Almost every website that uses a contact form, a newsletter sign-up or an analytics tool processes personal data. In the EU, the General Data Protection Regulation (GDPR) requires you to tell visitors clearly why their data is processed and on what legal basis, and to protect that data properly; Turkey's data protection law, KVKK (Law No. 6698), follows the same principles. This guide summarises the technical and design points to watch on the website side. It is not a substitute for legal advice.
Which texts do you need?
- Privacy notice: explains which data is processed, for what purposes and on what legal basis, who it may be shared with and what rights people have. It must be accessible from every point where data is collected.
- Consent texts: only needed for processing based on consent; consent must be specific, freely given and kept separate from the privacy notice.
- Cookie policy: explains the types of cookies used on the site, their purposes and how long they are stored.
- Privacy policy: summarises the site's overall approach to data processing and its security measures.
How should cookie consent work?
Under EU rules (and, in Germany, § 25 TDDDG), cookies that are not strictly necessary may only be set once the user has given consent. Turkey's data protection authority has published guidance with the same approach. In technical terms, this means:
- Analytics and marketing cookies must not load until the user has consented.
- The consent banner must offer a 'Reject' option that is as visible as 'Accept'.
- Pre-ticked boxes must not be used.
- Users must be able to change their choice easily later; a 'Cookie settings' link in the footer is a common solution.
- Google Analytics, advertising pixels and social media plug-ins must be set up to work with consent management (for example via Google Consent Mode).
What to watch out for in forms
- Only ask for the data you genuinely need (data minimisation).
- Place a clear link to the privacy notice next to the form.
- If you want to send marketing emails, obtain separate, optional consent for this; email marketing is also governed by its own rules.
- Transmit form data over an encrypted connection (HTTPS) and protect it against unauthorised access.
- Define how long data will be kept, and delete or anonymise records once that period has passed.
Health data and other special categories
Information about health, biometrics, religion or trade union membership belongs to special categories of personal data and is subject to stricter rules. If clinics, insurers and similar organisations need to collect such data through website forms, additional technical measures such as access rights, encryption and logging must be planned.
Services located abroad
If hosting, email, analytics or AI services run through providers based in other countries, personal data may be transferred abroad. Under GDPR, transfers outside the European Economic Area require an appropriate safeguard, and Turkey revised its own rules on cross-border transfers in 2024. The soundest approach is to build an inventory of which providers you use for what, and to determine the legal basis for each transfer together with your legal adviser.
Technical security measures
- HTTPS and current security headers across the whole site
- Role-based access and strong authentication for the admin panel
- Logging of access to forms and databases
- Regular, encrypted backups whose restoration has been tested
- Removal of unused plug-ins and accounts
Conclusion
Privacy compliance isn't achieved by adding a single text; every point of data collection, every cookie and the technical infrastructure have to be considered together. In our projects we plan where the privacy texts appear, how cookie consent is managed and which technical safeguards are needed from the start — and we recommend that the texts themselves are reviewed with your lawyer.
