauthorized access.
- **Inform your employees:** Everyone who handles data should know the confidentiality and sharing rules.
- **Sign contracts with service providers:** Contracts with companies that process data (infrastructure, shipping, email) should include confidentiality and security terms.
- **Delete when necessary:** Once the purpose ends and the retention period expires, delete the data or anonymize it.

Okumanızı öneririz

E-Ticaret

Sitesi Güvenlik Sistemleri

## What Changes If Services Abroad Are Used?

The servers of analytics, advertising, email or cloud services are often located abroad; in this case visitor and customer data is transferred abroad, and additional conditions apply to the transfer. These conditions and the permitted routes are regulated in legislation and may change over time.

- **List the services you use:** Which tool sends which data to servers in which country?
- **State it in the privacy notice:** Write that data may be transferred abroad, and the purpose.
- **Ask the provider:** Find out in writing the server location and data protection terms from your service provider.
- **Check the current rule:** Since transfer procedures can change, confirm the current route with your legal counsel.

## What Should Be Done in Case of a Data Breach?

If personal data is seized by unauthorized persons, the data controller must notify the data subjects concerned and the Personal Data Protection Board as soon as possible; according to the Board's decision, notification to the Board must be made within 72 hours of learning of the breach. This is why a response plan must be ready before a breach occurs.

- **Stop and contain:** Close the vulnerability, cut off the affected access, change passwords.
- **Determine the scope:** Keep a record of which data, how many people it concerns and when it occurred.
- **Notify:** Notify the Board and the affected people on time.
- **Fix the cause and document it:** Take measures to prevent recurrence and record the incident.

The form and details of notification are set by Board decisions and may change; check the current procedure from the Authority's publications and your legal counsel. The obligation of data controllers to register in the registry (VERBİS) also varies according to criteria; learn the current rules for your own situation.

## E-Commerce KVKK Compliance Checker

The tool below measures your site's basic readiness for KVKK with twelve items. Tick the items that are ready; the tool shows the percentage you have completed and your priority gaps. The tool is a general preliminary assessment and is not a substitute for legal advice.

KVKK readiness checker

Privacy notice is published on the site and at data collection points

Privacy policy is published

There is a cookie notice and cookie policy

Analytics and advertising codes run after consent is given

Explicit consent boxes are separate and not pre-ticked

Commercial message consent is obtained separately and managed with İYS

Distance sales contract and preliminary information are at the payment step

Return and withdrawal terms are published

A channel and a 30-day process are defined for rights requests

A data inventory has been prepared

SSL, access authorizations and a backup routine are in place

A data breach response plan is ready

Completed**0 / 12**

Rate**0%**

Status**Getting started**

Tick the items that are ready; priority gaps are listed here.

## 8 Common Mistakes in KVKK Compliance in E-Commerce

1. **Copying another site's text:** The data flow, the companies data is transferred to and the purposes won't match yours.
2. **Combining the privacy notice and explicit consent in one box:** Two separate purposes get mixed up and the consent may be deemed invalid.
3. **Making marketing permission a condition of the order:** Explicit consent must be given freely.
4. **Presenting pre-ticked boxes:** A pre-ticked box does not count as free consent.
5. **Running tracking codes before consent:** Showing a cookie notice is pointless if it does not stop the codes.
6. **Collecting unnecessary data:** Every field you don't use is an extra burden to protect and respond about.
7. **Not defining the rights request process:** The 30-day deadline is missed and complaints arise.
8. **Not updating the texts:** When you add a new tool or service, the privacy notice must be updated too.

## E-Commerce KVKK Compliance Checklist

Check the following items before launching the site and at regular intervals.

- Is your data inventory up to date: which data, where, why, for how long?
- Is the privacy notice visible, or reachable via a link, at every data collection point?
- Does the privacy notice contain the five elements listed in the Law?
- Are explicit consent, commercial message consent and the privacy notice presented separately and without mixing?
- Are the consent boxes unticked and not a precondition of the service?
- Does the cookie notice work, is refusing easy, and are tracking codes stopped before consent?
- Are commercial messages sent only to approved recipients, and is İYS (Turkey's commercial message consent registry) registration managed?
- Are the privacy, cookie, return, distance sales and delivery texts in the footer?
- Is there a defined channel for rights requests and a 30-day response process?
- Is your site served over SSL, and is access to the admin panel restricted and protected with two-step verification?
- Is there a contract with service providers that includes privacy and security terms?
- Is a data breach response plan ready, and are the responsible people identified?

