How will we determine retention periods; we cannot keep every document forever.

Keeping everything forever is neither necessary nor compliant. The workable method is a retention-and-destruction policy that sets the statutory period for each type of document — and those periods do not come from one place. The Turkish Commercial Code (No. 6102) requires commercial books and records to be kept for ten years. Tax documents follow the Tax Procedure Law. For personal data, the Personal Data Protection Law (No. 6698) applies a different kind of test altogether: the period laid down in the relevant legislation, or the period the purpose of the processing actually requires.

The policy then settles what is kept for how long, how it is destroyed or anonymised once the period ends, and how retention is extended in the cases that demand it — litigation and audits above all, where destroying on schedule is the wrong answer. That structure is the foundation of both KVKK compliance and control over what the archive costs to keep.