A customer, a former employee or a job candidate writes to your company asking what data you hold about them. The application lands in an email inbox, reaches the switchboard in a courier envelope, or ends up at the call center. A few weeks later, someone phones to explain the situation orally, and the matter is treated as closed.
The Kişisel Verileri Koruma Kurumu (KVKK, Türkiye's Personal Data Protection Authority) drew attention to exactly this practice in a public announcement published on October 1, 2026. In this article, we summarize the announcement and the provisions of Law No. 6698 (Türkiye's Personal Data Protection Law, "the Law") and the Communiqué on the Procedures and Principles of Applications to the Data Controller ("the Communiqué") on which it relies, in the wording of their sources, and then look at how answering applications can be turned into a traceable, partly automated workflow. The article reports what the sources say; it is not a substitute for legal advice.
What does the announcement say?
The Authority states that, in its reviews of complaints, it has seen some data controllers answer data subjects' applications only by phone, in-person briefings or similar oral methods. According to the announcement, during the application process it is possible to speak with the data subject by phone or in person to request additional information or documents, clarify the application or explain the process. This oral communication, however, is not accepted as the reply the legislation requires.
The announcement also explains why a written or electronic reply matters: it makes clear, auditable and provable whether the request was accepted, the reasons for any rejection, the actions taken under the application and the date on which the reply was notified. The Authority considers this important both for the data subject's ability to exercise their rights and for documenting the application in complaint proceedings and any judicial proceedings that may follow.
The announcement closes by grouping its expectations of data controllers under four headings: conclude applications according to the procedure in the Law and the Communiqué; notify the final reply in writing or electronically; bear in mind that oral methods do not count as a reply; and state clearly the extent to which requests have been met, giving understandable reasons for any that are rejected.
Time limits and conditions in the Law and the Communiqué
The announcement does not introduce a new rule; it draws attention to existing provisions. These provisions are as follows:
Rights (Law Art. 11). Article 11 of Law No. 6698 lists the rights that everyone has by applying to the data controller, such as the right to learn whether their personal data is being processed; to ask about the purpose of processing; to know the third parties to whom data has been transferred; to request correction of incomplete or inaccurate data and, where the conditions are met, its deletion; to object to an adverse result of analysis carried out exclusively by automated systems; and to request compensation for damage.
Time limit and reply (Law Art. 13). Under the Law, data subjects submit requests in writing or by other methods to be determined by the Personal Data Protection Board (Kurul, "the Board"). The data controller concludes requests, depending on their nature, "as soon as possible and within thirty days at the latest". It either accepts the request or rejects it with reasons, and notifies its reply in writing or electronically.
Application channels and date (Communiqué Art. 5). The Communiqué on the Procedures and Principles of Applications to the Data Controller lists the ways an application can be submitted: in writing, or by registered electronic mail (KEP), secure electronic signature, mobile signature, an email address registered in the data controller's system, or software or an app developed for submitting applications. An application must contain the name and surname (and signature, if in writing), the ID number (for foreign nationals, nationality and passport number), an address for service of notices, an email address, telephone and fax number for notification where available, and the subject of the request. Under the Communiqué, the application date is the date the document is served on the data controller or its representative for written applications, and the date the application reaches the data controller for other methods.
Content of the reply (Communiqué Art. 6). The Communiqué states that data controllers must take the administrative and technical measures needed to conclude applications effectively, lawfully and in good faith. The reply letter must include, as mandatory elements, the details of the data controller or its representative, the applicant's identity and contact details, the subject of the request and the data controller's explanations regarding the application. If the request is accepted, it is fulfilled as soon as possible and the data subject is informed.
Next step (Law Art. 14). If the application is rejected, the reply is found insufficient or no reply is given in time, the data subject can lodge a complaint with the Board within thirty days of learning of the reply and, in any case, within sixty days of the application date. Under the Law, a complaint cannot be filed before the application route has been exhausted. The application stage therefore becomes the first record examined in any review.
Why a process, and why automation?
In a mid-sized or large company, applications do not come through a single door. Corporate email, a KEP address, branch or head-office paperwork, a web form and customer service can all be entry points at once. The auditability and provability the announcement stresses require these scattered entry points to be consolidated into a single record, with a dated trail of every step.
This work is repetitive, rule-based and deadline-driven, which makes it a good candidate for process automation. Automation is not meant to make decisions; its purpose is to protect the application from being lost, the deadline from being missed and the reply from going out with a mandatory element missing. The decision to accept or reject, and its reasons, remain with authorized people.
A general workflow: six steps
The framework below is a general workflow derived from the conditions in the sources. It is not tied to any particular product, and each organization needs to adapt it to its own structure.
- One record. Applications arriving through all channels become a single application record. Each record carries a unique number, the channel of entry and the application date as defined in the Communiqué. Physical documents are scanned and linked to the same record.
- Mandatory fields and identity check. When the record is opened, a check is made on whether the mandatory details listed in the Communiqué are present. The organization's chosen method is used to confirm that the applicant really is the data subject; if missing information is requested, that request and its date are entered in the record. According to the announcement, such requests for additional information can also be made by phone, but a note of the conversation should be added to the record.
- Deadline tracking. The record carries a due date based on the thirty-day upper limit from the application date. Interim alerts (for example, at the halfway point and in the final week) go to the responsible person and their manager. The Law's phrase "as soon as possible" makes it sensible to set a target period that does not wait for the last day.
- Data collection and reply template. Depending on the type of request (information, correction, deletion, objection), information is requested from the relevant system owners. The reply is generated from a template containing the mandatory elements of Article 6/4 of the Communiqué: the data controller's details, the applicant's details, the subject of the request and the explanation. Accepted and rejected requests appear in separate sections of the template, and the reason for rejection has its own explicit field.
- Human approval. Before it is sent, the reply is approved by the data protection officer or the legal department. If requests such as deletion or correction have been accepted, proof that the action has actually been carried out is added to the approval step.
- Notification and archive. The reply is sent in writing or electronically, and the date and channel of sending are entered in the record. The application, its attachments, interim correspondence, the approval and the reply are archived in the same file. This file lets the questions listed in the announcement (accepted or rejected, on what grounds, which action was taken, on what date the reply was notified) be answered from a single place.
Some of these steps, such as consolidating channels, calculating due dates, sending alerts and filling in templates, can be automated with software robots or workflow tools. Identity verification, the reasons for rejection and approval, however, should remain with authorized people within the organization.
Conclusion
KVKK's October 1, 2026 announcement does not introduce a new obligation; it clarifies the existing rule: the reply to an application must be written or electronic, must be given within the thirty-day upper limit, and must clearly show whether the request was accepted or rejected, and why. Rather than relying on people to remember this each time, tying it to a workflow of record, deadline tracking, template, approval and archive both reduces risk and lightens the team's workload.
The pattern will feel familiar to anyone who has run logistics: every shipment has a unique tracking number, a dated scan at each handover, a promised delivery date with an alert when it slips, and proof of delivery on file. The six steps above apply the same discipline to data subject applications. It is a discipline that one of Orient Global's consultants has practiced for more than 30 years in operations, logistics and supply chain, including end-to-end responsibility for logistics and warehousing at a technology distribution company of roughly one billion dollars in scale and management of nationwide warehouse and transport operations at leading retail, logistics and distribution organizations.
From Orient Global's perspective, our recommendation is simple: first, list the applications of the last few months by the channel they came through and the number of days it took to answer them. Then set up the single-record and deadline-tracking steps; add automation on top of these two steps, keeping the approval points in place.
#interimmanagement #forwarddeployedengineering