## Legal Texts, Cookie and Consent Management with Faprika

Preparing the texts and managing consents is the most tiring part of putting KVKK (Turkish Personal Data Protection Law) compliance into practice. Faprika offers the following for this stage (you can see which feature starts in which plan on the [e-commerce plans](https://www.faprika.com/en/pricing) page):

- **Ready-made contract and text samples:** Sample texts for privacy and security, membership, payment and delivery, warranty and return terms, and the distance sales contract are available on the training pages: [Privacy and Security](https://www.faprika.com/en/tutorials/privacy-security-agreement-template), [Membership](https://www.faprika.com/en/tutorials/membership-agreement-template), [Payment and Delivery](https://www.faprika.com/en/tutorials/payment-delivery-agreement-template), [Warranty and Return Terms](https://www.faprika.com/en/tutorials/warranty-return-terms-template) and [Distance Sales Contract](https://www.faprika.com/en/tutorials/distance-sales-contract-template). The samples are starter templates; adapt them to your business and have your lawyer review them.
- **Cookie management module:** Collects, stores and logs visitors' cookie preferences; details are on the [Cookie Management](https://www.faprika.com/en/cookie-management) page. Varies by plan.
- **Message management and İYS integration:** The [Message Management System](https://www.faprika.com/en/message-management-system) solution is available for İYS-compliant management of commercial message consents.
- **SSL security certificate, backup and maintenance:** Included in all plans.
- **Message templates:** Templates for order and notification emails are edited from the panel.

## Frequently Asked Questions

**Is KVKK mandatory for e-commerce sites?**

Yes. Every e-commerce business that processes customers' personal data such as name, address, phone and email is a data controller, regardless of its size, and is subject to the Law's obligations, especially the disclosure and data security obligations.

**What is a disclosure notice and what should it include?**

The disclosure notice is the text with which you inform the data subject when collecting data. It must include the identity of the data controller, the purpose of processing, to whom and for what purpose the data may be transferred, the collection method and legal basis, and the rights of the data subject. It is an information text, not a consent text.

**Are the disclosure notice and explicit consent the same thing?**

No. The disclosure notice is information and does not require consent. Explicit consent, on the other hand, is a separate approval given for a specific processing activity, based on information and with free will. The two should not be combined in the same box, and marketing permission should not be made a precondition of the service.

**Is a cookie notice mandatory?**

If your site uses analytics, advertising or marketing cookies beyond the necessary ones, you must inform the visitor and in most cases obtain explicit consent. Tracking codes should not run before consent is given, and rejecting should be as easy as accepting.

**What should be done if a customer asks for their data to be deleted?**

The request is received, identity is verified and the request is answered within 30 days at the latest. Data subject to a legal retention obligation (for example invoice records) is not deleted; the reason is communicated to the applicant, and other data is deleted or anonymized.

**What should be done in case of a data breach?**

Close the vulnerability and determine the scope, then notify the affected individuals and the Personal Data Protection Board as soon as possible; according to the Board decision, notification to the Board must be made within 72 hours of becoming aware of the breach. Remove the cause and record the incident.

Legal Texts, Cookies and Consents in One Place

Contract samples, cookie management, İYS-compliant consent management and SSL come ready in the infrastructure. Plan your store's legal and technical setup together with Faprika experts.

Request a Demo

### You May Also Like

- [**E-Ticaret Sitesi Açmak İçin Gerekli Belgeler**](https://www.faprika.com/blog/e-ticaret-sitesi-acmak-icin-gerekli-belgeler)
- [**E-Ticarette Siber Güvenlik**](https://www.faprika.com/blog/e-ticarette-siber-guvenlik)
- [**2FA (İki Faktörlü Doğrulama) Nasıl Kullanılır?**](https://www.faprika.com/blog/2fa-iki-faktorlu-dogrulama-nasil-kullanilir)
- [**How to Get a Virtual POS?**](https://www.faprika.com/en/blog/how-to-get-virtual-pos)