Every company, association or public body that processes personal data in Turkey is a data controller under the Personal Data Protection Law No. 6698 (KVKK): it must rely on one of the statutory legal grounds, inform data subjects, take appropriate security measures and, where required, register with VERBİS. Since 1 June 2024, transfers of personal data abroad follow a tiered system of adequacy decisions, appropriate safeguards such as standard contracts, and occasional transfers, broadly similar to the GDPR. Fines imposed by the Data Protection Board are now challenged before the administrative courts. Individuals must first apply to the data controller and may then complain to the Board.
What is the KVKK and who does it apply to?
The Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK) governs the processing of any information relating to an identified or identifiable natural person, such as names, phone numbers, email addresses, IP addresses, camera footage and health information. "Processing" is defined very broadly and covers obtaining, recording, storing, altering, transferring, classifying and deleting data.
The law has three main actors:
- Data subject: the natural person whose data is processed (customer, employee, visitor, candidate).
- Data controller (veri sorumlusu): the person or entity that determines the purposes and means of processing, in most cases the company itself.
- Data processor (veri işleyen): a person or entity processing data on the controller's behalf and instructions, such as a cloud provider, payroll firm or call centre.
The law is enforced by the Personal Data Protection Authority and its decision-making body, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). Offences relating to personal data are separately defined in Articles 135–140 of the Turkish Criminal Code.
KVKK and the GDPR
The KVKK was modelled largely on the EU's former Data Protection Directive, and the 2024 amendments brought it closer to the GDPR, especially on special categories of data and cross-border transfers. Companies already compliant with the GDPR therefore start from a good position, but there are differences that matter in practice:
- The KVKK does not contain an express territorial scope provision like Article 3 of the GDPR, but processing connected with Turkey, such as a Turkish subsidiary's data or the data of people in Turkey, falls within its reach in practice.
- Many controllers must register with the public VERBİS registry, which has no direct GDPR equivalent.
- The KVKK does not require the appointment of a data protection officer; controllers resident abroad, however, must appoint a data controller representative in Turkey for VERBİS purposes under the Board's rules.
- The privacy notice and the explicit consent text must be kept separate, and consent should not be sought for processing that relies on another legal ground.
- Cross-border transfers based on standard contracts must be notified to the Authority within five business days.
When can personal data be processed?
Personal data must be processed in line with the general principles in Article 4 (lawfulness and fairness, accuracy, specified and legitimate purposes, relevance and proportionality, and storage only for as long as necessary) and on the basis of at least one of the legal grounds in Article 5:
- The data subject's explicit consent
- Express provision by law
- Protection of the life or physical integrity of a person unable to give consent
- Necessity for the conclusion or performance of a contract
- Compliance with a legal obligation of the controller
- Data made public by the data subject
- Establishment, exercise or protection of a right
- The controller's legitimate interests, provided the data subject's fundamental rights and freedoms are not harmed
A frequent mistake is trying to obtain explicit consent for every processing activity. Consent is only one ground and should be used when no other applies; asking for consent for processing that relies on another ground can mislead data subjects. Consent must be specific, informed and freely given, and the provision of a service should not be made conditional on it.
Special categories of personal data
Data on health, sexual life, biometrics and genetics, race, ethnic origin, political opinion, religion, membership of associations, foundations or trade unions, and criminal convictions is classified as special category data and subject to stricter rules (Art. 6). Since the 2024 amendment, such data can be processed with explicit consent or on a limited number of other grounds listed in the law. Additional security measures set by the Board are mandatory when processing special category data.
The duty to inform
When collecting personal data, the controller must inform data subjects under Article 10. The privacy notice (aydınlatma metni) must state:
- The identity of the controller and of its representative, if any
- The purposes of processing
- To whom and for what purposes the data may be transferred
- The method of collection and the legal ground
- The data subject's rights under Article 11
The duty to inform applies whether or not consent is required. Websites should also have a cookie policy and a consent mechanism for non-essential cookies. Notices should be available in Turkish for people in Turkey, even if other language versions are offered.
KVKK compliance programme for companies
- Data inventoryIdentify which departments process which data about which people, for what purpose, on what legal ground, for how long and to whom it is transferred.
- Legal assessmentDetermine the legal ground for each processing activity and stop unnecessary or disproportionate processing.
- DocumentsPrepare privacy notices, consent texts where needed, a personal data processing and protection policy, a retention and destruction policy, a cookie policy and a data subject application form.
