Alterlab Kvkk Dmp

---
name: alterlab-kvkk-dmp
description: "Produces KVKK-compliant (Law 6698, as amended by Law 7499 — published in the Official Gazette 12 Mar 2024, KVKK provisions effective 1 Jun 2024) data management plans for Turkish research, encoding the açık rıza (explicit consent) default basis, the Art. 28(1)(b) anonymization exemption as the primary compliance lever, the Art. 6 special-category regime for health/genetic/biometric data, Art. 7 deletion/destruction/anonymization at purpose-end, the Art. 13 thirty-day data-subject response window, Art. 9 cross-border adequacy-decision rules for cloud/overseas data, and Art. 16 VERBIS pre-processing registration, with a KVKK-vs-GDPR crosswalk. Use when the user needs a KVKK data management plan, to anonymize a research dataset under Turkish law, a VERBIS check, or to fix EU DMP boilerplate for Turkey; for pure GDPR/HIPAA use alterlab-research-ethics. Part of the AlterLab Academic Skills suite."
license: MIT
allowed-tools: Read Write Edit Bash(python:*)
compatibility: No API key required — generates KVKK data management plans from primary mevzuat (Law 6698) encoded in references/; the optional scaffold runs via `uv run python` on the standard library only
metadata:
  skill-author: AlterLab
  version: "1.0.0"
  last_updated: "2026-06-06"
  depends_on: "alterlab-tr-research-ethics (etik kurul routing), alterlab-aperta (TÜBİTAK open-science / VYP)"
---

# KVKK Data Management Plan — Compliance Scaffolding for Turkish Research Data

Generates a **KVKK** (Kişisel Verilerin Korunması Kanunu — Turkey's Personal
Data Protection Law, No. 6698) data management plan for empirical research, and
audits EU/GDPR DMP boilerplate for the points where Turkish law **diverges**.
KVKK applies to essentially all Turkish empirical research that touches
personal data, yet it is not GDPR: the lawful-basis menu is narrower, the
research exemption works differently, and registration (**VERBIS**) and
cross-border rules are Turkey-specific. This skill encodes those divergences so
a researcher does not silently reuse an EU plan that is non-compliant in Türkiye.

All article references trace to the primary text of Law 6698
(mevzuat.gov.tr) and the official KVKK English translation; the substantive
divergences are tabulated in `references/kvkk_vs_gdpr.md`. Anonymization
techniques and the re-identification trap are in
`references/anonymization_methods.md`. Article-level detail with the exact
exemption wording is in `references/kvkk_articles.md`.

## When to Use This Skill

Use this skill when the request is about **Turkish data-protection compliance
for research data** — producing or fixing a data management plan under KVKK,
deciding whether a dataset can ride the anonymization exemption, choosing a
lawful basis (açık rıza — explicit consent — vs. an Art. 5/6 alternative),
planning retention and deletion at purpose-end, checking whether **VERBIS**
registration is required, or assessing a cloud/overseas transfer under Art. 9.

Typical triggers:

- "KVKK uyumlu veri yönetim planı hazırla" (prepare a KVKK-compliant DMP)
- "Anonymize this research dataset so it falls under the KVKK research exemption"
- "VERBIS kaydı gerekli mi?" (is VERBIS registration required?)
- "I have an EU Horizon DMP — make it KVKK-compliant for my Türkiye site"
- "Can I store this survey data on a US cloud under KVKK?"
- "We collect health/biometric data — what does Art. 6 require?"

