| name | alterlab-kvkk-dmp |
| description | Produces KVKK-compliant (Law 6698, as amended by Law 7499 — published in the Official Gazette 12 Mar 2024, KVKK provisions effective 1 Jun 2024) data management plans for Turkish research, encoding the açık rıza (explicit consent) default basis, the Art. 28(1)(b) anonymization exemption as the primary compliance lever, the Art. 6 special-category regime for health/genetic/biometric data, Art. 7 deletion/destruction/anonymization at purpose-end, the Art. 13 thirty-day data-subject response window, Art. 9 cross-border adequacy-decision rules for cloud/overseas data, and Art. 16 VERBIS pre-processing registration, with a KVKK-vs-GDPR crosswalk. Use when the user needs a KVKK data management plan, to anonymize a research dataset under Turkish law, a VERBIS check, or to fix EU DMP boilerplate for Turkey; for pure GDPR/HIPAA use alterlab-research-ethics. Part of the AlterLab Academic Skills suite. |
| license | MIT |
| allowed-tools | Read Write Edit Bash(python:*) |
| compatibility | No API key required — generates KVKK data management plans from primary mevzuat (Law 6698) encoded in references/; the optional scaffold runs via `uv run python` on the standard library only |
| metadata | {"skill-author":"AlterLab","version":"1.0.0","last_updated":"2026-06-06","depends_on":"alterlab-tr-research-ethics (etik kurul routing), alterlab-aperta (TÜBİTAK open-science / VYP)"} |
KVKK Data Management Plan — Compliance Scaffolding for Turkish Research Data
Generates a KVKK (Kişisel Verilerin Korunması Kanunu — Turkey's Personal
Data Protection Law, No. 6698) data management plan for empirical research, and
audits EU/GDPR DMP boilerplate for the points where Turkish law diverges.
KVKK applies to essentially all Turkish empirical research that touches
personal data, yet it is not GDPR: the lawful-basis menu is narrower, the
research exemption works differently, and registration (VERBIS) and
cross-border rules are Turkey-specific. This skill encodes those divergences so
a researcher does not silently reuse an EU plan that is non-compliant in Türkiye.
All article references trace to the primary text of Law 6698
(mevzuat.gov.tr) and the official KVKK English translation; the substantive
divergences are tabulated in references/kvkk_vs_gdpr.md. Anonymization
techniques and the re-identification trap are in
references/anonymization_methods.md. Article-level detail with the exact
exemption wording is in references/kvkk_articles.md.
When to Use This Skill
Use this skill when the request is about Turkish data-protection compliance
for research data — producing or fixing a data management plan under KVKK,
deciding whether a dataset can ride the anonymization exemption, choosing a
lawful basis (açık rıza — explicit consent — vs. an Art. 5/6 alternative),
planning retention and deletion at purpose-end, checking whether VERBIS
registration is required, or assessing a cloud/overseas transfer under Art. 9.
Typical triggers:
- "KVKK uyumlu veri yönetim planı hazırla" (prepare a KVKK-compliant DMP)
- "Anonymize this research dataset so it falls under the KVKK research exemption"
- "VERBIS kaydı gerekli mi?" (is VERBIS registration required?)
- "I have an EU Horizon DMP — make it KVKK-compliant for my Türkiye site"
- "Can I store this survey data on a US cloud under KVKK?"
- "We collect health/biometric data — what does Art. 6 require?"
Does NOT Trigger
Route adjacent requests to the correct sibling skill instead of forcing this one:
| The user actually wants… | Route to | Why not this skill |
|---|
| GDPR / HIPAA / non-Turkish data-protection compliance | alterlab-research-ethics | This skill is KVKK-only; the international ethics/privacy skill owns GDPR/HIPAA |
| An etik kurul (ethics committee) application or which committee is needed (anket/TİTCK) |
