Don't leave data protection compliance to release week
Decisions about personal data are architectural decisions. Making compliance part of the design lowers its cost.
Türkiye's Personal Data Protection Law No. 6698 comes up in most teams during the final week of the project. At that point compliance turns into a layer of text stuck onto the product afterwards: a disclosure notice gets written, a checkbox gets added, and the job is considered done.
But what the law actually asks for is not text — it is decisions. Which data do you collect, which legal basis do you rely on, how long do you retain it, who do you share it with? The answers to those questions directly shape your data model and your architecture.
Questions to ask during design
- Do we really have to collect this field? (data minimisation)
- On which legal basis are we processing it — explicit consent, or performance of a contract?
- Is the record deleted automatically once the retention period expires?
- How will we handle a request to export or delete user data?
- Is there any transfer abroad, and if so under which mechanism?
Teams that answer these questions at the start of a project write the retention period into the database as a column and hand deletion off to a scheduled job. Teams that try to answer them at the end end up running manual scripts — which is open to both mistakes and audit risk.
