Title: "KVKK Compliance for Events: International Organizer Guide"

Description: "Learn how international event organizers can approach KVKK compliance in Türkiye, from attendee notices and consent to vendors, transfers, security and retention."

KVKK Compliance for Events: A Guide for International Organizers

KVKK compliance for events requires more than adding a consent checkbox to a registration form. International organizers operating in Türkiye must understand what attendee data they collect, why they need it, who can access it, where it is transferred and when it should be deleted.

A single event can generate personal data across registration forms, application reviews, payment systems, attendee communications, QR check-in, photography, online sessions and professional networking. Compliance therefore depends on the complete event journey—not one privacy notice displayed at the beginning.

For international organizers, KVKK event compliance begins with five questions: What data is collected, why is it needed, who receives it, where does it travel and when is it deleted?

This guide provides an operational framework for examining those questions. It is intended for general information and does not replace legal advice concerning a specific event, organization or processing activity.

What Is KVKK, and Why Does It Matter for International Events?

The KVKK is Türkiye’s Law No. 6698 on the Protection of Personal Data. It establishes rules governing the collection, use, disclosure, storage and protection of information relating to identifiable individuals. The law also gives individuals rights concerning how organizations process their personal data.

For an event organizer, attendee data protection can apply long before participants arrive at a venue. Personal data may be collected when someone visits an event page, submits an application, joins a waiting list, purchases a ticket, requests an accommodation or creates a professional networking profile.

Processing can continue during and after the event through check-in records, photographs, session attendance, feedback forms, connection requests and future communications. Organizers should therefore assess each activity separately rather than treating “event registration” as one broad purpose covering every possible use.

Personal Data Commonly Collected During Events

Personal data includes information that identifies a person directly or makes them identifiable when combined with other information. In an event context, this can include ordinary registration details as well as information produced through the attendee’s participation.

Common categories include:

• Names and contact details
• Employer names and job titles
• Professional biographies
• Session or workshop selections
• Application responses
• Payment and invoicing details
• QR check-in and attendance records
• Photographs and video recordings
• Networking interests and meeting preferences
• Messages and connection requests
• Survey responses
• Marketing preferences
• Device, access and platform log data

Not every field carries the same level of risk. A name and business email address may be necessary to administer registration, while a networking biography, photograph or statement about whom the participant wants to meet may be optional.

A practical event registration privacy review should therefore distinguish required information from optional profile data. Organizers should also document which employees, suppliers, sponsors or technology providers can access each category.

When Event Data May Become Sensitive

Some event forms collect information that may reveal health conditions, disabilities, religious beliefs or other protected characteristics. An accessibility request, for example, may contain health-related information. A dietary request may reveal a medical condition or religious practice depending on how the question is framed and answered.

Organizers should not request detailed medical histories when a simple accommodation instruction would be sufficient. A field such as “Tell us what support you need to participate” may be more proportionate than asking attendees to disclose a diagnosis.

Editorial Example: Optional Accessibility Field

A registration form could make the field optional, explain that the information will be used only to arrange appropriate support and restrict access to staff members who need it for that purpose.

Sensitive Data Review Rule

Any workflow involving health information, disability details, biometric identifiers, identity documents, religious information or criminal records should undergo additional legal and security review before registration opens.

Does KVKK Apply to an Overseas Event Organizer?

An organization does not necessarily fall outside Türkiye’s data protection framework simply because its headquarters or event technology provider is located abroad. International organizers should examine the event’s connection with Türkiye, the people whose information is collected and the entities that determine how attendee data will be used.

Relevant factors may include where the event takes place, where attendees are located, whether a Turkish venue or agency is involved, which company controls the registration journey and whether information is accessed from or transferred to another country.

Because applicability can depend on the facts, organizers should avoid relying on a general assumption that either all overseas events are covered or all foreign organizations are exempt. Events involving participants, suppliers or processing activities connected with Türkiye should be assessed under current legislation and guidance from the Turkish Personal Data Protection Authority.

Identify the Data Controller, Processors and Other Parties

The data controller generally determines why personal data is processed and how the essential processing activities are carried out. A processor handles data on the controller’s instructions. These labels depend on actual decision-making, not merely the terminology used in a contract.

For example, the lead organizer may decide which registration fields are required, how applications are evaluated and whether attendee information is shared with sponsors. A registration platform may process that information to provide the contracted service. However, a sponsor receiving attendee details for its own sales activities may have separate responsibilities.

A clear role map allows the organizer to assign responsibilities, prepare accurate notices and identify where contracts or additional safeguards may be required. The next step is to convert that role map into a complete inventory of data collected before, during and after the event.

