kvkk-compliance

KVKK & GDPR Compliance Patterns

Practical patterns for Turkish KVKK (Law No. 6698) and EU GDPR data protection compliance.

KVKK vs GDPR Comparison

Data Classification

enum DataCategory {
  PERSONAL = 'personal',           // name, email, phone
  SPECIAL = 'special_category',    // health, biometrics, religion
  ANONYMOUS = 'anonymous',         // cannot identify anyone
  PSEUDONYMOUS = 'pseudonymous',   // identifiable only with additional data
}

interface DataField {
  name: string
  category: DataCategory
  retentionDays: number
  requiresExplicitConsent: boolean
  encryptAtRest: boolean
}

const USER_DATA_FIELDS: DataField[] = [
  { name: 'email', category: DataCategory.PERSONAL, retentionDays: 730, requiresExplicitConsent: false, encryptAtRest: false },
  { name: 'healthRecords', category: DataCategory.SPECIAL, retentionDays: 365, requiresExplicitConsent: true, encryptAtRest: true },
  { name: 'analyticsId', category: DataCategory.PSEUDONYMOUS, retentionDays: 365, requiresExplicitConsent: false, encryptAtRest: false },
]

Consent Management

// BAD: single "accept all" checkbox - violates both KVKK and GDPR
// <input type="checkbox" /> I accept everything

// GOOD: granular, purpose-specific consent
interface ConsentRecord {
  userId: string; purpose: string; granted: boolean
  timestamp: Date; ipAddress: string; version: string
}

const CONSENT_PURPOSES = [
  { id: 'essential', label: 'Service operation', required: true },
  { id: 'analytics', label: 'Usage analytics', required: false },
  { id: 'marketing', label: 'Marketing emails', required: false },
  { id: 'third_party', label: 'Third-party sharing', required: false },
] as const

async function recordConsent(userId: string, purposeId: string, granted: boolean, meta: { ip: string; userAgent: string }): Promise<ConsentRecord> {
  // Always INSERT, never UPDATE - full audit trail
  return db.consentRecords.create({
    data: { userId, purpose: purposeId, granted, timestamp: new Date(), ipAddress: meta.ip, version: CURRENT_CONSENT_VERSION },
  })
}

async function hasActiveConsent(userId: string, purposeId: string): Promise<boolean> {
  const latest = await db.consentRecords.findFirst({
    where: { userId, purpose: purposeId },
    orderBy: { timestamp: 'desc' },
  })
  return latest?.granted === true
}