From personnel files and customer addresses to CCTV and online orders, textile businesses process personal data.
Turkey’s Personal Data Protection Law No. 6698 (KVKK) concerns small workshops and online shops as well as large factories and technology companies. A small workforce does not by itself remove the duties imposed by the Law. Its scope includes automated processing and non-automated processing forming part of a data filing system, subject to statutory exceptions.
This five-part series examines textile businesses’ duties. The first article addresses key concepts, general principles and the data inventory that underpins compliance.
1. Personal data and key concepts
Personal data: Information concerning an identified or identifiable natural person: names, identity numbers, addresses, telephone numbers, email, photographs, CCTV images and bank details.
Controller: The natural or legal person determining the purposes and means of processing and responsible for establishing and managing the filing system. A textile company is generally the controller for its own personnel and customer processes; where the business is a legal entity, the company itself bears that role.
Processor: A person processing on a controller’s behalf and under its authorisation. Payroll providers, cloud suppliers and e-commerce infrastructure providers may act as processors. Accountants, couriers and SMS providers are not automatically processors merely because they receive data: their actual decision-making, legal duties and processing activities determine whether they are processors or independent controllers.
Data subject: The natural person whose data are processed, such as an employee, applicant, customer, visitor or supplier’s employee.
Special categories: Data about race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Processing requires the conditions in Article 6 and the adequate measures determined by the Board. The conditions were amended in 2024; outdated summaries must be checked.
Corporate information, such as a company’s name and corporate tax number, generally does not itself concern a natural person. Its representative’s name, signature and personal telephone number do. Data relating to workshop owners, supplier representatives and sole traders can therefore fall within the Law.
2. General principles
Article 4 applies throughout the processing lifecycle:
Lawfulness and fairness
Processing must comply with law and good faith.
Accuracy
Keep data accurate and, where necessary, up to date; correct inaccurate personnel and customer records.
Specified, explicit and legitimate purposes
Identify why data are needed and avoid incompatible uses.
Relevance, limitation and proportionality
Do not collect excessive data merely “in case it becomes useful”.
Limited retention
Retain data for the statutory period or as long as the processing purpose requires. When the processing conditions cease, erase, destroy or anonymise data under the applicable rules, subject to other lawful retention duties.
3. Mapping a textile business’s data
Identify what data exist, where they are held, why they are used, who receives them and the legal basis.
Employees and applicants: Personnel files, identification, bank accounts and IBANs, payroll, Social Security Institution notifications, pre-employment and periodic medical reports, attendance records, CCTV and CVs. Identifying fingerprints in an inventory does not make biometric attendance lawful; necessity, proportionality and Article 6 must be assessed separately.
Customers and buyers: Names, addresses, contact details, orders, payment information, wholesale buyer representatives and marketing permissions.
Suppliers and subcontractors: Owners’ and representatives’ identity and contact details, relevant social security and dispatch records, where their processing and disclosure have a lawful basis.
Visitors: Entrance records and CCTV at factories and shops. Collect only necessary information; copying identity documents should not become an unchecked default.
Why the inventory matters: It supports privacy notices, applicable VERBİS declarations and retention and disposal arrangements. It identifies the legal basis of each activity, external processors and international transfers. Formal inventory and policy duties must be assessed under the relevant regulations and exemptions.
4. Compliance roadmap
- Map processing: Record data categories, departments, purposes and recipients.
- Choose the correct legal basis: Assess each activity against Articles 5 or 6. Where another processing condition applies, do not use consent as a blanket substitute. Part two addresses the distinction.
- Provide information: Prepare business-specific notices for employees, applicants, customers and visitors; part three examines this duty.
- Assess VERBİS: Consider employee numbers, annual financial balance-sheet totals, the main activity and current Board exemptions. Exemption from registration does not generally exempt the controller from the other duties of the Law.
- Take security measures: Appropriate access controls, encryption, backups, physical security and confidentiality arrangements.
- Set retention and disposal rules: Determine periods and methods for each category and the applicable formal policy requirements.
- Review suppliers: Set data protection terms reflecting the actual controller–processor relationship, including payroll, accounting, cloud and logistics arrangements.
- Train staff and plan for breaches: Assign responsibilities and escalation steps before an incident; part five discusses breaches and transfers.
Compliance is an ongoing way of managing data. Documents should accurately describe what the business actually does.
Series: 1. Controllers and principles · 2. Processing conditions and consent · 3. Privacy notices and VERBİS · 4. Employee data · 5. Breaches, international transfers and sanctions. Further translated parts will be linked as they become available.
Official sources
Personal Data Protection Law · Authority: the controller · Special categories of data.
General information
This article concerns Turkish law and does not replace an assessment of a specific business. Turkish statutory texts govern. Reviewed on 30 October 2026.