KVKK Compliance in Real Estate Sales (Construction Guide)

In 2026, a single data-security breach can bring a construction firm an administrative fine exceeding ₺17 million. According to the amounts announced by the Personal Data Protection Authority, even the lowest fine starts at ₺85,437. This picture makes KVKK compliance a priority that construction and real estate firms cannot postpone.

In this guide you'll find:

• The types of personal data construction firms process and their risks
• 2026 KVKK fine amounts and the rules of privacy notices and explicit consent
• A practical compliance checklist for the site, sales office and marketing

Note: This content is for general information, not legal advice. Consult a KVKK lawyer for your own processes.

Why is KVKK critical in real estate sales?

Under KVKK, a construction firm is a data controller. In other words, it is the party that determines the purpose and method of processing customer, employee and subcontractor data. This designation imposes direct legal responsibility on the firm.

The risk is not merely theoretical. According to Invekor's 2025 field data, the average administrative fine imposed by the Board rose to the ₺427,000 level. Moreover, the high fines mostly come from cases where more than one obligation was breached at the same time.

Compliance is not just about fear of a fine, but also about trust. A firm that shows it protects data is more trustworthy in the buyer's eyes. In a high-value decision like real estate, this trust directly affects the sale. In this sense, KVKK compliance is not a cost but both risk management and a marketing advantage.

What personal data does a construction firm process?

A construction firm collects a large amount of personal data throughout the sales funnel. Each of these data types falls under KVKK and requires a separate processing basis.

• Prospect (lead) data: Name, phone and preference information from ad forms, the website and trade-fair contacts.
• Customer and contract data: Identity, contact and sales-contract information.
• Financial and title data: Bank details, credit status, payment plan and title-record information.
• Employee and subcontractor data: Identity and personnel data of site staff and subcontractor employees.
• Image and audio data: Security cameras at the site and sales office, and call-center recordings.

This diversity of data shows that a single privacy notice is not enough. According to the Board's approach, separate privacy notices must be given to different groups of people — for example, customers and employees. Therefore, KVKK compliance requires handling each data group with a separate basis and text. To keep customer data organized and traceable, a KVKK-compliant real estate CRM gathers processes in a single panel.

2026 KVKK fine amounts

Fine amounts increase each year by the revaluation rate. According to the rate announced in the Official Gazette dated 27 November 2025, the 2026 increase was 25.49%. The current lower and upper limits are as follows:

• Breach of the privacy-notice obligation: ₺85,437 – ₺1,709,200
• Breach of data-security obligations: ₺256,357 – ₺17,092,242
• Failure to comply with Board decisions: ₺427,263 – ₺17,092,242
• Breach of the VERBİS obligation: ₺341,809 – ₺17,092,242
• Failure to notify a standard contract in a cross-border transfer: ₺90,308 – ₺1,806,177

The route of appeal has also changed. According to information reported by Büken Hukuk, with the 1 June 2024 amendment, objections to Board fines are now made not to the criminal court of peace but to the administrative court; the period is 60 days from notification. In addition, a data breach must be reported to the Board within 72 hours at the latest once it is discovered.

The privacy-notice obligation

The privacy-notice obligation is the data controller's most basic duty. Under Article 10 of KVKK, the individual must be informed when personal data is obtained. The key point is this: the privacy notice is independent of explicit consent and must be given in every case.

According to the framework reported by Erdemir & Özmen, a privacy notice must contain the following minimum elements:

• The identity of the data controller and its representative, if any
• The purpose for which the personal data will be processed
• To whom and for what purpose the data may be transferred
• The method and legal basis of the data collection
• The rights the individual holds

Language matters too. The Board does not credit pages of legal jargon; the customer must easily understand which data is collected and why. For a buyer filling in a form at the sales office, the safest way is to give the privacy notice at that very moment with a plain text. Privacy and consent texts should be prepared specifically for the firm, not from a template; ready-made templates are immediately spotted in an audit.

Explicit consent and İYS: the marketing side

Marketing is the area where fines are issued most often and, in terms of KVKK compliance, the process that must be managed most carefully. Sending a buyer a campaign SMS, email or call counts as a commercial electronic message. Two conditions are required together for this: registration with the Message Management System (İYS) and prior explicit consent.