- ContractsPut data processing and confidentiality terms in place with processors (software, cloud, payroll, logistics) and choose a transfer tool for any transfer abroad, including intra-group transfers.
- Technical and organisational measuresAccess controls, logging, encryption, backups, penetration testing, staff training and confidentiality undertakings.
- VERBİS and ongoing complianceRegister with VERBİS where required and keep compliance up to date through periodic reviews.
VERBİS registration
VERBİS (Veri Sorumluları Sicil Bilgi Sistemi) is the public registry in which data controllers register and declare their processing activities (Art. 16). The Board has exempted certain controllers: those below the annual employee and balance-sheet thresholds it sets whose main activity is not processing special category data, and certain professions such as lawyers, notaries and certified public accountants. Under the Board's decisions, controllers resident abroad are not covered by the threshold exemption and register through their representative in Turkey. Because thresholds and exemptions are updated, the obligation should be assessed against the Board's current decisions. Failure to register is subject to administrative fines.
Data breach notification
If personal data is obtained by others unlawfully, for example through a cyber attack, ransomware, an email sent to the wrong recipient or a lost device, the controller must notify the data subjects and the Board as soon as possible (Art. 12(5)). Under the Board's decision, notification to the Board must be made without delay and at the latest within 72 hours of becoming aware of the breach, using the Authority's breach notification form. Affected data subjects should also be informed within a reasonable time.
Contain the breach with technical measures, establish its scope and the people affected, record every step and do not miss the 72-hour deadline. For cyber attacks, a criminal complaint may also be appropriate; see our IT and internet law guide.
Transfers of personal data abroad (2024 reform)
Law No. 7499 amended Article 9 of the KVKK and introduced a tiered system for transfers abroad from 1 June 2024:
| Tier | Description |
|---|---|
| 1. Adequacy decision | Where the Board has issued an adequacy decision for the destination country, sector or international organisation, data can be transferred if a legal ground for processing exists. |
| 2. Appropriate safeguards | Without an adequacy decision, data can be transferred using safeguards such as the standard contracts announced by the Board, binding corporate rules or written undertakings approved by the Board. A standard contract must be notified to the Authority within five business days of signature. |
| 3. Occasional transfers | Without an adequacy decision or safeguards, only occasional (non-regular) transfers can rely on limited exceptions listed in the law, such as explicit consent or performance of a contract. |
Foreign cloud services, international email and CRM systems and data flows to group companies abroad all fall within this regime. Explicit consent is no longer a sufficient basis for regular transfers; an appropriate transfer tool must be chosen. Standard contracts must be used in the form published by the Board.
Data subject rights and the complaint process
Under Article 11, anyone can apply to a data controller to exercise the following rights:
- To learn whether their data is processed and, if so, to request information
- To learn the purpose of processing and whether data is used accordingly
- To know the third parties to whom data is transferred, in Turkey or abroad
- To request correction of incomplete or inaccurate data
- To request deletion or destruction of data
- To request that corrections and deletions be notified to third parties to whom the data was transferred
- To object to an adverse result arising exclusively from automated analysis
- To claim compensation for damage caused by unlawful processing
- Application to the controllerThe application is made in writing or by other methods set by the Board, such as registered electronic mail (KEP) or a secure electronic signature.
- Controller's responseThe controller must respond as soon as possible and within 30 days at the latest, generally free of charge (Art. 13).
- Complaint to the BoardIf the application is rejected, the response is inadequate or no timely response is given, the data subject can complain to the Board within 30 days of learning of the response and in any case within 60 days of the application (Art. 14).
A complaint cannot be made directly to the Board without first applying to the controller. Claims for compensation for violation of personality rights under general law remain available.
Sanctions
- Administrative fines (Art. 18): for breaches of the duty to inform, data security obligations, Board decisions, the VERBİS obligation and the standard contract notification obligation. Amounts are revalued every year.
- Challenging fines: since 1 June 2024, administrative fines imposed by the Board are challenged before the administrative court, generally within 60 days of notification. For decisions before that date, the previous procedure (objection to the criminal judgeship of peace) continues to apply. See our administrative law guide.
- Criminal sanctions: unlawfully recording, disclosing, disseminating or obtaining personal data, and failing to destroy data when the retention period has expired, are offences under Articles 135–138 of the Criminal Code.
- Compensation: people harmed by a breach can claim pecuniary and non-pecuniary damages.
