Data Controller

What does a data controller decide?

The controller determines the purpose and means of processing personal data. In practice, the decision-making analysis looks at who decides what data is collected, how it is collected, why it is used, whose data is involved, whether it is shared, and how long it is retained.

Who is the controller in a company?

Under the KVKK Authority's Publication No. 106, the legal entity is the data controller when it meets the statutory definition. A department or employee does not have a separate legal personality and does not become a separate controller merely because they receive, record, or otherwise process personal data for the company. Each company in a corporate group may, however, be a separate controller because it has its own legal personality.

Core KVKK responsibilities

Once a business is identified as a data controller, its compliance programme should address the following obligations under Law No. 6698 and related KVKK rules:

• Informing: provide a privacy notice covering the controller's identity, processing purposes, transfers, collection method and legal basis, and data-subject rights.
• Security: take appropriate technical and organisational measures, conduct necessary audits, and manage processor security responsibilities.
• Data-subject requests: maintain a process to receive and respond to requests concerning access and other Article 11 rights.
• Incidents: assess unlawful access or disclosure and meet the applicable notification duties without delay.
• VERBIS: assess whether registration with the Data Controllers' Registry Information System is required; exemptions do not remove the other KVKK duties.

Examples from KVKK Publication No. 106

The label “processor” is not automatic just because a service provider works for a client. The decisive question is who determines the purposes and means of the relevant processing:

• Market research company: may be a joint controller where it decides which employees are surveyed, which data is collected, and how the survey is conducted.
• Payment service provider: may be a controller for customer payment data where it independently determines required data, processing purposes, terms, and legal responsibilities.
• Lawyer: may be a controller alongside the client where the lawyer determines how personal data received for legal advice is processed.
• Financial advisor: may be a controller for client account records when professional duties require independent decisions, such as reporting suspected fraud.
• Cloud storage provider: may be a processor where it only stores data under the public institution's instructions and does not use the data for its own purposes.

Practical implementation in Türkiye

A business should map its processing activities, identify the decision-maker for each activity, document the controller-processor relationship, review privacy notices and retention periods, and test its request, security and incident-response procedures. The role should be assessed by processing activity rather than by the service provider's job title or the existence of a generic contract.

Frequently asked questions

Can a data controller also be a data processor?

Yes. A cloud provider, accounting firm or other service provider can be a controller for its own personnel data and a processor for data handled only on a client's instructions.

Does signing a data processing agreement decide the role?

No. The actual decision-making power and legal obligations matter. A contract can allocate technical tasks, but it cannot change the statutory classification where the provider independently determines the purposes or means of processing.

Does VERBIS registration replace KVKK compliance?

No. Registration, where required, does not replace the controller's duties concerning lawful processing, informing, data security, data-subject requests, retention and incident management.

Primary source: This entry summarizes the Personal Data Protection Authority's Data Controller and Data Processor, KVKK Publication No. 106 (June 2025). It is a practical summary, not a substitute for the Turkish text of the legislation or advice on a specific processing activity.