Personal data in a graduation yearbook: KVKK, parental consent and what schools need to do

Making a yearbook is one of the nicest things a class can do. But a yearbook holds names, faces and the personal sentences children write to each other. In other words, a yearbook is also a data matter. This article is for school administrators, teachers and parents. The aim is not to frighten anyone, but to explain in plain language how to do it properly.

One important note: what follows is general information and not legal advice. Every school’s situation can be different. When you set up your own process, talk to your school’s legal advisor or to the person it has named as responsible for personal data.

What counts as personal data in a yearbook?

KVKK is the short name of Turkey’s personal data protection law, Kişisel Verilerin Korunması Kanunu, Law No. 6698. It treats any information about an identified or identifiable person as personal data. For a yearbook, that list is long:

• First and last name. It sits at the top of every page.
• Class, school and section. Harmless alone, but combined with a name it says where a child studies.
• Photos. Portraits, class photos, the pictures on a memory wall.
• Messages. Lines written to friends, personal memories, inside jokes.
• Contact details. Phone numbers and e-mail addresses. They do not have to be printed in the yearbook, but they may be collected when people use an app.
• Voice and video memories. A recording of a voice or a face is data too.

In short, almost everything in a yearbook is data. That is not a bad thing; what matters is that it is clear whose data it is and who is responsible for it.

Why parental consent matters for students under 18

A minor cannot fully decide about their own data in law. That is why schools generally rely on informing the parent and getting the parent’s consent in place of the student. Nearly every yearbook, from preschool to high school, falls into this group.

The practical difference is this: a parent should know that their child’s photo goes into a book and a digital version. They should know that their child’s messages will be read by other children. They should know where the data is kept. And they should be able to say no. Consent is not announcing that “your child will be in the yearbook”; it is offering a choice.

Age matters in another way. Middle and high school students are often active participants: they write messages and act as class representatives. Even at these ages the consent sits with the parent, but it is healthier, both educationally and practically, for the student to have a say in the process too. A child who knows what is happening will find it easier to talk to the parent.

Explicit consent vs. privacy notice: the difference in plain words

These two ideas are often mixed up. Let us explain them as if we were at the kitchen table.

The privacy notice

This is the information in which the school says: “This is what we collect, this is why we use it, this is how long we keep it, this is who we share it with, and these are your rights.” No agreement is asked for here; information is given. Giving this information is an obligation of the data controller. The text has to be understandable: four pages of legal language does not count as informing someone.

Explicit consent

This is an agreement given after being informed, on a specific matter, with nobody forcing it. It has three parts: it is about a specific matter, it is based on information and it is given of free will. Saying “you must accept everything to take part in the yearbook” can create a problem on the free-will side.

Not every use of data has to rest on explicit consent; the law recognizes other grounds in some cases. Which use sits on which ground is a legal assessment, and your school’s advisor should make it. But one rule of thumb works in practice: for parts where the yearbook could be made without them, such as photos, asking for a separate and optional consent closes the debate from the start.

Separate consents instead of one signature

The most common mistake is putting everything on a single sheet: “I consent to the processing of data, the publication of photos and the transfer abroad.” Even if a parent wants to say yes to one thing and no to another, they face a single box.

It is better to separate the consents:

1. Data processing: the basic information needed to make the yearbook.
2. Storage abroad: if data sits on a server abroad, this should be asked about as its own matter.
3. Photos: optional. If the parent does not give it, the child should not be left out of the yearbook.
4. Extra check with AI: if a tool is used, this too should be a separate, optional choice.

This structure has another benefit: it builds the parents’ trust. A school that does not say “all or nothing” shows that it takes parents seriously.

Storing data abroad

Many modern apps keep data on cloud servers in other countries. This is not forbidden or bad in itself, but KVKK has separate rules for transfers abroad. The details and the current state of those rules can change, so the school should check them with its legal advisor.

The simple question from a parent’s side is: “Where is my child’s data?” The answer should be clear. If a school or a service provider answers “in the cloud”, that is an insufficient answer. The country, and if possible the city, should be named.

How long is the data kept?

One of the basic ideas in KVKK is that data is kept only as long as the purpose requires. Once the yearbook has been delivered, there is no reason for photos and messages to sit on a server for years.

