What to do when an employee requests deletion of their personal data? A step-by-step KVKK deletion request guide
When a current or former employee requests deletion of their personal data, you need to log the request, verify the person's identity, separate what can be deleted from what must be legally retained, and respond with the outcome. This guide walks through the process step by step.
Turkey's Personal Data Protection Law No. 6698 (KVKK) gives individuals the right to request the erasure of their data. When a request comes from an employee or a former employee, the job is more than deleting one user: the same person's data sits in different places, such as email, files, sign-in logs and invoices. Some of it must be deleted, while some must be retained under legal obligations.
Deletion request step by step
- Record the request. Note the date, the channel it came through and its scope. Under the law, requests must be concluded within 30 days at the latest.
- Verify the person. Make sure the request really comes from the data subject.
- Work out where the data is. User account, contact details, sessions, mobile device records, forms, and personal settings in the products.
- Separate the data to delete from the data to retain. Data that must be retained by law, such as accounting and security records, is not deleted; its link to the person is limited to an anonymous ID.
- Carry out the deletion in a single action. Deleting piece by piece leaves personal data behind in any system that is overlooked.
- Reply with the outcome and keep a record. Note what was deleted and what was retained and why; the record itself must not contain personal data.
What's deleted, what stays?
| Data | Action |
|---|---|
| Name, username, email, phone, password | Deleted |
| Active sessions, mobile device records, invitation links | Deleted |
| Contact form messages written by the person | Deleted |
| Company business records (files, email, orders) | Remain in the organization; the person appears as “Deleted person” |
| Security audit and invoice records | Retained under an anonymous ID for the legal period |
Deletion versus removal from the organization
If an employee has only left the company and has not asked for their data to be deleted, it is enough to disable their access; the records may be needed later. Deletion cannot be undone; carry it out only when there is a request.
How does DBLinx handle a deletion request?
- Single action: The organization administrator clicks “Delete person and personal data (KVKK)” on the person's card in the organization dashboard, then types the person's username to confirm.
- Deleted centrally: The person's name, username, email, phone and password in their DBLinx account are deleted; their account is closed in all products and their sessions are ended.
- In the products: In SmartPass, the person's name and personal details are anonymised, their photo is deleted and their card is cancelled. In SmartFiles, AI chats are deleted and the share links they created are closed; files remain in the organization.
- Retained: Security audit records and order and invoice records are kept under an anonymous ID for the legal period.