For consent to be valid, it has specific rules:

• A pre-ticked box is invalid. Consent must be given by the person's free will.
• It must be obtained separately. Contract approval and marketing consent cannot be combined in a single box.
• It must be withdrawable. The person must be able to withdraw consent easily.

Although there are some exceptions for promoting similar products to existing customers, the safe route is always explicit consent. To set up automated messaging flows in line with the rules, İYS integration and a transparent KVKK policy should be part of the infrastructure. We covered the compliant side of marketing automation in more detail in our real estate sales automation guide.

Site and sales office: cameras and biometrics

The area construction firms overlook most is image and biometric data. Security cameras at the site and sales office also process personal data. In these areas a separate camera privacy notice and a visible information sign are mandatory.

Biometric data requires special attention. The Board's Principle Decision dated 29 April 2026 assessed fingerprint and facial-recognition systems used for employee time-tracking. Such special-category data is subject to the principle of proportionality; if a less intrusive method such as a card exists for site entry instead of biometrics, that should be preferred.

On 8 June 2026 the Board also issued separate announcements on the lawful use of security cameras. For this reason, camera locations, recording duration and access rights must be documented. If AI-supported systems are used, explainability also matters; we examined this in our article on AI in sales.

Data sharing and cross-border transfer

Construction projects have many stakeholders. The firm shares data with subcontractors, suppliers, banks and sometimes foreign investors. Each share counts as a transfer and requires a legal basis.

For domestic sharing, a contract and privacy notice may be sufficient. But if data is transferred abroad — for example to a foreign-based cloud server or a foreign partner — the rules tighten. According to information reported by Esenyel Partners, failure to notify the Board of the standard contracts used in a cross-border transfer can result in a fine of up to ₺1.8 million in 2026.

For this reason, data-processing and confidentiality clauses must be added to subcontractor and supplier contracts. Who accesses which data and where the data is stored must be defined in writing.

VERBİS registration and updates

VERBİS is the Data Controllers' Registry. Firms exceeding certain thresholds are required to register. According to Board decision no. 2025/1572, in addition to the general thresholds, the employee-count and balance-sheet thresholds for those processing special-category data were revised.

Registration is not a one-time act. As Invekor emphasizes, whenever the inventory changes, the system must be updated within 30 days. If an update is not made when a new data category is added or a cross-border transfer begins, an "incomplete notification" penalty comes onto the agenda in an audit.

An important warning is this: being exempt from VERBİS does not mean being exempt from other obligations. Privacy notices, data security and a destruction policy apply to every firm.

KVKK compliance checklist for construction firms

The list below summarizes the basic steps of KVKK compliance for a construction firm. Each item closes a separate fine risk.

1. Create a data-processing inventory. Document which data you process, why and where.
2. Prepare separate privacy notices. Write separate texts for customers, employees and visitors.
3. Set up the explicit-consent flow. Separate marketing consent from the contract and make withdrawal easy.
4. Complete your İYS registration. Build a consented database before sending commercial messages.
5. Document camera and biometric processes. Define information signs and access rights.
6. Add data clauses to contracts. Secure subcontractor and supplier sharing in writing.
7. Keep VERBİS up to date. Notify within 30 days as the inventory changes.
8. Run regular internal audits. Review compliance at least once a year.

Keeping document management and customer records in one place makes these steps easier. Document modules help you keep privacy-notice and consent records organized. This compliance layer also secures your work in transaction-heavy stages such as the title-deed transfer process.

Conclusion

KVKK compliance in real estate sales is both a legal requirement and a trust investment for construction firms. The four standout points are:

• A construction firm is a data controller; it is responsible for customer, employee and subcontractor data.
• In 2026 fines can exceed ₺17 million; the risk multiplies with multiple breaches.
• The privacy notice is independent of explicit consent and must be given separately for each data group.
• Marketing, cameras, biometrics and cross-border transfer are the riskiest areas.

To manage your customer and document processes on a KVKK-compliant infrastructure, request a demo from Evon. For more content, explore the Evon Blog page.

Frequently Asked Questions

Related Posts

Title-Deed Transfer in Home Sales (2026 Guide) Real Estate Sales Automation: A Guide with Examples What Do Construction Firms Use a CRM For Differently?