### Does NOT Trigger

Route adjacent requests to the correct sibling skill instead of forcing this one:

| The user actually wants… | Route to | Why not this skill |
|---|---|---|
| GDPR / HIPAA / non-Turkish data-protection compliance | `alterlab-research-ethics` | This skill is KVKK-only; the international ethics/privacy skill owns GDPR/HIPAA |
| An **etik kurul** (ethics committee) application or which committee is needed (anket/TİTCK) | `alterlab-tr-research-ethics` | That skill scaffolds the Turkish ethics-board submission; KVKK-DMP covers data protection, not ethics review |
| Depositing accepted manuscripts / data in **Aperta** or a TÜBİTAK open-science **VYP** (veri yönetim planı / data-management plan) for the funder | `alterlab-aperta` | Aperta owns the TÜBİTAK open-science mandate and funder-facing VYP; KVKK-DMP only supplies the Principle-6 "why data is closed" justification |
| Building a TÜBİTAK ARDEB 1001/1002-A proposal | `alterlab-tubitak-proposal` | That skill scaffolds the proposal form; KVKK-DMP only fills the data-protection annex |
| Building a data-capture instrument / survey (Qualtrics, REDCap) or questionnaire | `alterlab-survey-design` | That owns instrument design; KVKK-DMP governs the legal-basis/retention layer over the data they collect |
| Turkish APA-7 / TR Dizin citation style or academic-writing conventions | `alterlab-tr-academic-style` | Style, not data protection |

If a workflow needs both a **funder VYP** (Aperta) and a **KVKK DMP** (here),
produce the KVKK plan first and hand its lawful-basis / anonymization decision
to `alterlab-aperta` to populate the open-science Principle-6 justification.

## The Six Decisions a KVKK DMP Must Resolve

A compliant plan answers these in order. Each maps to a specific article of Law
6698 (full wording in `references/kvkk_articles.md`).

1. **Lawful basis (Art. 5 / Art. 6).** The default is **açık rıza** (explicit
   consent). Unlike GDPR Art. 6, KVKK Art. 5 has **no standalone "scientific
   research" lawful basis** — if consent is not used, the processing must fit one
   of the enumerated Art. 5(2) alternatives (e.g. legal obligation, a contract,
   data made public by the subject, legitimate interest). Special-category data
   (sağlık/health, genetic, biometric, religious belief, etc.) falls under
   **Art. 6**, where processing is prohibited except in enumerated cases and the
   Board can mandate **adequate measures** (yeterli önlemler).

2. **Anonymization exemption (Art. 28(1)(b)) — the primary compliance lever.**
   Personal data that are **anonymized** for research, planning and statistics
   fall **outside the scope of the Law** under Art. 28(1)(b). Art. 28(1)(c)
   similarly exempts processing for scientific/artistic/literary purposes within
   limits. This is the single most powerful move in a research DMP: a genuinely
   anonymized dataset escapes consent, VERBIS, and transfer constraints.
   **Caveat:** data that remain re-identifiable are *not* anonymized and do **not**
   qualify — see `references/anonymization_methods.md`. Pseudonymized data are
   still personal data.

3. **Retention & destruction at purpose-end (Art. 7).** When the reasons for
   processing no longer exist, data must be **erased, destroyed, or anonymized**
   (silme / yok etme / anonim hale getirme) ex officio or on the data subject's
   request, per the KVKK By-Law on Erasure, Destruction or Anonymization. The DMP
   states a retention period and the destruction method for each data category.

4. **Data-subject rights & the response window (Art. 13).** A controller must
   answer a data-subject application **within thirty days** (otuz gün) at the
   latest. The DMP names the contact point and the procedure.

5. **Cross-border transfer (Art. 9, as amended by Law 7499 — published in the
   Official Gazette 12 Mar 2024, RG No. 32487; KVKK provisions effective 1 Jun
   2024).** Overseas/cloud storage needs either an **adequacy decision** by the
   Board or one of the enumerated safeguards (standard contracts, binding
   corporate rules, written undertakings, etc.). The Law 7499 amendment
   restructured Art. 9 around adequacy decisions and standard contracts — do not
   reuse pre-2024 "explicit consent for every transfer" boilerplate. Flag any
   non-Türkiye cloud.

6. **VERBIS registration (Art. 16).** Controllers must register with the **Veri
   Sorumluları Sicili** (VERBIS — Data Controllers' Registry) **before**
   processing, though the Board exempts categories by objective criteria. The DMP
   records VERBIS status (registered / exempt-by-criterion / pending) with the
   reason.

A worked walkthrough of all six on a sample survey + health-data project is in
`references/dmp_walkthrough.md`.

