Data Privacy Law: GDPR, KVKK, CCPA, and Cross-Border Compliance

Data privacy law has moved from a narrow legal specialty to a board-level business risk. A company can now lose customer trust, face regulator scrutiny, and disrupt revenue simply because it collected more data than it needed, transferred it without a valid mechanism, or failed to answer a user request on time. The legal rules are technical, but the management problem is practical: every business must know what personal data it has, why it has it, who can access it, where it travels, how long it stays, and what happens if it leaks.

This guide is the master reference for the Data Privacy and KVKK pillar inside the Kurums Law department. It explains the core legal architecture behind GDPR, Turkey’s KVKK, California privacy law, cross-border transfers, data processing agreements, breach notification, cookies, and privacy governance. Use it as the central map before going deeper into the supporting guides.

What is data privacy law?

Data privacy law is the body of rules that governs how organizations handle personal data throughout its lifecycle, from collection to deletion. It answers four fundamental questions: whether a company may process personal data, what it must tell the individual, how it must protect and control the data, and what rights the individual has over it.

The modern privacy model is not limited to secrecy. It also includes fairness, transparency, purpose limitation, minimization, accuracy, storage limitation, security, accountability, and the ability to prove compliance. A business may keep data confidential and still violate privacy law if it collected the data without a valid basis, used it for an unexpected purpose, retained it too long, or transferred it abroad without the required safeguards.

Which laws matter most for international businesses?

The most important privacy regimes for international business are GDPR in the European Union and EEA, KVKK in Turkey, CCPA/CPRA in California, and sector-specific rules that apply to finance, health, telecom, employment, and children. Many other countries have enacted GDPR-style laws, but these frameworks are often the starting point for global compliance design.

What are the core principles of privacy compliance?

Most privacy laws are built on seven core principles: lawful basis, transparency, purpose limitation, data minimization, accuracy, storage limitation, security, and accountability. These principles are broad, but they become concrete when applied to daily business operations.

1. Lawful basis or permitted purpose – identify the legal reason for processing before collecting the data.
2. Transparency – explain processing clearly through privacy notices, employee notices, cookie notices, and just-in-time disclosures where needed.
3. Purpose limitation – use data only for the purpose disclosed or otherwise legally permitted.
4. Data minimization – collect only what is necessary for the stated purpose.
5. Accuracy – keep data accurate where inaccurate data could harm individuals or business decisions.
6. Storage limitation – define retention periods and delete or anonymize data when no longer needed.
7. Security and accountability – protect data and maintain evidence that compliance decisions were made properly.

How should businesses build a privacy compliance program?

A privacy compliance program should be built as an operating system, not a document folder. Policies matter, but regulators and courts increasingly look for evidence of implementation: records, assessments, contracts, training, escalation logs, breach drills, vendor reviews, and data subject request workflows.

The practical sequence starts with data mapping. Identify processing activities by business function: marketing, sales, HR, finance, support, product analytics, procurement, legal, and security. For each activity, record the data categories, source, purpose, lawful basis, recipients, storage location, transfer destination, retention period, security controls, and responsible owner. This becomes the backbone for privacy notices, vendor contracts, DPIAs, transfer impact assessments, and deletion schedules.

The privacy operating model

What is a lawful basis, and why does it matter?

A lawful basis is the legal justification that allows an organization to process personal data. Under GDPR, the common bases are consent, contract necessity, legal obligation, vital interests, public task, and legitimate interests. KVKK uses its own structure, including explicit consent and statutory exceptions such as processing required by law, contract necessity, legal obligation, public availability by the data subject, establishment or protection of a right, and legitimate interest where fundamental rights are not harmed.

The mistake many companies make is treating consent as the safest option. Consent is useful when it is freely given, specific, informed, and withdrawable. But it is often weak in employment, essential services, and situations where the individual has little real choice. For routine business processing, contract necessity, legal obligation, or legitimate interest may be more appropriate if properly documented.

What contracts are required for privacy compliance?

Privacy compliance depends heavily on contracts because vendors, processors, affiliates, advertisers, cloud tools, payroll providers, CRM systems, and analytics platforms often process data on behalf of the business. A privacy notice may describe the processing, but the contract controls who may do what with the data.

The most important document is the data processing agreement, often called a DPA. It defines whether each party is a controller, processor, joint controller, service provider, contractor, or business under the relevant law. It also addresses processing instructions, confidentiality, security, sub-processors, audit rights, international transfers, deletion, breach notification, and assistance with data subject requests. For contract drafting fundamentals, see the Kurums guide to business agreements.

How do cross-border data transfers work?

A cross-border transfer occurs when personal data moves or becomes accessible outside the jurisdiction where it was collected, and many privacy laws restrict these transfers unless safeguards are in place. Cloud hosting, remote support access, global HR systems, international marketing platforms, and group-company reporting can all create transfers.

Under GDPR, common transfer tools include adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, and limited derogations. Under KVKK, cross-border transfers have historically required explicit consent or authority-approved safeguards, with reforms and guidance shaping practical compliance. The business issue is the same: identify where the data goes, why it goes there, who can access it, and which legal mechanism supports the transfer.

What should happen after a data breach?

A data breach response should move through containment, assessment, notification analysis, evidence preservation, remediation, and post-incident improvement. The clock starts quickly. GDPR has a 72-hour supervisory authority notification standard where the breach is likely to result in risk to individuals, while other regimes have their own timing and content requirements.

The first legal question is not whether the company is embarrassed. It is whether the incident involved personal data, whether confidentiality, integrity, or availability was affected, whether individuals face risk, and whether a regulator, individual, customer, insurer, or contractual counterparty must be notified. A prepared company has a breach playbook before the incident, not after.

How do cookies and tracking technologies fit into privacy law?

Cookies, pixels, SDKs, tags, and similar tracking technologies can trigger privacy and electronic communications rules because they identify devices, track behavior, or share data with advertising and analytics partners. Website privacy risk often comes from tools added by marketing teams without legal review.

A compliant cookie program usually requires classifying cookies by purpose, blocking non-essential cookies until consent where required, offering granular choices, recording consent logs, updating cookie notices, and reviewing third-party tags. Under California rules, some adtech sharing can trigger “sale” or “sharing” obligations even if no money changes hands.

Common privacy compliance mistakes

• Copying privacy policies from competitors without matching actual data flows.
• Using consent for everything instead of selecting the correct lawful basis.
• Ignoring employee data even though HR processing is often high risk.
• Forgetting vendor contracts and sub-processor controls.
• Keeping data forever because no retention schedule exists.
• Letting marketing tags multiply without cookie governance.
• Responding to rights requests manually without identity checks, deadlines, or evidence logs.

Frequently Asked Questions