Build a KVKK-Compliant Event Data Map

A reliable compliance process begins with a complete map of the information collected throughout the event lifecycle. Without this map, organizers may overlook temporary spreadsheets, sponsor exports, check-in devices, survey tools or networking profiles that continue processing personal data outside the main registration platform.

The data map should connect every data element to a defined purpose, processing condition, recipient, storage location and retention trigger. This allows the organizer to identify unnecessary fields, inconsistent notices and international data flows before registration opens.

Map Data Across the Event Lifecycle

Event data is rarely processed in one system or at one moment. An attendee may first provide an email address to register interest, later submit a full application, receive an online-event link, check in with a QR code and complete a post-event survey.

The organizer should review each stage separately:

• Pre-event discovery and registration
• Application review and approval
• Waiting-list management
• Ticket payment and invoicing
• Announcements and reminders
• Online-event access
• On-site check-in
• Networking participation
• Photography and recording
• Surveys and feedback
• Sponsor or partner interactions
• Post-event follow-up
• Future marketing
• Deletion, anonymization or archival

A practical inventory might look like this:

The “possible processing condition” column should not be completed through assumptions. Organizers should confirm the appropriate legal basis for each activity under the current KVKK framework and document the reasoning.

Choose the Correct Processing Ground

One of the most common mistakes in KVKK compliance for events is treating explicit consent as the default basis for every activity. The KVKK provides multiple processing conditions, and the appropriate condition depends on the purpose, necessity and circumstances of the processing.

For example, collecting information needed to administer a confirmed registration may require a different analysis from publishing a participant profile, sharing details with a sponsor or sending future marketing communications. Organizers should assess each purpose independently instead of placing every activity under one broad consent statement.

When Explicit Consent May Be Relevant

Explicit consent may be relevant where participation in a separate, optional activity depends on the attendee’s affirmative choice. Examples may include optional networking visibility, certain promotional uses of photographs, some sponsor disclosures or processing that cannot rely on another applicable condition.

However, consent should not be requested merely because it appears to be the safest option. A consent request may be inappropriate where the attendee cannot make a genuinely free choice or where the processing is already necessary under another valid condition.

Where consent is used, the request should be specific, informed and clearly separated from unrelated purposes. It should also be possible to understand what will happen if the attendee does not agree.

Why Bundled Consent Creates Risk

A person should not have to accept unrelated marketing, sponsor sharing or public-profile visibility simply to register for an event. Bundled wording makes it difficult to determine whether the attendee understood and freely accepted each purpose.

This separation also improves the attendee experience. Participants can make informed decisions without being forced to abandon the entire registration journey because they disagree with one optional use.

Privacy Notice and Consent Are Not the Same Thing

A privacy notice explains how personal data is processed. Consent, where relied upon, is a legal mechanism based on an affirmative choice. Displaying a notice does not mean the attendee has consented to every activity described in it.

The registration interface should therefore distinguish between:

• Information the attendee must receive
• Contractual or participation terms
• Optional permissions
• Marketing preferences
• Networking visibility choices
• Photography or recording selections

A notice acknowledgment may confirm that information was presented, but it should not be worded as though reading the notice automatically authorizes all processing.

Prepare an Event Privacy Notice Attendees Can Understand

An event privacy notice should explain the processing journey in language that an international participant can understand. It should identify the controller, describe the purposes of processing and explain how information may be shared, transferred, retained and accessed.

A layered format is often more usable than placing a long legal document beneath the registration button. The registration page can present a concise summary with a link to a detailed notice, while optional features such as networking or sponsor interactions can include additional explanations at the point of choice.

Information the Notice Should Address

Subject to current legal review, the notice should cover:

• Identity of the data controller
• Categories of personal data collected
• Purposes of processing
• Collection methods
• Applicable processing conditions
• Categories of recipients
• International-transfer information
• Retention approach
• Data-subject rights
• Contact or request channel
• Differences between registration, networking and marketing

The notice should reflect the event’s real data flow. Generic text copied from another event may omit important vendors, transfer locations or optional uses.

Place Notices at the Right Moment

Transparency should continue throughout the event journey. Relevant notices or explanations may be needed when a participant creates a profile, activates networking, agrees to sponsor contact, enters a recorded session or signs up for future communications.

For permission-based networking, the interface should clearly explain which profile details may be visible, who may receive recommendations and how participants can control their involvement. This approach supports event registration privacy by separating core attendance from optional professional discovery.

