# KVKK Compliance Assessment Record

## Organisation Details

| Field | Value |
|-------|-------|
| **Organisation Name** | [Legal entity name] |
| **Tax ID / MERSiS No.** | [Registration number] |
| **Registered Address** | [Address in Turkey / Representative address] |
| **Data Controller Representative** | [Name, if controller not established in Turkey] |
| **VERBIS Registration Number** | [Number / Exempt / Pending] |
| **Contact Person** | [Name, email, phone] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessor** | [Name, Title] |

## VERBIS Registration Status

| Requirement | Status | Notes |
|-------------|--------|-------|
| **50+ employees OR TRY 100M+ turnover** | [Yes / No] | [Details] |
| **Core activity is special category processing** | [Yes / No] | [Details] |
| **VERBIS registration required** | [Yes / No / Exempt] | [Exemption basis] |
| **Registration submitted** | [Yes / No / N/A] | [Date] |
| **Registration approved** | [Yes / No / Pending / N/A] | [Approval date] |

## Legal Basis Mapping

| Processing Activity | Data Categories | Data Subjects | Legal Basis (Art. 5/6) | Documented? |
|--------------------|-----------------|---------------|----------------------|-------------|
| [Activity 1] | [Categories] | [Subjects] | [Article reference] | [Yes / No] |
| [Activity 2] | [Categories] | [Subjects] | [Article reference] | [Yes / No] |

## Special Category Data Processing (Article 6)

| Category | Processed? | Legal Basis | Safeguards |
|----------|-----------|-------------|------------|
| Race or ethnic origin | [Yes / No] | [Explicit consent / Law] | [Description] |
| Political opinion | [Yes / No] | [Explicit consent / Law] | [Description] |
| Philosophical belief | [Yes / No] | [Explicit consent / Law] | [Description] |
| Religion, sect, other belief | [Yes / No] | [Explicit consent / Law] | [Description] |
| Appearance and dressing | [Yes / No] | [Explicit consent / Law] | [Description] |
| Association/union membership | [Yes / No] | [Explicit consent / Law] | [Description] |
| Health data | [Yes / No] | [Explicit consent / Authorised persons] | [Description] |
| Sexual life | [Yes / No] | [Explicit consent / Authorised persons] | [Description] |
| Criminal conviction data | [Yes / No] | [Explicit consent / Law] | [Description] |
| Biometric data | [Yes / No] | [Explicit consent / Law] | [Description] |
| Genetic data | [Yes / No] | [Explicit consent / Law] | [Description] |

## Data Subject Rights (Article 11) Implementation

| Right | Implemented? | Mechanism | Response Time |
|-------|-------------|-----------|---------------|
| Right to learn if data is processed | [Yes / No] | [Description] | [Days] |
| Right to request information | [Yes / No] | [Description] | [Days] |
| Right to learn purpose of processing | [Yes / No] | [Description] | [Days] |
| Right to know third-party recipients | [Yes / No] | [Description] | [Days] |
| Right to rectification | [Yes / No] | [Description] | [Days] |
| Right to erasure/destruction | [Yes / No] | [Description] | [Days] |
| Right to notification of rectification/erasure | [Yes / No] | [Description] | [Days] |
| Right to object to automated decisions | [Yes / No] | [Description] | [Days] |
| Right to claim compensation | [Yes / No] | [Description] | [Days] |

## Security Measures (Article 12)

### Technical Measures

| Measure | Implemented? | Evidence |
|---------|-------------|----------|
| Access control and authorisation | [Yes / No] | [Reference] |
| Encryption at rest | [Yes / No] | [Reference] |
| Encryption in transit | [Yes / No] | [Reference] |
| Logging and monitoring | [Yes / No] | [Reference] |
| Vulnerability management | [Yes / No] | [Reference] |
| Backup and recovery | [Yes / No] | [Reference] |

### Organisational Measures

| Measure | Implemented? | Evidence |
|---------|-------------|----------|
| Data protection policies | [Yes / No] | [Reference] |
| Staff training | [Yes / No] | [Last training date] |
| Confidentiality agreements | [Yes / No] | [Reference] |
| Incident response plan | [Yes / No] | [Last test date] |
| Security audit | [Yes / No] | [Last audit date] |

## Cross-Border Transfers (Article 9)

| Recipient | Country | Transfer Mechanism | Board Approval | Status |
|-----------|---------|-------------------|----------------|--------|
| [Recipient name] | [Country] | [SCC / BCR / Adequacy / Consent / Written undertaking] | [Required / Not required / Approved / Pending] | [Active / Suspended] |

## Breach Notification Readiness

| Element | Status | Notes |
|---------|--------|-------|
| Breach detection capability | [In place / Partial / Not in place] | [Details] |
| Board notification procedure | [Documented / Not documented] | [Details] |
| Data subject notification template | [Prepared / Not prepared] | [Details] |
| 72-hour notification capability | [Tested / Not tested] | [Last test date] |

## Remediation Plan

| Gap | Priority | Action Required | Owner | Target Date | Status |
|-----|----------|----------------|-------|-------------|--------|
| [Gap 1] | [Critical / High / Medium / Low] | [Action] | [Name] | [YYYY-MM-DD] | [Open / In progress / Closed] |

## Sign-Off

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Data Controller Representative | [Name] | __________ | [YYYY-MM-DD] |
| Assessor | [Name] | __________ | [YYYY-MM-DD] |

---

*This assessment is conducted under the Kisisel Verilerin Korunmasi Kanunu (KVKK), Law No. 6698, and reflects compliance status as of the assessment date.*