KVKK Compliance Management coming soon: inventory, explicit consent and destruction records for employee data

Who will it be for, and what problem will it solve?

KVKK Compliance Management is planned for every employer that processes employee and candidate data; it will be especially useful for businesses that keep their personal data inventory in a separate spreadsheet, store explicit consents in folders and cannot regularly review records whose retention period has expired. With this method, which data is kept for which purpose and for how long does not stay current, leavers' data stays indefinitely and employee requests get lost in email.

• HR manager: will update the inventory and follow explicit consent records and requests on a single screen.
• KVKK officer or contact person: will follow records whose retention period has expired, destruction operations and the target dates of data subject requests.
• Legal adviser: will review the inventory, destruction reports and the access report.

What will KVKK Compliance Management do?

KVKK Compliance Management will turn the decisions the employer makes into records that can be applied and evidenced; it will not make the decisions itself. The whole module is coming soon; the planned scope is as follows:

• Personal data inventory: data category, processing purpose, legal basis, retention period and transfer details for HR data will be entered according to your company's policy; the inventory will be exportable as CSV.
• Retention and destruction: records whose retention period has expired will be listed at set intervals; deletion, anonymization or destruction will be carried out with approval and documented in a destruction report.
• Data subject requests: requests will be recorded with their status, response and target date.
• Explicit consent records: for consent-based processing, the giving and withdrawal of consent will be recorded.
• Access report: will show views of sensitive data from the existing audit log in the Roles, Permissions & Security module.

Publishing privacy notices and policies as company-wide documents, with a read report and a list of those who have not read them, is also coming soon to Document & Contract Management. Ready-made privacy notice or policy templates, a data breach notification flow and direct registration in VERBİS (Türkiye's data controllers' registry) are not part of the planned scope.

Sora İK's obligations as a data processor are on the Data Processing Agreement page, and information on encryption, backups and sub-processors is on the security page.

How will it work?

The planned module will make the employer's policy workable in five steps.

1. Inventory: data categories, processing purposes, legal bases, retention periods and transfers will be entered together with your legal adviser.
2. Retention periods: periods will be defined by data type; records whose period has expired will be listed at set intervals.
3. Destruction: for the listed records, deletion, anonymization or destruction will be approved and a destruction report created.
4. Consent and requests: consent records will be kept for processing that requires explicit consent; each incoming data subject request will be recorded and its status and target date followed.
5. Access review: views of sensitive data will be reviewed regularly with the access report.

Regulatory note

The rules for applying KVKK are set by the Law, regulations, communiqués, and the guidelines and decisions of the Personal Data Protection Authority; no article numbers or periods are given on this page.

• Law No. 6698 on the Protection of Personal Data
• Personal Data Protection Authority
• Obligation to Inform
• Points to Consider When Obtaining Explicit Consent
• Erasure, Destruction or Anonymization of Personal Data
• Authority guidelines

The notice Sora İK has prepared for its own website and account data is on the KVKK Privacy Notice page. This page is not legal advice; for situations specific to your business, consult your legal adviser.

Which technical measures does Sora İK contribute today?

Even before KVKK Compliance Management arrives, the Sora İK modules in use today apply the following measures for processing employee data under the principle of least privilege:

• Roles and permissions: who sees which data is limited by roles and custom roles; this is managed in the Roles, Permissions & Security module.
• Audit log: every modifying action is recorded with the person who did it and the names of the changed fields; values and personal data are not written. Displaying another person's identity number in full, viewing pay history, payroll details, candidate and performance records, document downloads and exports are also recorded separately.
• Special category documents: health reports and criminal record certificates are viewed with a separate permission; by default only the company owner and HR have this permission.
• Document deletion: when an authorized user deletes a document, all its versions are also removed from storage and the action is recorded in the audit log.
• Candidate consent: in the applicant tracking system, optional explicit consent given in an application is stored together with the text's SHA-256 fingerprint and the time of consent.
• Identity number: not shown in lists, not shown to users without permission, and not written to application logs.
• Team view: in the attendance ledger, the team manager cannot tell sick days apart from paid excused absence; in leave notification emails, leave with a health-related reason is given a neutral name.
• PDKS (time and attendance): no biometric data is processed; location is taken only at the moment of a QR record, for verification, and raw coordinates are not stored; IP address and browser information are not stored with clock-in records.
• Company separation: each company's data is separated at database level with row-level security.

Can HR software achieve KVKK compliance on its own?

No. Responsibility for KVKK compliance lies with the data controller, who decides for what purpose and by what method personal data is processed; the employer is the data controller for employee data. HR software helps run and record processes such as the inventory, explicit consent, retention and destruction in an orderly way; however, which data is processed on which legal basis, the content of notices, setting retention periods, obligations relating to the Data Controllers' Registry Information System (VERBİS), informing employees and managing the paper archive remain the employer's decision and responsibility.

Questions to ask when assessing software from this angle:

1. Is a data processing agreement signed, and are sub-processors listed?
2. Where is the data hosted, and how is it backed up?
3. Can access to each kind of data be limited by role and tracked in an audit log?
4. Can the data be exported and deleted when the contract ends?

For Sora İK, the answers to these questions are on the security, Data Processing Agreement and pricing pages. Other modules in the compliance and reporting area (occupational health and safety, disciplinary records and statutory reports) are listed on the Compliance & Reporting category page.