Analyses based on sales, loyalty card or e-commerce data help companies get to know their customers better. But much of this data is personal data and falls under Law No. 6698 on the Protection of Personal Data (KVKK), Türkiye’s data protection law. The “Commonly Believed Misconceptions” guide published by the Personal Data Protection Authority in March 2025 addresses common mistakes in this area. The principles below summarise how the general principles in the guide apply to analytics projects.
1. Start by identifying the legal basis
Not every data processing activity requires explicit consent. First, determine which of the processing conditions in Articles 5 and 6 of the Law applies. If another condition applies, asking for explicit consent for the same activity is not recommended, as it may mislead the individual.
2. If explicit consent is required, make it purpose-specific
Explicit consent must relate to a specific subject, be based on information and be given freely. General statements such as “my data may be processed for any purpose” are not considered valid. If consent is relied on for analytics, it must clearly cover that purpose.
3. Don’t skip the obligation to inform
The obligation to inform is separate from consent. Even if processing is not based on consent, individuals must be told which of their data is processed and for what purpose. If consent is to be obtained, informing and consent should be handled as separate steps.
4. Work with anonymous data where possible
Data that has been truly anonymised, meaning it can no longer be linked back to an individual, is no longer considered personal data. Most analytical questions, such as sales trends by store or product, do not need fields that identify individuals. However, simply deleting names is not always enough; a combination of other fields can make a person identifiable again.
5. Using a service provider does not transfer responsibility
Outsourcing analytics work to an external firm or a cloud service does not remove the data controller’s obligations. Data security obligations must be clearly set out in contracts, and if there is an ongoing transfer of data abroad, this must be assessed separately.
6. Retention periods and breach notification
Data should be kept only as long as necessary for the purpose; once the processing conditions no longer apply, it should be deleted, destroyed or anonymised. When a data breach is detected, the Authority must be notified without delay and within 72 hours at the latest.
Conclusion
KVKK compliance is not an obstacle to data analytics; it is part of a well-designed data infrastructure. Separating personal data from analytical data when building the data model, restricting access and working with anonymous data wherever possible make both compliance and security easier. This article is for general information only and does not constitute legal advice. We recommend consulting a legal adviser about your own situation.