# Build your software to meet KVKK and ISO 27001 expectations. > Secure SDLC, access and logging design, data inventory and ISO 27001 audit preparation for software teams, from an ISO/IEC 27001:2022 certified firm. Source: https://www.algofact.tech/en/services/technology-assessment/kvkk-iso27001-compliance Language: en-US Updated: 2026-10-26 Languages: en-US, tr-TR ALGOFACT helps software teams align the systems they build and run with Türkiye’s data protection law (KVKK, Law No. 6698) and ISO/IEC 27001:2022: a secure development lifecycle, access and logging design, a system-level personal data inventory and evidence preparation before an audit. Our own information security management system is ISO/IEC 27001:2022 certified. We are not a certification body or a law firm; legal advice comes from your own counsel. ## Key facts - **Legal framework:** KVKK, Law No. 6698 [1] - **Standard:** ISO/IEC 27001:2022 [2] - **ALGOFACT’s status:** ISO/IEC 27001:2022 certified - **Focus:** Software systems and development teams - **Our role:** Technical design, implementation and evidence - **Out of scope:** Certification and legal opinions ## When is this the right engagement? This engagement fits when your company is preparing for ISO 27001 certification but the software team does not know what the auditor will ask, when a customer’s vendor security questionnaire asks where personal data is stored and the answer lives in a few people’s heads, or when a product that serves users in Türkiye was designed without KVKK in mind. The focus is the software itself rather than policy documents: code, infrastructure, access, logs and the development process. International teams often meet KVKK when they enter the Turkish market or work with a Türkiye-based vendor. Many of its technical measures overlap with what the GDPR already asks for, but the details differ, for example on cross-border transfers and registration with the data controller registry (VERBİS). Your counsel decides what applies; we turn those decisions into working controls. Accredited certification bodies issue ISO 27001 certificates, and interpreting KVKK obligations is your counsel’s job. We fill the technical gap between the two: we design how the controls an auditor or lawyer expects are implemented in software, build them and make them provable. Going through our own ISO/IEC 27001:2022 certification showed us firsthand where software teams struggle in an audit. ## Areas of work Each area produces an answer to a concrete question an auditor or a customer’s security team will ask. ### Secure development lifecycle Security and privacy items in requirements, threat modeling, code review rules, dependency and secret scanning, security testing and release approval, added to the tools you already use such as Git, CI/CD and your issue tracker. ### Access and permission design Application and infrastructure level design for role-based access, least privilege, privileged account management, multi-factor authentication and revoking access when someone leaves. ### Logging and traceability Application logs that record who accessed personal data, when and with which action; tamper-resistant log storage, retention periods and alerts on suspicious access. ### System-level data inventory A technical inventory showing which personal data each application holds in which table, for what purpose and for how long, who it is shared with and whether it is transferred abroad. It feeds the records your legal team maintains. ### ISO 27001 audit preparation Evidence collection for secure development, change management, backup, vulnerability management and supplier security controls, plus a work list for closing gaps before the audit. ## How the engagement runs ### Scope and current state We define which applications, infrastructure and teams are in scope and review your existing policies, procedures and tools. ### Technical gap analysis We compare the software-related controls in ISO/IEC 27001:2022 Annex A, and the technical measures your counsel has identified under KVKK or the GDPR, with the actual state of your codebase, infrastructure and processes. ### Prioritized work list Findings are ranked by risk and effort, and each item gets an owner and acceptance criteria. ### Implementation If you want, we make the fixes with your team: security checks in CI/CD, the access model, logging infrastructure, encryption and backup settings. ### Evidence and handover For each control we prepare the evidence an auditor will see (configuration, log samples, records, procedures) and hand over training and runbooks so your team can keep the process running on its own. ## What you receive ### Gap analysis report Control-by-control current state, findings and risk level. ### Secure SDLC definition A process adapted to your team’s tools, code review rules and a release checklist. ### Access and logging design Role and permission matrix, log schema, retention periods and alert rules. ### Technical data inventory A personal data map at system, table and field level, with data flow diagrams. ### Audit evidence pack Evidence mapped to controls and a record of closed findings. ## What we do and what we do not do - **What we do:** Design and implement software and infrastructure controls, prepare technical evidence and prepare your team for the technical part of audit interviews. - **Certification:** ISO/IEC 27001 certificates are issued by accredited certification bodies. We are not a certification body and we do not guarantee that you will be certified; the audit outcome belongs to the auditor. - **Legal opinions:** Privacy notices, explicit consent, VERBİS registration and cross-border transfers are legal questions for your counsel. We translate the requirements they set into technical design. - **Policy writing:** Writing your full set of information security policies is not the focus of this service. We contribute to technical procedures such as secure development, access, logging and change management. ALGOFACT’s information security management system is ISO/IEC 27001:2022 certified, and the company holds the Kamu Bilişim Yetki Belgesi, which authorizes public-sector digital work in Türkiye. Among the use cases on /work, we built security infrastructure and hospital management system software for Özel Letoon Hastanesi, so we know how these controls work day to day in systems that process sensitive health data. ## Questions ### Do you guarantee that we will get ISO 27001 certified? No. Certification depends on the audit by an accredited certification body. We help you go into the audit prepared by making sure software and infrastructure controls are implemented and evidenced. ### Is our counsel not enough for KVKK compliance? Your counsel determines the obligations and the measures required. A large share of those measures (access restrictions, logging, encryption, retention and deletion periods, a data inventory) has to be implemented in software. We work alongside your legal team and turn their decisions into code and infrastructure. ### We already comply with the GDPR. What changes for KVKK? Much of the technical groundwork carries over, such as access control, logging and data minimization. Differences in areas like cross-border transfer rules and VERBİS registration are for your counsel to assess; we then update the data inventory, data flows and controls to match. ### Does this include penetration testing? The focus of this service is process, design and evidence; penetration testing is a separate piece of work. The gap analysis helps you decide which security tests you need and how often. ### What drives the timeline and cost? The number of applications and teams in scope, how well current processes are documented, the variety of personal data processed, the time left before your audit and whether we or your team make the fixes. The gap analysis can be scoped as a separate phase, and we plan the next steps in writing based on its findings. ## Related - [Technology Assessment](https://www.algofact.tech/en/services/technology-assessment) - [AI consulting](https://www.algofact.tech/en/services/technology-assessment/ai-consulting) - [Cybersecurity](https://www.algofact.tech/en/services/cloud/cybersecurity) - [Quality and information security](https://www.algofact.tech/en/quality) - [Discovery call](https://www.algofact.tech/en/contact) ## Sources 1. [Personal Data Protection Law (Law No. 6698)](https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law), Personal Data Protection Authority (KVKK) 2. [ISO/IEC 27001:2022 Information security management systems](https://www.iso.org/standard/27001), International Organization for Standardization