Choosing KVKK-Compliant HR Software: What to Check

HR software holds some of the most sensitive personal data a company processes: identity and contact details, leave and medical documents, performance scores, payslips and conversations between colleagues. When you choose an HR system, how that data is protected matters as much as the feature list.

Türkiye’s Personal Data Protection Law No. 6698 (KVKK) holds the company that buys the software accountable as the data controller. Choosing the tool is your decision, and so is answering for it. Below are the questions worth putting to any vendor.

Start with roles: controller and processor

Because you decide why and how employee data is processed, you are the data controller. A vendor offering the software as a cloud service processes that data on your behalf and is usually the data processor. Article 12 of KVKK, on data security, makes the processor jointly responsible with you for security measures. The relationship should be set out in a written agreement.

Transparency and data minimisation

You must inform employees which data is processed, for what purpose and on what legal basis. Software that lets you switch modules on only when you need them, rather than forcing you to collect everything, supports the principle of data minimisation.

Where is the data hosted?

Transfers of personal data abroad are governed separately by article 9 of KVKK, which was substantially amended in 2024. Using a service hosted outside Türkiye can require additional legal assessment and documentation. So one of the first questions is: in which country and data centre does the data live? Hosting in Türkiye removes much of the uncertainty here.

Ask about backups and supporting services too

Even if the main database is in Türkiye, ask separately whether backups, email delivery services or built-in AI features move data elsewhere. With AI features in particular, whether employee and task data is sent to a third-party service can be decisive for cross-border transfer.

Access rights and data isolation

KVKK’s proportionality principle means each user should see only what their job requires. A manager doesn’t need everyone’s performance scores or medical notes. Ask:

• Are permissions defined by role and permission?
• Can each permission be limited by scope — own records, team, department, whole company?
• In the cloud service, is each company’s data strictly separated from others?

Employee rights and the data lifecycle

Article 11 of KVKK gives employees rights such as learning whether their data is processed, asking for corrections and, where the conditions are met, requesting deletion. The software you choose should make answering these requests easy: you should be able to find a person’s data, correct wrong records and delete or anonymise when required.

The data lifecycle doesn’t end when someone leaves. A retention and disposal policy that sets how long each kind of data is kept should be considered together with the deletion and anonymisation options the software offers. Your policy sets the retention periods; the software should help you apply it.

Technical measures checklist

1. Is sensitive content, such as messages, encrypted in the database?
2. Are backups encrypted?
3. Are sessions short-lived, and can users see and end their active sessions?
4. Are failed login attempts rate-limited?
5. Is there a history of changes on important records?
6. What happens to the data when a deletion request arrives?
7. Can the software be installed on your own servers if needed?

Common mistakes

• Taking “KVKK compliant” at face value. Compliance isn’t a product label; it comes from the tool and your processes together.
• Giving every manager broad access and never narrowing it.
• Not asking where built-in AI features send your data.
• Having no retention and disposal plan for leavers’ data.
• Loading real employee data during a trial; use sample or limited data where you can.
• Leaving the decision to HR alone; IT and legal should be involved too.

How HibritİK answers these questions

The HibritİK security approach maps to the checklist like this:

• Hosted in Türkiye: cloud data is hosted in Istanbul.
• On-premises option: the same software can be installed on your own servers — see cloud and on-premises deployment.
• Access scopes: role- and permission-based access, with each permission limited to Own / Team / Department / Tenant scope, and strict isolation between companies.
• Encryption: chat messages are encrypted at rest in the database, and backups are encrypted.
• Session management: short-lived access tokens and login rate limiting; users can see and revoke their sessions.
• Account deletion: on a deletion request, the account is anonymised after 30 days.
• AI assistant: the task assistant runs on a model hosted on HibritİK’s own servers, and task data is not sent to any third-party AI service. More in AI and data privacy.
• Per-module licensing: unlicensed modules stay hidden, so you only enable what you need.

Sotech Bilgi Teknolojileri is an ISO 27001 certified company. Our notice on personal data processing is on the data protection page.

Conclusion

From a KVKK perspective, the right HR software can clearly answer three questions: where the data lives, who can see what, and what happens when you no longer need it. Explore HibritİK’s leave and performance modules with your own policies — start your 14-day free trial.

Note: this article is general information and not legal advice. Please consult a legal adviser about your KVKK obligations.