// GLOSSARY

KVKK

Law No. 6698 on the Protection of Personal Data; the core legislation regulating the processing of personal data in Turkiye. Its Article 3 definitions (data controller, data subject, explicit consent, personal data) and the Article 10 disclosure obligation form the ground for both a website's privacy notice and assurance-line design. From the offensive-security side, KVKK is not a legal detail outside the technical work but a constraint that must be designed into it. A social-engineering simulation processes employee data; a penetration test may touch personal data in production; each such contact is a processing activity and requires the written frame of controlled execution to be aligned with KVKK obligations. The practical consequence is clear: when the test scope is set, which personal data will be seen, how it will be stored, how it will be destroyed at the end of the test, and on what legal basis it will be processed are all decided in advance. Compliance is not a note appended to the end of the report but part of the Rules of Engagement (RoE); it works conceptually in parallel with the GDPR.