Confidentiality in Translation and KVKK Compliance

In Türkiye the processing of personal data is governed by Personal Data Protection Law no. 6698 (KVKK), and the Personal Data Protection Authority is the supervisory body in this field. When a document containing personal data is handled in the course of translation, the core principles of that framework apply: the data may be processed only for the purpose in hand, kept only as long as necessary, and protected against unauthorised access.

Handing a document over for translation means entrusting it to someone else, and what that trust should be met with is a concrete, traceable confidentiality regime. Confidentiality is not merely a promise to say nothing to anyone; it is the sum of specific steps – who sees the document, how it is transmitted, how long it is kept and how it is destroyed. Once those steps are defined, confidentiality stops being a declaration of good intent and becomes a process that can actually be applied. Below we look at the layers of that process.

The three layers of confidentiality

Confidentiality in translation is not a single undertaking; it is made up of layers that complement one another. Restricted access ensures that only the person who needs the document sees it, a contractual undertaking puts the obligation in writing, and the retention and destruction principle keeps data from being held longer than necessary. The table below summarises these layers.

Layer	What it ensures	What it looks like in practice
Restricted access	Only the person who needs the document sees it	Role-based access
Contractual undertaking	The confidentiality obligation is put in writing	Confidentiality agreement
Retention and destruction	Data is not held longer than necessary	Deletion after a set period
Transfer security	The file is sent over a secure channel	A secure sharing method

Step by step: sending a confidential file the right way

1. Say what is confidential. Stating at the outset which information in the document is particularly sensitive makes the right precautions easier to take.
2. Ask for a confidentiality undertaking if you need one. Where a job involves trade secrets or special categories of personal data, a written undertaking is appropriate.
3. Do not share information that is not needed. Withholding annexes that are not required for the translation is in line with the data minimisation principle.
4. Send it over a secure channel. Use a secure sharing method for the file.
5. Discuss the retention period. Establish how long the file will be kept once the work is finished, and how it will be destroyed.

Purpose limitation and data minimisation

Two core principles of the KVKK framework bear directly on the translation process. Purpose limitation requires the data in a document to be processed only for the purpose of translating it; the data may not be used for anything else. Data minimisation, for its part, means sharing and retaining only the information that is actually needed. So where a document has sensitive annexes that are not part of the translation, not sharing them is both safer and in keeping with the principles.

These two principles turn into a practical habit: share only the document to be translated, only with the person who needs it, and only for as long as necessary. If only a particular section of a contract is to be translated, for example, it is better to share that section than to send the whole document with all its annexes.

Extra care in corporate work

Documents that come from companies involve trade secrets as well as personal data: pricing, contract terms, technical detail. In such documents confidentiality is not only a legal obligation but a commercial necessity. In corporate work a written confidentiality agreement clarifies what each side expects and establishes who answers for what should a dispute arise.

Keeping access restricted matters particularly in work of this kind. The fewer people handle the document, the lower the risk of a leak. Sensitive corporate files should therefore be run with as few people as the job requires, and on role-based access.

Common mistakes

• Not flagging sensitivity. If the critical fields in a document are not pointed out, the precautions they call for are taken late.
• Sending more documents than necessary. Data that has nothing to do with the job creates needless risk.
• Transmitting over an insecure channel. Open channels are the weak point at the transfer stage.
• Skipping the destruction plan. Keeping data indefinitely cannot be reconciled with the data minimisation principle.

Points that come up often

Is a confidentiality agreement necessary for every job? It is not compulsory for every job, but for documents containing trade secrets or special categories of personal data a written undertaking is appropriate, because it makes clear what each side expects.

What happens to my document once the translation is finished? This is something to discuss at the outset. Once it is settled how long the data will be kept and how it will be destroyed, the process is in line with the data minimisation principle.

Do you keep a copy of my document? Retention should be no longer than necessary. When it is established at the outset how long the document will be held after the work is finished and how it will be destroyed, the process is in line with the data minimisation principle.

How can I know that my data will not be used for another purpose? The purpose limitation principle requires the data in a document to be processed only for the purpose of translating it. In work involving trade secrets or special categories of personal data, setting this out in a written confidentiality undertaking puts what each side expects beyond doubt.

Managing access during the translation process

The most concrete measure of confidentiality is how many people see a document. The more people have access to a file, the greater the likelihood of an accidental leak. In sensitive work, access is therefore kept role-based: only those who need the document for that particular job see it, and access ends when the job does. This principle follows as much from common sense as from the legal framework.

Managing access is about channels as well as people. How a document is sent, where it is stored and when it is deleted are all inseparable parts of confidentiality. A secure sharing channel, a defined retention period and destruction at the end of the job: these three together protect the data throughout its life cycle.

Is anonymisation always possible?

In some jobs it may seem sensible to work with part of the personal data in the document masked. In the translation of official documents this is usually not possible, because the integrity and verifiability of the document rest on precisely those identity details. An identity card or a civil registry document loses its function without the name and the number on it. In documents of this kind, confidentiality is therefore achieved not by masking the data but by managing access and retention strictly.

Checklist

• Have you pointed out the most sensitive fields in the document at the outset?
• If one is needed, is there a written confidentiality undertaking in place?
• Have you shared only the documents that are actually to be translated?
• Did you send the file over a secure channel?
• Have the retention period and the method of destruction been settled?

We can plan the confidentiality requirements of your sensitive documents from the outset and take the work forward on a secure process with restricted access. You can send us your file through the quote form, read about how we work on the translation services page, and put any questions about a confidentiality undertaking to us on the contact page.

The account below summarises typical practice; individual institutions may do things differently. We recommend following official announcements for the practice currently in force.