KVKK Data Management Plan — Compliance Scaffolding for Turkish Research Data

Generates a KVKK (Kişisel Verilerin Korunması Kanunu — Turkey's Personal Data Protection Law, No. 6698) data management plan for empirical research, and audits EU/GDPR DMP boilerplate for the points where Turkish law diverges. KVKK applies to essentially all Turkish empirical research that touches personal data, yet it is not GDPR: the lawful-basis menu is narrower, the research exemption works differently, and registration (VERBIS) and cross-border rules are Turkey-specific. This skill encodes those divergences so a researcher does not silently reuse an EU plan that is non-compliant in Türkiye.

All article references trace to the primary text of Law 6698 (mevzuat.gov.tr) and the official KVKK English translation; the substantive divergences are tabulated in references/kvkk_vs_gdpr.md. Anonymization techniques and the re-identification trap are in references/anonymization_methods.md. Article-level detail with the exact exemption wording is in references/kvkk_articles.md.

When to Use This Skill

Use this skill when the request is about Turkish data-protection compliance for research data — producing or fixing a data management plan under KVKK, deciding whether a dataset can ride the anonymization exemption, choosing a lawful basis (açık rıza — explicit consent — vs. an Art. 5/6 alternative), planning retention and deletion at purpose-end, checking whether VERBIS registration is required, or assessing a cloud/overseas transfer under Art. 9.

Typical triggers:

• "KVKK uyumlu veri yönetim planı hazırla" (prepare a KVKK-compliant DMP)
• "Anonymize this research dataset so it falls under the KVKK research exemption"
• "VERBIS kaydı gerekli mi?" (is VERBIS registration required?)
• "I have an EU Horizon DMP — make it KVKK-compliant for my Türkiye site"
• "Can I store this survey data on a US cloud under KVKK?"
• "We collect health/biometric data — what does Art. 6 require?"

Does NOT Trigger

Route adjacent requests to the correct sibling skill instead of forcing this one:

If a workflow needs both a funder VYP (Aperta) and a KVKK DMP (here), produce the KVKK plan first and hand its lawful-basis / anonymization decision to alterlab-aperta to populate the open-science Principle-6 justification.

The Six Decisions a KVKK DMP Must Resolve

A compliant plan answers these in order. Each maps to a specific article of Law 6698 (full wording in references/kvkk_articles.md).

1. Lawful basis (Art. 5 / Art. 6). The default is açık rıza (explicit

consent). Unlike GDPR Art. 6, KVKK Art. 5 has no standalone "scientific research" lawful basis — if consent is not used, the processing must fit one of the enumerated Art. 5(2) alternatives (e.g. legal obligation, a contract, data made public by the subject, legitimate interest). Special-category data (sağlık/health, genetic, biometric, religious belief, etc.) falls under Art. 6, where processing is prohibited except in enumerated cases and the Board can mandate adequate measures (yeterli önlemler).

1. Anonymization exemption (Art. 28(1)(b)) — the primary compliance lever.

Personal data that are anonymized for research, planning and statistics fall outside the scope of the Law under Art. 28(1)(b). Art. 28(1)(c) similarly exempts processing for scientific/artistic/literary purposes within limits. This is the single most powerful move in a research DMP: a genuinely anonymized dataset escapes consent, VERBIS, and transfer constraints. Caveat: data that remain re-identifiable are not anonymized and do not qualify — see references/anonymization_methods.md. Pseudonymized data are still personal data.

1. Retention & destruction at purpose-end (Art. 7). When the reasons for

processing no longer exist, data must be erased, destroyed, or anonymized (silme / yok etme / anonim hale getirme) ex officio or on the data subject's request, per the KVKK By-Law on Erasure, Destruction or Anonymization. The DMP states a retention period and the destruction method for each data category.

1. Data-subject rights & the response window (Art. 13). A controller must

answer a data-subject application within thirty days (otuz gün) at the latest. The DMP names the contact point and the procedure.

1. **Cross-border transfer (Art. 9, as amended by Law 7499 — published in the

Official Gazette 12 Mar 2024, RG No. 32487; KVKK provisions effective 1 Jun 2024). Overseas/cloud storage needs either an adequacy decision** by the Board or one of the enumerated safeguards (standard contracts, binding corporate rules, written undertakings, etc.). The Law 7499 amendment restructured Art. 9 around adequacy decisions and standard contracts — do not reuse pre-2024 "explicit consent for every transfer" boilerplate. Flag any non-Türkiye cloud.