## How to Produce the Plan

1. **Classify the data.** For each data category, decide: personal vs.
   special-category (Art. 6), and identifiable vs. (intended-)anonymized.
2. **Pick the lever.** If the research questions can be answered on anonymized
   data, plan for Art. 28(1)(b) anonymization at the earliest point and document
   the technique and the re-identification-risk assessment. Otherwise select an
   Art. 5/6 lawful basis (default açık rıza) and justify it.
3. **Fill the six decisions** above into the DMP sections.
4. **Run the scaffold** (optional, deterministic) to emit a structured TR+EN DMP
   skeleton you then complete and review:

   ```bash
   uv run python skills/turkish-academia/alterlab-kvkk-dmp/scripts/kvkk_dmp_scaffold.py \
       --title "Project title" \
       --basis explicit-consent \
       --special-category health \
       --retention "5 years post-publication" \
       --cross-border none \
       --verbis registered \
       --lang both \
       --out kvkk_dmp.md
   ```

   The scaffold writes only a template grounded in the encoded article map; it
   makes **no legal determination** and reaches no network. Run
   `--help` for all flags, or `--self-check` to validate the article encoding.
5. **Audit reused EU/GDPR boilerplate** against `references/kvkk_vs_gdpr.md` and
   rewrite each divergent clause (no research basis; anonymization exemption;
   VERBIS; 2024 transfer rules).

## Hard Rules (do not violate)

- **Never claim a dataset is anonymized if it is re-identifiable.** Re-identifiable
  "anonymized" data does not qualify for the Art. 28 exemption and remains fully
  in scope. Pseudonymization is not anonymization.
- **Do not invent an Art. 5 "research" basis.** KVKK has none; use consent or a
  real enumerated alternative, or anonymize.
- **Cite base figures and mechanisms, not stale amounts.** KVKK Art. 18
  administrative fines are revalued every January under the Tax Procedure Law
  (Vergi Usul Kanunu) revaluation rate — cite the mechanism and direct the user to
  verify the current-year figure; do not hard-code a TRY amount.
- **Verify against the current law before relying on an output.** Flag the Law
  7499 amendments (Art. 6, 9, 18) — adopted 2 Mar 2024, published in the Official
  Gazette 12 Mar 2024 (RG No. 32487), KVKK provisions effective 1 Jun 2024 — as
  the most recent substantive change.
- This skill produces compliance **scaffolding**, not legal advice; recommend a
  Veri Sorumlusu / KVKK officer (or counsel) sign-off for high-risk processing.

## References

- `references/kvkk_articles.md` — article-by-article map (Art. 5, 6, 7, 9, 13, 16,
  28) with the exact exemption wording, sourced to Law 6698.
- `references/kvkk_vs_gdpr.md` — KVKK↔GDPR crosswalk: the four divergences that
  break EU DMP boilerplate (no research basis, anonymization exemption, VERBIS,
  2024 transfer reform).
- `references/anonymization_methods.md` — masking, aggregation, generalization
  (k-anonymity-style), and the re-identification trap that voids Art. 28.
- `references/dmp_walkthrough.md` — the six decisions worked end-to-end on a
  sample survey + health-data study, with a fill-in DMP outline.

### Primary sources

- Law 6698 (KVKK) full text — https://www.mevzuat.gov.tr/mevzuatmetin/1.5.6698.pdf
- KVKK official English translation — https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law
- By-Law on Erasure, Destruction or Anonymization of Personal Data — https://www.kvkk.gov.tr/Icerik/6636/By-Law-on-Erasure-Destruction-or-Anonymization-of-Personal-Data
- VERBIS (Data Controllers' Registry) — https://www.kvkk.gov.tr/Icerik/2043/
- Law 7499 — amendments to Art. 6, 9, 18 (adopted 2 Mar 2024; published in the Official Gazette 12 Mar 2024, RG No. 32487 — https://www.resmigazete.gov.tr/eskiler/2024/03/20240312-1.htm; KVKK provisions effective 1 Jun 2024)

Part of the AlterLab Academic Skills suite.