Manage Attendee Networking Without Exposing Everyone

Publishing a complete attendee directory may create unnecessary privacy risks. Participants may not expect their names, roles, employers, profile details or contact information to be visible to every attendee, sponsor or external party. Public-by-default lists can also encourage scraping, unsolicited outreach and uses that fall outside the original purpose of event participation.

A more privacy-conscious model limits visibility and gives participants meaningful control over whether they join networking activities. Organizers should define which information is required for attendance, which fields are optional and which profile elements may be used to recommend relevant professional connections.

Use Permission-Based Networking and Limited Visibility

Permission-based networking does not require exposing every participant to everyone else. Instead, organizers can configure networking settings while attendees decide whether to participate and which professional details they provide.

MeetWho supports this model by recommending relevant people among users who have permitted networking participation. Rather than presenting an unrestricted public attendee list, the platform can rank potential connections and explain why two people may benefit from meeting, how they could help each other and how a conversation might begin.

Participants can send introduction requests and message one another after a mutual connection. They can also add private notes, create follow-up reminders and manage their connection history after the event. Paid access does not reveal hidden profiles or private contact details, and MeetWho does not sell attendee lists.

These capabilities can support attendee data protection, but they do not make an event automatically compliant. The organizer must still determine the relevant purposes, processing conditions, notices, visibility rules and retention practices.

Apply Data Minimization to Professional Profiles

A professional networking profile should collect only information connected with the stated networking purpose. Organizers should avoid turning optional discovery features into mandatory registration requirements unless those fields are genuinely necessary for the event.

A practical distinction is to separate:

• Required registration details
• Optional professional biography information
• Optional networking goals and interests
• Organizer-only administrative information
• Private notes visible only to the participant
• Contact details that should not be disclosed by default

This separation helps attendees understand how their information will be used and reduces the risk of collecting excessive data.

Review International Data Transfers Before the Event

An international transfer may occur when attendee data is stored abroad, accessed by overseas support personnel or shared with a foreign group company, sponsor, CRM provider or communications platform. Organizers should assess these flows before selecting vendors or opening registration.

The legal framework governing international data transfers under the KVKK should be checked against the legislation and Turkish Data Protection Authority guidance in force at the time of publication. Organizers should avoid relying on outdated templates or assuming that a vendor’s global privacy policy is sufficient.

Questions to Ask Every Vendor

Vendor due diligence should cover both storage and remote access. A system hosted in one country may still be supported, backed up or monitored from several others.

Key questions include:

1. In which countries is attendee data stored?
2. From which countries can staff access it?
3. Which subprocessors are involved?
4. What transfer mechanism is being relied upon?
5. What contractual safeguards apply?
6. Can data location or support access be configured?
7. How are security incidents reported?
8. What happens to backups after deletion?
9. Can the vendor assist with attendee requests?
10. What documentation is available for review?

Organizers should record the answers in a transfer register that identifies the exporter, recipient, countries involved, data categories, purposes, transfer mechanism, supporting documents and review date.

Select and Contract Event Technology Vendors

Event technology should be assessed against the organizer’s actual workflow rather than a generic compliance badge. A registration or networking platform may process identity details, profile information, attendance records, communications and interaction data, making its contractual and technical arrangements especially important.

The organizer should clarify whether the vendor processes data only on documented instructions or uses any information for its own purposes. Contracts should also address confidentiality, subprocessors, security controls, incident notification, attendee requests, deletion and the return of data when the service ends.

Questions to Ask an Event Platform

A practical platform review should establish whether the organizer can:

• Separate required registration fields from optional profile fields
• Approve applicants or manage a waiting list
• Restrict online-event links to registered attendees
• Make networking participation optional
• Configure networking privacy settings
• Limit communications to relevant attendee groups
• Revoke participant or staff access
• Use controlled QR check-in
• Export or delete records according to an internal process
• Protect contact details from unrestricted visibility

MeetWho combines event pages, registration, application approval, waiting-list management, registered-attendee access, announcements, reminders, QR check-in and privacy-configurable networking in one platform. These features may reduce fragmented data handling, but the organizer remains responsible for how they are configured and used.

Protect Data Before, During and After the Event

Security should cover people, processes and technology. Before the event, organizers should review staff permissions, train temporary teams, test registration flows and confirm which vendors can access attendee information.

During the event, check-in devices should be secured, administrator accounts limited and printed lists avoided where possible. Staff should not move participant data into unmanaged spreadsheets, personal messaging applications or shared drives merely for convenience.

After the event, unnecessary access should be removed, temporary exports deleted and retention rules applied. Organizers should also review photographs, recordings, sponsor disclosures, survey data and future marketing lists separately rather than treating all post-event information as one permanent archive.