What the school should do is set a retention period and write it into the privacy notice. It should also be clear what happens when the period ends: is the data deleted or anonymized? Leave this question open, and a year later it turns into a parent asking, “Is my child’s photo still there?”

Parents’ rights and withdrawing consent

Article 11 of KVKK gives people certain rights over their own data. Roughly: to learn whether their data is processed, to ask for information if it is, to learn the purpose and whether it is used accordingly, to know who it is passed to, to ask for correction if it is incomplete or wrong, to ask for deletion or destruction, and to object to a result that harms them. A person who suffers damage can also ask for it to be made good.

For children, these rights are exercised by parents. What matters for a school in practice is knowing in advance who will do what on the day a parent says “I withdraw my consent” or “delete my data”. Who the request goes to, how many days it takes to answer and how deletion works should be written in the privacy notice.

How does Kepyil handle these topics?

Kepyil is a mobile app for making a graduation yearbook together as a class. The points below are what the product actually does today.

• Clear roles. The school is the data controller; Kepyil processes data on the school’s behalf.
• Separate parent consents for students under 18. Data processing, storage abroad, photos (optional) and AI moderation (optional) are each asked separately.
• If photo consent is not given, the student’s initials appear instead of a photo. The student is still in the yearbook.
• Children under 13: a parent uses the app on the child’s behalf and gives consent in the same step. For siblings or twins, the parent can switch between children.
• Class representatives aged 13 and over: when a student under 18 wants to start a yearbook, the parent consents first, and a teacher or a parent joins the process as the responsible adult.
• Servers: in Frankfurt, Germany, which is inside the European Union.
• Phone numbers and e-mail addresses are seen only by teachers and school management. Data is never used for ads and never sold.
• Messages are checked automatically before they appear. Profanity, insults, personal data such as phone numbers, and characters that cannot be printed are caught. With the parent’s consent, an AI model also looks at them with names removed. Unclear ones go to the teacher.
• Students have a say over their own messages: they can hide a message, report it, or block someone.
• Retention: original photos and messages are deleted 12 months after the yearbook is delivered.
• Account deletion: the account closes at once and is fully deleted after 30 days.
• Sign-in: with a one-time code sent by e-mail; there are no passwords.

For more detail on these points, see the safety and privacy pages. We explain how parents take part on the page for parents, and what schools can expect on the page for schools.

One more caution: an app having these features does not remove the school’s own obligations. As the data controller, the school still prepares its own privacy notice, its own retention policy and its own way for people to make requests.

A practical checklist for schools

Before starting a yearbook project, school management and teachers should be able to answer these questions:

1. Who is the data controller? The school or the founding organization? Is there a contract with the service provider?
2. What data will be collected? Name, class, photo, message, contact details. Nothing more than needed should be asked for.
3. Is the privacy notice ready? Is it understandable, short, and in a language parents can read?
4. Are the consents separate? Are optional matters such as photos in their own box?
5. What happens to the child of a parent who does not consent? They should not be left out of the yearbook; an alternative, such as initials, should be ready.
6. Where is the data stored? Are the country and city known? For storage abroad, has a separate consent and a legal check been done?
7. Is the retention period written down? How will deletion work at the end?
8. Who sees what? Contact details should be visible only to the adults who need them.
9. Is there a clear way to make a request? If a parent wants to withdraw consent or ask for deletion, who do they write to?
10. Are messages checked? Texts that children write to each other can leak personal information or contain insults or harmful content.
11. Has the legal advisor looked at it? All of these documents should go through the school’s advisor before they are published.

Questions parents can ask the school

If you are a parent and you have received a consent form for the yearbook, you are entitled to ask:

• What information about my child is being collected?
• Who will see the photo? What happens if I do not consent?
• Where will the data be kept, and for how long?
• Whom do I contact if I change my mind?
• Even if the yearbook is not printed, will my child be in the digital version, and who will see it?

A good school will not find these questions uncomfortable, because it already has the answers.

Trust is the yearbook’s invisible page

The best version of a yearbook is one that can be opened comfortably years later. For that, all parents and students need to have been informed from the start and to have been able to choose separately. Knowing that what the class wrote to each other is safe also makes the messages more heartfelt.

If you would like to see the rest of the process, take a look at how to make a graduation yearbook. For younger classes, there is also our guide to the preschool and primary school yearbook. Remember that this article is general information and not legal advice; please ask your school’s legal advisor.