# Alterlab Kvkk Dmp > Produces KVKK-compliant (Law 6698, as amended by Law 7499 — published in the Official Gazette 12 Mar 2024, KVKK provisions effective 1 Jun 2024) data management plans for Turkish research, encoding the açık rıza (explicit consent) default basis, the Art. 28(1)(b) anonymization exemption as the primary compliance lever, the Art. 6 special-category regime for health/genetic/biometric data, Art. 7 deletion/destruction/anonymization at purpose-end, the Art. 13 thirty-day data-subject response window, Art. 9 cross-border adequacy-decision rules for cloud/overseas data, and Art. 16 VERBIS pre-processing registration, with a KVKK-vs-GDPR crosswalk. Use when the user needs a KVKK data management plan, to anonymize a research dataset under Turkish law, a VERBIS check, or to fix EU DMP boilerplate for Turkey; for pure GDPR/HIPAA use alterlab-research-ethics. Part of the AlterLab Academic Skills suite. - Skill: `alterlab-ieu/alterlab-kvkk-dmp` (Agent Skill, multi-file: 7 files) - Install (CLI): `npx skillmds@latest add alterlab-ieu/alterlab-kvkk-dmp` - Raw SKILL.md: https://api.skillmd.com/api/skills/alterlab-ieu/alterlab-kvkk-dmp/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - License: MIT - Author: AlterLab-IEU (https://skillmd.com/u/alterlab-ieu) - Updated: 2026-09-08 - Page: https://skillmd.com/skills/alterlab-ieu/alterlab-kvkk-dmp --- # KVKK Data Management Plan — Compliance Scaffolding for Turkish Research Data Generates a **KVKK** (Kişisel Verilerin Korunması Kanunu — Turkey's Personal Data Protection Law, No. 6698) data management plan for empirical research, and audits EU/GDPR DMP boilerplate for the points where Turkish law **diverges**. KVKK applies to essentially all Turkish empirical research that touches personal data, yet it is not GDPR: the lawful-basis menu is narrower, the research exemption works differently, and registration (**VERBIS**) and cross-border rules are Turkey-specific. This skill encodes those divergences so a researcher does not silently reuse an EU plan that is non-compliant in Türkiye. All article references trace to the primary text of Law 6698 (mevzuat.gov.tr) and the official KVKK English translation; the substantive divergences are tabulated in `references/kvkk_vs_gdpr.md`. Anonymization techniques and the re-identification trap are in `references/anonymization_methods.md`. Article-level detail with the exact exemption wording is in `references/kvkk_articles.md`. ## When to Use This Skill Use this skill when the request is about **Turkish data-protection compliance for research data** — producing or fixing a data management plan under KVKK, deciding whether a dataset can ride the anonymization exemption, choosing a lawful basis (açık rıza — explicit consent — vs. an Art. 5/6 alternative), planning retention and deletion at purpose-end, checking whether **VERBIS** registration is required, or assessing a cloud/overseas transfer under Art. 9. Typical triggers: - "KVKK uyumlu veri yönetim planı hazırla" (prepare a KVKK-compliant DMP) - "Anonymize this research dataset so it falls under the KVKK research exemption" - "VERBIS kaydı gerekli mi?" (is VERBIS registration required?) - "I have an EU Horizon DMP — make it KVKK-compliant for my Türkiye site" - "Can I store this survey data on a US cloud under KVKK?" - "We collect health/biometric data — what does Art. 6 require?" ### Does NOT Trigger Route adjacent requests to the correct sibling skill instead of forcing this one: | The user actually wants… | Route to | Why not this skill | |---|---|---| | GDPR / HIPAA / non-Turkish data-protection compliance | `alterlab-research-ethics` | This skill is KVKK-only; the international ethics/privacy skill owns GDPR/HIPAA | | An **etik kurul** (ethics committee) application or which committee is needed (anket/TİTCK) | `alterlab-tr-research-ethics` | That skill scaffolds the Turkish ethics-board submission; KVKK-DMP covers data protection, not ethics review | | Depositing accepted manuscripts / data in **Aperta** or a TÜBİTAK open-science **VYP** (veri yönetim planı / data-management plan) for the funder | `alterlab-aperta` | Aperta owns the TÜBİTAK open-science mandate and funder-facing VYP; KVKK-DMP only supplies the Principle-6 "why data is closed" justification | | Building a TÜBİTAK ARDEB 1001/1002-A proposal | `alterlab-tubitak-proposal` | That skill scaffolds the proposal form; KVKK-DMP only fills the data-protection annex | | Building a data-capture instrument / survey (Qualtrics, REDCap) or questionnaire | `alterlab-survey-design` | That owns instrument design; KVKK-DMP governs the legal-basis/retention layer over the data they collect | | Turkish APA-7 / TR Dizin citation style or academic-writing conventions | `alterlab-tr-academic-style` | Style, not data protection | If a workflow needs both a **funder VYP** (Aperta) and a **KVKK DMP** (here), produce the KVKK plan first and hand its lawful-basis / anonymization decision to `alterlab-aperta` to populate the open-science Principle-6 justification. ## The Six Decisions a KVKK DMP Must Resolve A compliant plan answers these in order. Each maps to a specific article of Law 6698 (full wording in `references/kvkk_articles.md`). 1. **Lawful basis (Art. 5 / Art. 6).** The default is **açık rıza** (explicit consent). Unlike GDPR Art. 6, KVKK Art. 5 has **no standalone "scientific research" lawful basis** — if consent is not used, the processing must fit one of the enumerated Art. 5(2) alternatives (e.g. legal obligation, a contract, data made public by the subject, legitimate interest). Special-category data (sağlık/health, genetic, biometric, religious belief, etc.) falls under **Art. 6**, where processing is prohibited except in enumerated cases and the Board can mandate **adequate measures** (yeterli önlemler). 2. **Anonymization exemption (Art. 28(1)(b)) — the primary compliance lever.