1. VERBIS registration (Art. 16). Controllers must register with the **Veri

Sorumluları Sicili (VERBIS — Data Controllers' Registry) before** processing, though the Board exempts categories by objective criteria. The DMP records VERBIS status (registered / exempt-by-criterion / pending) with the reason.

A worked walkthrough of all six on a sample survey + health-data project is in references/dmp_walkthrough.md.

How to Produce the Plan

1. Classify the data. For each data category, decide: personal vs.

special-category (Art. 6), and identifiable vs. (intended-)anonymized.

1. Pick the lever. If the research questions can be answered on anonymized

data, plan for Art. 28(1)(b) anonymization at the earliest point and document the technique and the re-identification-risk assessment. Otherwise select an Art. 5/6 lawful basis (default açık rıza) and justify it.

1. Fill the six decisions above into the DMP sections.
2. Run the scaffold (optional, deterministic) to emit a structured TR+EN DMP

skeleton you then complete and review:

   uv run python skills/turkish-academia/alterlab-kvkk-dmp/scripts/kvkk_dmp_scaffold.py \
       --title "Project title" \
       --basis explicit-consent \
       --special-category health \
       --retention "5 years post-publication" \
       --cross-border none \
       --verbis registered \
       --lang both \
       --out kvkk_dmp.md

The scaffold writes only a template grounded in the encoded article map; it makes no legal determination and reaches no network. Run --help for all flags, or --self-check to validate the article encoding.

1. Audit reused EU/GDPR boilerplate against references/kvkk_vs_gdpr.md and

rewrite each divergent clause (no research basis; anonymization exemption; VERBIS; 2024 transfer rules).

Hard Rules (do not violate)

• Never claim a dataset is anonymized if it is re-identifiable. Re-identifiable

"anonymized" data does not qualify for the Art. 28 exemption and remains fully in scope. Pseudonymization is not anonymization.

• Do not invent an Art. 5 "research" basis. KVKK has none; use consent or a

real enumerated alternative, or anonymize.

• Cite base figures and mechanisms, not stale amounts. KVKK Art. 18

administrative fines are revalued every January under the Tax Procedure Law (Vergi Usul Kanunu) revaluation rate — cite the mechanism and direct the user to verify the current-year figure; do not hard-code a TRY amount.

• Verify against the current law before relying on an output. Flag the Law

7499 amendments (Art. 6, 9, 18) — adopted 2 Mar 2024, published in the Official Gazette 12 Mar 2024 (RG No. 32487), KVKK provisions effective 1 Jun 2024 — as the most recent substantive change.

• This skill produces compliance scaffolding, not legal advice; recommend a

Veri Sorumlusu / KVKK officer (or counsel) sign-off for high-risk processing.

References

• references/kvkk_articles.md — article-by-article map (Art. 5, 6, 7, 9, 13, 16,

28) with the exact exemption wording, sourced to Law 6698.

• references/kvkk_vs_gdpr.md — KVKK↔GDPR crosswalk: the four divergences that

break EU DMP boilerplate (no research basis, anonymization exemption, VERBIS, 2024 transfer reform).

• references/anonymization_methods.md — masking, aggregation, generalization

(k-anonymity-style), and the re-identification trap that voids Art. 28.

• references/dmp_walkthrough.md — the six decisions worked end-to-end on a

sample survey + health-data study, with a fill-in DMP outline.

Primary sources

• Law 6698 (KVKK) full text — https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf
• KVKK official English translation — https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law
• By-Law on Erasure, Destruction or Anonymization of Personal Data — https://www.kvkk.gov.tr/Icerik/6636/By-Law-on-Erasure-Destruction-or-Anonymization-of-Personal-Data
• VERBIS (Data Controllers' Registry) — https://www.kvkk.gov.tr/Icerik/2043/
• Law 7499 — amendments to Art. 6, 9, 18 (adopted 2 Mar 2024; published in the Official Gazette 12 Mar 2024, RG No. 32487 — https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm; KVKK provisions effective 1 Jun 2024)

Part of the AlterLab Academic Skills suite.