Set Defensible Retention and Deletion Rules

A retention policy should connect each record to a purpose and a clear deletion trigger. “Keep everything in case it becomes useful” is not a defensible approach.

Fixed legal periods should not be inserted without checking current requirements. The organizer should document who owns each retention decision and how deletion applies to live systems, exports and backups.

Prepare for Attendee Rights and Complaints

Every international event should have a practical process for responding to attendee privacy requests. A privacy notice alone is not enough if the organizer cannot identify where attendee information is stored or coordinate with vendors responsible for different parts of the event journey.

Registration records, QR check-in logs, networking profiles, survey responses and communication histories may all reside in separate systems. Before registration opens, organizers should know which party can search, export, correct or delete each category of information and how requests will be documented.

Rights-Request Workflow

A structured workflow helps organizers respond consistently while maintaining an audit trail.

1. Receive the attendee's request through the designated contact channel.
2. Verify the requester's identity using a proportionate method.
3. Record the request and applicable internal deadlines.
4. Identify every system and vendor holding relevant information.
5. Assess the request under the current KVKK framework.
6. Coordinate with processors and service providers where necessary.
7. Respond through the appropriate communication channel.
8. Document the outcome for accountability purposes.

Where multiple vendors are involved, responsibilities should be defined before the event. Waiting until a request arrives often results in delays, duplicate work and inconsistent responses.

Coordinate Requests Across Vendors

An attendee's information may exist in several environments simultaneously. For example:

• Registration platform
• Email communication provider
• QR check-in system
• Networking platform
• Survey software
• CRM
• Payment provider
• Internal spreadsheets created for event operations

Organizers should maintain an internal record identifying which vendor is responsible for each processing activity and who should be contacted if attendee information needs to be corrected, exported or deleted.

Common KVKK Mistakes Event Organizers Should Avoid

Even well-organized events can introduce unnecessary privacy risks through everyday operational decisions. Many issues arise not because organizers intentionally misuse personal data, but because workflows evolve without reviewing whether they remain consistent with the stated purposes of processing.

The following mistakes are among the most common:

1. Treating explicit consent as the only lawful processing condition.
2. Combining registration, marketing, sponsor sharing and networking into one checkbox.
3. Publishing a complete attendee directory by default.
4. Collecting profile information that is not needed for the event.
5. Sharing attendee details with sponsors without appropriate transparency and legal assessment.
6. Ignoring overseas hosting or remote support access.
7. Keeping exported spreadsheets long after the event has finished.
8. Giving administrator privileges to everyone on the event team.
9. Copying participant data into unmanaged collaboration tools.
10. Assuming a technology vendor's compliance claims automatically satisfy the organizer's obligations.
11. Failing to distinguish between operational communications and promotional marketing.
12. Launching registration before mapping the event's complete data flow.

Avoiding these mistakes not only reduces legal risk but also improves attendee trust. Participants are more likely to engage with networking features and professional profiles when they understand how their information will be used and who can access it.

KVKK Event Compliance Checklist for International Organizers

Use the following checklist before opening registration and revisit it after the event to evaluate your processes.

Governance and Scope

• Identify every organization involved in the event.
• Determine controller and processor roles.
• Map processing activities connected with Türkiye.
• Assign an internal privacy owner.
• Obtain Turkish legal advice where appropriate.

Registration and Transparency

• Collect only information that is necessary.
• Clearly distinguish required and optional fields.
• Publish an event-specific privacy notice.
• Separate privacy information from consent where applicable.
• Review registration wording for clarity.
• Avoid pre-selected optional permissions.

Networking and Participant Visibility

• Decide whether networking participation is optional.
• Define which profile fields are visible.
• Avoid unrestricted attendee directories.
• Protect personal contact information.
• Explain how introductions and messaging work.
• Allow participants to manage relevant permissions.

Vendors and International Transfers

• Document all event vendors.
• Review hosting and access locations.
• Identify subprocessors.
• Assess international transfer requirements.
• Execute appropriate contractual arrangements.
• Confirm deletion and incident procedures.

Security and Retention

• Apply role-based access controls.
• Secure QR check-in devices.
• Train staff handling attendee information.
• Define retention triggers.
• Remove temporary exports after use.
• Test internal request procedures.
• Conduct a post-event compliance review.

How MeetWho Supports a More Privacy-Conscious Event Workflow

Privacy-conscious event management starts with clear operational processes. Fragmented tools often create duplicate attendee lists, inconsistent permissions and multiple exports that become difficult to monitor after the event.

