How-to
Resolving a KVKK Data Request
Taking up a user's request for a copy, a correction or the deletion of their data, doing what it asks and telling the person the outcome.
Users open a request under KVKK (Türkiye's Personal Data Protection Law) on the My profile → Privacy & KVKK tab. The requests arrive on the Administration → Data requests (KVKK) screen. Open requests are also counted on the Open data requests card of the Overview screen.
- To show that you are handling the request, press Start review on its row.
- Do what the request asks, depending on its type. What to do for each type is described below.
- Press Resolve on the row.
- In the Outcome list, select Completed or Rejected.
- In the Explanation (shown to the person) field, write what you did or why you rejected the request, in at least 5 characters.
- Press Resolve in the window.
The explanation appears in the request history on the person's Privacy & KVKK tab. Every status change of the request is written to the audit log, and the log keeps who resolved the request and when.
Steps for each request type
| Request | What to do |
|---|---|
| A copy of my data | Download the file with the Download data (JSON) button on the row and pass it to the person through a secure channel. |
| Correction of my data | Make the correction the person describes in their note. You change the name and e-mail address on the user page. |
| Deletion of my account and data | Anonymise the account from the user page, then resolve the request. |
The Open user link in the resolution window of a deletion request opens the user's page. Anonymisation is explained in Anonymising an Account, and changing the name and e-mail address in Managing User Accounts.
Data copy file
The Download data (JSON) button downloads the account's personal data in a single JSON file. The file contains the following.
- account and profile details, roles and sessions
- KVKK requests, notifications and saved publications
- the newsletter subscription and contact messages
- the person's submissions, the submissions they co-authored and their review invitations
- the messages the person sent on submissions, their editor assignments and their production comments
- the linked catalogue person, the account's events and the actions the person took on other records
Passwords, one-time links and two-factor authentication keys are not in the file. E-mail texts and the texts of review reports are not included either, so a reviewer's later addendum to a submitted report is listed without its text. An action shows only its name, its time and the type of record. The changed values and the reason for the action are not in the file. Other people's messages and comments are not in it either.
The account's events, the actions, the messages, the editor assignments and the comments are limited to the newest
2000 rows. If a list was shortened, the export.truncated field at the top of the file gives the list's name, the
number of rows in the file and the total number of rows. When the field is empty, the file is complete.
Every download is written to the audit log. The button appears only on copy requests that were not rejected.