Competent authorities
| Matter | Authority |
|---|---|
| Data subject application | Data controller |
| Complaint | Personal Data Protection Board |
| Actions against the Board's fines and other decisions | Administrative court (decisions after 1 June 2024) |
| Offences relating to personal data | Public prosecutor; criminal courts |
| Compensation claims | Civil court of first instance (consumer court for consumer transactions) |
Time limits
| Item | Period | Legal basis |
|---|---|---|
| Controller's response to an application | 30 days at the latest | KVKK, Art. 13 |
| Complaint to the Board | 30 days from the response; 60 days from the application at the latest | KVKK, Art. 14 |
| Breach notification to the Board | 72 hours from awareness at the latest | KVKK, Art. 12(5); Board decision |
| Notification of a standard contract | 5 business days from signature | KVKK, Art. 9 |
| Action against a Board fine | 60 days from notification | KVKK, Art. 18; Law No. 2577, Art. 7 |
Board decisions, guidelines, VERBİS thresholds and fine amounts are updated regularly. This page is general information; check the Personal Data Protection Authority's website for the current rules.
Documents usually required
- For companies: existing privacy notices and consent texts, website privacy and cookie policies, employee and customer forms
- A list of software and cloud services used, service contracts and server locations, including group-level systems
- Intra-group data transfer arrangements and any standard contracts signed
- In a breach: incident logs, categories of data and number of people affected, measures taken
- For individuals: the application to the controller and the response, and evidence of the violation (messages, calls, screenshots)
Relevant legislation
Turkish legislation is published (in Turkish) at mevzuat.gov.tr and kvkk.gov.tr:
- Personal Data Protection Law No. 6698
- Law No. 7499 (1 June 2024; amendments to Arts. 6, 9 and 18)
- Regulation on the Deletion, Destruction or Anonymisation of Personal Data
- Communiqué on the Procedures and Principles for Fulfilling the Duty to Inform
- Communiqué on the Procedures and Principles for Applications to the Data Controller
- Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad
- Turkish Criminal Code No. 5237 — Arts. 135–140
Data Protection (KVKK): topics
The main topics within Turkish data protection law are listed below. Detailed guides for each are in preparation.
- KVKK compliance programmes
- VERBİS registration
- Data breach notification
- Cross-border data transfers
- Data subject applications and complaints
- Challenging Board fines
Frequently asked questions about data protection in Turkey
Does the KVKK apply to my foreign company?
If your company processes personal data in connection with Turkey, for example through a Turkish subsidiary or branch, or by processing the data of people in Turkey, the KVKK is likely to be relevant. Controllers resident abroad that are subject to VERBİS registration must appoint a representative in Turkey. The specific obligations depend on the processing involved.
Is the KVKK the same as the GDPR?
They are similar, and the 2024 amendments brought them closer, but they are not identical. Differences include VERBİS registration, the separation of privacy notices and consent texts, and the notification of standard contracts within five business days.
Can we transfer employee data to our parent company abroad?
Yes, but it is a transfer abroad under Article 9. Unless there is an adequacy decision, an appropriate safeguard such as the Board's standard contract or approved binding corporate rules must be used, and a standard contract must be notified to the Authority within five business days. Explicit consent is not a sufficient basis for regular transfers.
Do we need explicit consent for every processing activity?
No. Explicit consent is one of several legal grounds. If processing is necessary for a contract, required by law or based on legitimate interests, consent is not needed. The duty to inform applies in every case.
How quickly must a data breach be notified?
Under the Board's decision, without delay and at the latest within 72 hours of becoming aware of it, using the Authority's form. Affected individuals should also be informed within a reasonable time.
A company is using my data without permission. What can I do?
First apply to the controller in writing. If there is no response within 30 days, or the response is inadequate, you can complain to the Board within 30 days of the response and in any case within 60 days of your application. Compensation and criminal complaint routes are also available.
How are KVKK fines challenged?
Since 1 June 2024, by filing an action in the administrative court within 60 days of notification. For decisions before that date, the earlier procedure of objecting to the criminal judgeship of peace still applies.
Do we need to register with VERBİS?
It depends on the Board's thresholds for employee numbers and annual balance sheet total, the nature of your main activity and whether you are resident in Turkey. Controllers resident abroad are not covered by the threshold exemption. Check the Board's current decisions.
This article is for general information only and does not constitute legal advice. Please consult a lawyer about your specific situation. Legislation and court practice change over time, so check the current legislation before taking any step. Last updated: 14 October 2026