MeetWho brings event creation, attendee registration and participant management into a single workflow. Organizers can create event pages for free, collect registrations, approve applications, manage waiting lists, share online event access only with registered participants, send announcements and reminders, perform QR check-in and configure networking privacy settings from one platform.

For networking, MeetWho follows its Event Networking Intelligence approach. Participants build professional profiles describing what they are working on, what they are looking for, whom they hope to meet and how they can help others. Rather than displaying an unrestricted attendee list, MeetWho analyzes these signals alongside shared interests and event objectives to recommend relevant connections among participants who have permissioned networking.

Each recommendation explains why the introduction may be valuable and suggests ways to start the conversation. Participants can send introduction requests, message each other after a mutual connection, keep private notes, create follow-up reminders and manage their networking history after the event. Paid membership does not provide access to hidden profiles or private contact details, and MeetWho does not sell attendee lists.

These capabilities can support operational privacy goals, but they do not replace legal analysis. Every organizer remains responsible for determining processing purposes, preparing appropriate notices, assessing legal grounds, managing vendors, reviewing international transfers and implementing retention policies.

Frequently Asked Questions About KVKK Compliance for Events

Is attendee consent always required under KVKK?

No. Explicit consent is not automatically required for every event-related processing activity. Organizers should determine the appropriate processing condition for each purpose under the applicable KVKK framework instead of assuming that consent is always the correct approach.

Does KVKK apply to an event organizer based outside Türkiye?

It may, depending on the event's connection with Türkiye, the processing activities involved and the organizations participating in those activities. International organizers should assess their specific circumstances and obtain qualified legal advice where appropriate.

Can we publish a list of everyone attending the event?

Not by default. Organizers should evaluate the purpose, participant expectations, transparency and applicable legal requirements before making attendee information visible. Permission-based networking generally provides a more privacy-conscious alternative than unrestricted attendee directories.

Can attendee data be stored outside Türkiye?

International storage or remote access requires careful assessment under the current KVKK transfer framework. Organizers should review vendor arrangements, transfer mechanisms and applicable legal requirements before transferring attendee information abroad.

Can registration data be used for future marketing?

Event administration and future promotional communications are different purposes. Organizers should assess each activity separately and ensure their communications comply with applicable privacy and electronic communications requirements.

Are photographs and event recordings covered by KVKK?

They may be if identifiable individuals are recorded. Organizers should establish appropriate transparency measures, define the intended purpose, determine access permissions and apply suitable retention practices.

What should an event privacy notice include?

A privacy notice should explain the controller's identity, processing purposes, categories of personal data, collection methods, recipients, international transfers where applicable, retention approach, attendee rights and contact information.

Is a QR check-in system automatically KVKK-compliant?

No. Compliance depends on how the system is configured, what information is processed, who can access it, how long records are retained and whether appropriate security measures are implemented.

Is MeetWho automatically KVKK-compliant for every event?

No. MeetWho provides configurable event management, registration and permission-based networking capabilities, but compliance depends on how organizers configure their event, define processing purposes and meet their legal responsibilities.

How early should organizers begin KVKK planning?

Ideally, privacy planning should begin during event design and vendor selection—before registration forms, sponsor agreements, networking features or attendee communications are launched.

Final Takeaway: Design Privacy Into the Event Journey

KVKK compliance for events is most effective when privacy is built into the event from the beginning rather than added after registration has already started. Mapping personal data, defining processing purposes, reviewing vendors and documenting responsibilities help organizers reduce operational risk while creating a more transparent attendee experience.

Privacy and networking do not have to compete. When participants understand how their information will be used and have meaningful control over their visibility, they are more likely to engage confidently with the event community.

Whether you are organizing a conference, community meetup, accelerator programme, workshop or hybrid event in Türkiye, designing your event around transparency, proportionality and participant trust creates a stronger foundation for long-term success.

---

Create Your Event with MeetWho

Create Your Event for Free

Build an event page, collect registrations, manage applications and waiting lists, communicate with attendees, perform QR check-in and configure permission-based networking—all from a single platform designed to help people know who to meet.

👉 https://meetwho.app/

---

Sources and Further Reading

• Republic of Türkiye – Law No. 6698 on the Protection of Personal Data (KVKK)
• Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu – KVKK): https://www.kvkk.gov.tr/
• Official guidance and decisions published by the Turkish Personal Data Protection Board
• Official Gazette of the Republic of Türkiye
• Current Turkish Data Protection Authority guidance on international data transfers, explicit consent and privacy notices (verify the latest versions before publication)