KVKK for associations: core principles for working with member data

When associations and foundations process data about members, donors, volunteers and beneficiaries, they are data controllers under KVKK, Turkey's personal data protection law, and must process that data lawfully, for specific purposes, proportionately and only for as long as necessary. In practice the obligation comes down to five topics: notice, explicit consent where it is required, retention, access rights and security. This article offers a general road map; it is not legal advice, and you should consult a lawyer about your own situation.

Where do associations and foundations stand under KVKK?

An association processes personal data from the moment it receives a membership application: name, contact details, ID number, profession, address and often a photograph. Organisations that accept donations, work with volunteers, distribute aid or employ staff handle even more categories of data. Because the association decides why and how this data is processed, it is the data controller.

• Members' identity, contact, profession and dues details form the association's core data set.
• Donors' names, contact details and giving history should be treated as a separate data set.
• Volunteers' availability, skills and assignments often sit in unofficial spreadsheets.
• Beneficiaries' household, income and health details are the most sensitive data set.
• Data about staff and board members is subject to the same principles.

Outside parties that process data on the association's behalf are data processors. A software provider, an accounting firm, a bulk messaging service or a company supporting an event can all fall into this group. Contracts with them should state clearly for what purpose the data is processed, how it is protected and what happens to it when the work ends.

There is one point associations need to watch closely: the law lists membership of an association, foundation or trade union among special categories of personal data. Together with other special categories such as health or religious belief, this data is subject to stricter processing conditions and additional security measures. Because these conditions can be updated, check the current text and the guidance of the Personal Data Protection Authority through official sources.

How do you meet the duty to inform in practice?

The duty to inform means telling people, at the moment you collect their data, who is processing it, for what purpose and on what legal basis, to whom it may be transferred and what rights they have. A privacy notice is not a tick box; it is a plain, specific explanation that people can actually read and understand.

Associations often settle for one generic text, yet a membership application, a donation form, an event registration and a volunteer application serve different purposes. Preparing a short notice focused on each collection point makes it easier for people to understand and stops the association from asking for more data than it needs.

• State the association's name and contact details clearly in the notice.
• List the purposes of processing in concrete terms.
• Explain to whom the data may be transferred and why.
• Say how the data is collected and which legal basis it rests on.
• Describe the person's rights and how to exercise them.
• Keep a record of when, and in which version, the notice was presented.

Forms and registration pages on the website need the same care. Asking only for the fields the purpose requires, marking optional fields clearly and linking the privacy notice right next to the form are signs of good practice. Cookies and analytics tools that collect visitor data also call for a separate notice.

When is explicit consent needed, and when is it not?

The most common mistake is asking for explicit consent for every processing activity. The law also recognises other legal bases, such as performing a contract, meeting a legal obligation or legitimate interest. Asking for consent to processing that is essential for running the membership relationship suggests a choice that does not really exist, and leaves the association stuck if the consent is withdrawn.

Explicit consent comes into play where no other legal basis exists; publishing members' photos for promotion or tailoring communications to members' interests are typical examples. Consent must relate to a specific matter, be informed and be freely given. Making membership or a service conditional on consent takes that freedom away.

When consent is given, record when, with which text and through which channel. Withdrawing consent should be as easy as giving it, and when a withdrawal arrives the processing must genuinely stop. For promotional bulk messages, the current rules on commercial electronic communications also need to be checked.

Explicit consent is not a key that opens every door; the right legal basis is chosen together with the right purpose.

How long should member data be kept?

Personal data should be kept for as long as the purpose requires, or for as long as legislation prescribes. The principle cuts both ways: accounting and association rules require some records to be kept for set periods, while holding data indefinitely after its purpose has ended runs against the principle of proportionality.

The way to strike that balance is a retention and destruction policy. For each category of data, the policy sets the retention period, what that period is based on, and whether the data will be erased, destroyed or anonymised when it expires. Confirm the actual periods with the legislation and your legal adviser; this article gives no figures because periods vary by record type and change with regulations.

The records most often overlooked are rejected membership applications, old event attendee lists and attachments piling up in mailboxes. A departed member's dues and accounting records may still have to be kept, but their communication preferences and promotional data should no longer be processed. Logging each periodic destruction run shows that the policy is actually applied.

How should access be restricted?

Who can reach the association's data is the most tangible measure of its security. The basic rule is least privilege: everyone should see only the data their role requires. A branch secretary should not see other branches' members, a volunteer coordinator should not see members' dues history and an event officer should not see donor details.

Defining permissions on paper is not enough; the system you use must enforce those limits technically. Shared accounts, folders everyone can open and member lists circulating by email undermine even the best-written policy. Access for officers who leave after an election should be removed the same day, and critical actions and bulk exports should be logged.

The same rule applies to outside parties. The contract should state when and with what authority the software provider may access data for support, and those accesses should be logged too. Parties such as the accounting firm or an auditor should be given only the part of the data their work requires, not all of it.

Which security measures should be in place?

KVKK expects data controllers to take technical and administrative measures that provide an appropriate level of security against unlawful processing and access. For associations these measures rarely need a big budget; most are simple habits applied consistently.

• Give every user their own account and use two-step verification on administrator accounts.
• Back up data regularly and test restoring it at set intervals.
• Do not share member lists as email attachments or in messaging groups.
• Have everyone with access to personal data sign a confidentiality undertaking and receive a short briefing.
• Write down in advance who does what in a data breach and how the Authority is to be notified.
• Use screen locks and disk encryption on laptops, phones and similar devices.

Deadlines and procedures for breach notification are set by the Authority's decisions, so check the current rules on the Personal Data Protection Authority's official website. What matters is following a plan prepared in advance rather than improvising under pressure when a breach happens.

Paper records are part of security as well. Membership application forms, signed documents and aid files should be kept in locked cabinets, and the policy should say when and how paper copies of digitised documents are destroyed.

Frequently asked questions

Can an association share its member list with other members?

Sharing the member list is only conceivable where there is a valid legal basis and a clear purpose. Even then, it should be limited to the fields the purpose requires, and legal advice should be sought first.

Are donor and volunteer data covered by KVKK too?

Yes. Any data relating to a natural person is personal data, whatever their relationship with the association. Notice, retention and security principles apply equally to donors, volunteers, beneficiaries and event attendees.

Do associations have to register with the data controllers' registry?

The registration obligation and its exemptions are set by the Board's decisions and can change over time. Confirm your association's position through the Personal Data Protection Authority's current announcements and with a lawyer.

What should happen when a member asks for their data to be deleted?

Log the request and answer it within the statutory period. Records the association is required to keep are retained, while data whose purpose has ended is erased or anonymised, and the person is told which data is kept and why.

Can event photos be published on the association's website?

Publishing photos in which people can be recognised for promotional purposes usually needs a separate legal assessment and, in many cases, explicit consent. Asking for a separate, optional approval at event registration avoids objections later.

Starting with small but steady steps

KVKK compliance is not a one-off paperwork exercise but a habit in how the association works with data. Mapping your data, writing a short notice for each collection point, setting retention periods and limiting access by role is a manageable and lasting start for most associations. In the Dernek Yönetim Sistemi we build at Bir Web Ajans, branch scope is enforced at the data-query level rather than in the interface, and every installation runs on its own database.