What businesses should plan
- Understand which role your business has under the applicable framework.
- Define the guest-identification and access workflow appropriate to the venue.
- Design log integrity, timestamping, retention and access controls around the actual deployment.
- Keep internet-access notices separate from optional marketing permissions and review KVKK obligations independently.
Official source: T.C. Mevzuat Bilgi Sistemi
Requirements can change and can differ by role and deployment. Have qualified counsel review your production configuration and notices.