** Personal data that are **anonymized** for research, planning and statistics fall **outside the scope of the Law** under Art. 28(1)(b). Art. 28(1)(c) similarly exempts processing for scientific/artistic/literary purposes within limits. This is the single most powerful move in a research DMP: a genuinely anonymized dataset escapes consent, VERBIS, and transfer constraints. **Caveat:** data that remain re-identifiable are *not* anonymized and do **not** qualify — see `references/anonymization_methods.md`. Pseudonymized data are still personal data. 3. **Retention & destruction at purpose-end (Art. 7).** When the reasons for processing no longer exist, data must be **erased, destroyed, or anonymized** (silme / yok etme / anonim hale getirme) ex officio or on the data subject's request, per the KVKK By-Law on Erasure, Destruction or Anonymization. The DMP states a retention period and the destruction method for each data category. 4. **Data-subject rights & the response window (Art. 13).** A controller must answer a data-subject application **within thirty days** (otuz gün) at the latest. The DMP names the contact point and the procedure. 5. **Cross-border transfer (Art. 9, as amended by Law 7499 — published in the Official Gazette 12 Mar 2024, RG No. 32487; KVKK provisions effective 1 Jun 2024).** Overseas/cloud storage needs either an **adequacy decision** by the Board or one of the enumerated safeguards (standard contracts, binding corporate rules, written undertakings, etc.). The Law 7499 amendment restructured Art. 9 around adequacy decisions and standard contracts — do not reuse pre-2024 "explicit consent for every transfer" boilerplate. Flag any non-Türkiye cloud. 6. **VERBIS registration (Art. 16).** Controllers must register with the **Veri Sorumluları Sicili** (VERBIS — Data Controllers' Registry) **before** processing, though the Board exempts categories by objective criteria. The DMP records VERBIS status (registered / exempt-by-criterion / pending) with the reason. A worked walkthrough of all six on a sample survey + health-data project is in `references/dmp_walkthrough.md`. ## How to Produce the Plan 1. **Classify the data.** For each data category, decide: personal vs. special-category (Art. 6), and identifiable vs. (intended-)anonymized. 2. **Pick the lever.** If the research questions can be answered on anonymized data, plan for Art. 28(1)(b) anonymization at the earliest point and document the technique and the re-identification-risk assessment. Otherwise select an Art. 5/6 lawful basis (default açık rıza) and justify it. 3. **Fill the six decisions** above into the DMP sections. 4. **Run the scaffold** (optional, deterministic) to emit a structured TR+EN DMP skeleton you then complete and review: ```bash uv run python skills/turkish-academia/alterlab-kvkk-dmp/scripts/kvkk_dmp_scaffold.py \ --title "Project title" \ --basis explicit-consent \ --special-category health \ --retention "5 years post-publication" \ --cross-border none \ --verbis registered \ --lang both \ --out kvkk_dmp.md ``` The scaffold writes only a template grounded in the encoded article map; it makes **no legal determination** and reaches no network. Run `--help` for all flags, or `--self-check` to validate the article encoding. 5. **Audit reused EU/GDPR boilerplate** against `references/kvkk_vs_gdpr.md` and rewrite each divergent clause (no research basis; anonymization exemption; VERBIS; 2024 transfer rules). ## Hard Rules (do not violate) - **Never claim a dataset is anonymized if it is re-identifiable.** Re-identifiable "anonymized" data does not qualify for the Art. 28 exemption and remains fully in scope. Pseudonymization is not anonymization. - **Do not invent an Art. 5 "research" basis.** KVKK has none; use consent or a real enumerated alternative, or anonymize. - **Cite base figures and mechanisms, not stale amounts.** KVKK Art. 18 administrative fines are revalued every January under the Tax Procedure Law (Vergi Usul Kanunu) revaluation rate — cite the mechanism and direct the user to verify the current-year figure; do not hard-code a TRY amount. - **Verify against the current law before relying on an output.** Flag the Law 7499 amendments (Art. 6, 9, 18) — adopted 2 Mar 2024, published in the Official Gazette 12 Mar 2024 (RG No. 32487), KVKK provisions effective 1 Jun 2024 — as the most recent substantive change. - This skill produces compliance **scaffolding**, not legal advice; recommend a Veri Sorumlusu / KVKK officer (or counsel) sign-off for high-risk processing. ## References - `references/kvkk_articles.md` — article-by-article map (Art. 5, 6, 7, 9, 13, 16, 28) with the exact exemption wording, sourced to Law 6698. - `references/kvkk_vs_gdpr.md` — KVKK↔GDPR crosswalk: the four divergences that break EU DMP boilerplate (no research basis, anonymization exemption, VERBIS, 2024 transfer reform). - `references/anonymization_methods.md` — masking, aggregation, generalization (k-anonymity-style), and the re-identification trap that voids Art. 28. - `references/dmp_walkthrough.md` — the six decisions worked end-to-end on a sample survey + health-data study, with a fill-in DMP outline. ### Primary sources - Law 6698 (KVKK) full text — https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf - KVKK official English translation — https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law - By-Law on Erasure, Destruction or Anonymization of Personal Data — https://www.kvkk.gov.tr/Icerik/6636/By-Law-on-Erasure-Destruction-or-Anonymization-of-Personal-Data - VERBIS (Data Controllers' Registry) — https://www.kvkk.gov.tr/Icerik/2043/ - Law 7499 — amendments to Art. 6, 9, 18 (adopted 2 Mar 2024; published in the Official Gazette 12 Mar 2024, RG No. 32487 — https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm; KVKK provisions effective 1 Jun 2024) Part of the AlterLab Academic Skills suite.