Personal data handled the way the law and your customers expect.
KVKK and GDPR compliance built into the systems, not bolted on: data mapping, technical measures, consent and retention in code, data-subject requests that can actually be fulfilled, and the records a regulator will ask for.
- Data map
- Measures and plumbing
- Records and DPIAs
- Keep it true
We work alongside your DPO and counsel.
Privacy law is written in policies but enforced in systems. A retention policy that says ninety days means nothing if the database keeps everything forever; a consent banner is theatre if the marketing platform never hears what the user chose; a data-subject request that should take days takes weeks because nobody knows which systems hold the person. The gap between the policy and the code is where fines and lost trust live.
We close that gap from the engineering side. We map where personal data enters, moves and rests across your estate, implement the technical measures KVKK and GDPR require — minimisation, encryption, access control, retention, pseudonymisation — as code and configuration, and build the plumbing that makes consent, erasure and access requests fulfillable. Your legal team writes the policy; we make the systems obey it.
We do not give legal advice; we make the technical side of their advice true.
Four things a privacy programme needs from engineering.
Most engagements start with the data map, because nothing else can be done honestly without it.
Data mapping and records
Where personal data enters, which systems hold it, who it flows to, on what basis, for how long. Produced from the systems themselves, not from interviews alone, and kept current by automated scans.
Technical measures
Encryption at rest and in transit, access control and logging, pseudonymisation for analytics, minimisation in forms and APIs, secure deletion. Implemented and evidenced, not described.
Consent and retention in code
Consent captured once and propagated to every system that acts on it; retention rules enforced by jobs that delete and log; cookie and tracking consent wired to the tools it governs.
Data-subject requests and DPIAs
Access, erasure and portability requests fulfilled from the data map with a tooling path per system, and data-protection impact assessments with the technical detail a regulator expects. See also compliance auditing.
How the work runs, day to day.
A policy is a configuration your systems enforce.
Retention becomes a scheduled job with a log. Consent becomes an event every downstream system subscribes to. Minimisation becomes a review rule on every new field. Access becomes roles mapped to your identity provider with regular reviews generated automatically. The privacy programme stops depending on people remembering.
- Retention and deletion as jobs with evidence, not as a policy document
- Consent propagated by events to marketing, analytics and partners
- Erasure paths tested per system, so a request is a workflow, not a project
How the work runs.
Data map
Systems scanned and owners interviewed; the map of personal data, flows, bases and retention produced and reviewed with your DPO.
Measures and plumbing
Technical measures implemented in priority order; consent and retention wired; erasure and access paths built and tested per system.
Records and DPIAs
Records of processing generated from the map; DPIAs for the high-risk processing with the technical detail filled in.
Keep it true
Scans that detect new personal data, regular access reviews at a rhythm agreed with you, and a request workflow your team runs.
What you keep.
- A data map of personal data across systems, generated and maintainable
- Technical measures implemented and evidenced
- Consent and retention enforced by code with logs
- A data-subject request workflow with a tested path per system
- Records of processing and DPIAs with technical detail
When this is the right call.
Choose this when your policies say one thing and your systems do another — when a data-subject request is a scramble, when nobody can say which systems hold a customer, or when a regulator, an auditor or a large customer has asked for proof.
Look elsewhere if you need the legal programme itself written — the policies, the contracts, the DPO function. We work with your counsel; we do not replace them.
Frequently asked questions
Services that pair with this.
Where does your personal data actually live?
Tell us the systems and the regime you answer to. An engineer reads it and replies in writing with a scope for the data map.