Personal data protection in Türkiye is governed by the Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, or KVKK), which took effect in 2016. The law is closely modelled on European standards and, following its March 2024 amendments, has moved further toward alignment with the EU General Data Protection Regulation (GDPR). For any company operating in or entering the Turkish market, KVKK compliance is now a baseline requirement rather than an afterthought: it shapes how you hire, sell, market, and run your IT systems from day one.
The framework at a glance
The KVKK is enforced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), the decision-making body of the Personal Data Protection Authority. The Board issues binding decisions, investigates complaints, publishes guidance and imposes administrative fines. Publicity matters in practice: the Board announces the decisions it considers necessary (Article 23(5)) and may publish a data breach on its website (Article 12(5)), so a compliance failure can become a reputational event as well as a financial one.
Read the full section
The law rests on a familiar set of definitions:
- Data controller: the natural or legal person who determines the purposes and means of processing and is responsible for setting up and managing the filing system. The VERBIS Regulation expressly covers controllers not established in Türkiye.
- Data processor: a natural or legal person who processes personal data on the controller’s behalf, based on the authority the controller grants.
- Processing: almost any operation performed on personal data, including collection, recording, storage, alteration, disclosure and transfer.
What this means for you
If you sell to Turkish consumers, employ people in Türkiye, or run a website or app that collects data from users in the country, you are almost certainly a data controller under the KVKK, even if your servers and headquarters are abroad. The practical consequence is that the first compliance question is rarely “does the law apply?” but “where are our gaps, and how exposed are we?”
Lawful grounds for processing
As a rule, personal data may only be processed with the explicit consent of the data subject. Article 3 defines explicit consent as consent relating to a specific matter, based on information and given with free will. A pre-ticked box or a blanket “I agree to everything” clause buried in terms of service is hard to reconcile with that definition.
Read the full section
The KVKK then sets out specific exceptions where processing is lawful without consent, such as where it is:
- expressly permitted by law;
- necessary to process the data of the parties to a contract, where directly related to concluding or performing it;
- required to comply with a legal obligation of the controller;
- necessary to protect the life or bodily integrity of a person, or of another, where that person cannot express consent due to actual impossibility or their consent has no legal validity; or
- necessary for the controller’s legitimate interests, provided the data subject’s fundamental rights are not prejudiced.
Special categories of data (Article 6(1) lists race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data) may not be processed unless one of the grounds in Article 6(3), as amended with effect from 1 June 2024, applies: for example explicit consent, an express provision of law, data made public by the data subject in line with that intention, the establishment, exercise or protection of a right, health-care purposes pursued by persons under a duty of confidentiality, or legal obligations in employment, occupational safety and social security. The adequate measures set by the Board must also be taken (Article 6(4)). Because the bar is higher, processing them (for example, in HR files or health services) needs particular care.
A common and costly mistake is treating explicit consent as a catch-all. Consent that is bundled into a contract or made a condition of a service is hard to square with the requirement that consent be given with free will, and if that consent fails, processing that relied only on it has no lawful basis.
Rights of the data subject
The KVKK grants individuals a robust set of rights. A data subject may:
Show the 7 points
- learn whether their personal data is being processed and request information about it;
- learn the purpose of processing and whether the data is used accordingly;
- know the third parties, in Türkiye or abroad, to whom data is transferred;
- request correction of inaccurate data and erasure or destruction where the grounds for processing no longer exist;
- ask that corrections and erasures be notified to the third parties who received the data;
- object to an adverse outcome produced exclusively by automated analysis; and
- claim compensation for damage caused by unlawful processing.
Controllers must conclude such requests as soon as possible and within 30 days at the latest (Article 13(2)). If the request is rejected, the answer is inadequate or no answer comes in time, the data subject may complain to the Board within 30 days of learning the answer and in any case within 60 days of the application; the application to the controller must come first (Article 14). In practice this means you need a working intake process (a monitored contact point, a template response and an internal owner) before the first request arrives, not after.
VERBIS registration
Article 16(2) requires controllers to enrol in VERBIS (Veri Sorumluları Sicili), the Data Controllers’ Registry, before processing begins. The registration describes, at a high level, what data you process, for what purposes, with whom you share it, and what security measures you apply. The Board may exempt categories of controllers on objective criteria; the Registry Regulation (Article 16) lists them, including the nature and number of the data, the purpose and sector of processing and the controller’s annual employee numbers or annual balance-sheet total. Whether an exemption applies should be checked against the Board’s current decisions rather than assumed.
Read the full section
Foreign controllers without an establishment in Türkiye face an added step: under the Registry Regulation (Article 5(1)(b)) they must register through a data controller representative, a legal person established in Türkiye or a Turkish citizen, before processing begins. Because the registry is public (Article 16(1)), a missing entry is easy to detect, and breaching the registration and notification duty carries its own fine (Article 18(1)(ç)).
Cross-border data transfers after the 2024 reform
Transfer of personal data abroad was historically the most restrictive part of the KVKK, and for years it was the single biggest headache for multinational groups running shared HR, CRM or cloud systems. Law No. 7499, adopted in March 2024, rewrote Article 9 with effect from 1 June 2024 (the old consent-based rule could still be applied alongside it until 1 September 2024). The adequacy and safeguard routes also require one of the processing grounds in Article 5 or 6, and data may now be transferred outside Türkiye through:
Show the 3 points
- an adequacy decision by the Board for the destination country, sectors within it or an international organisation;
- appropriate safeguards such as the standard contract announced by the Board, binding corporate rules approved by the Board, or a written undertaking with the Board’s permission, provided the data subject can exercise rights and seek effective remedies in the destination country; or
- specific exceptional grounds, including the data subject’s explicit consent after being informed of the possible risks, for occasional transfers.
A standard contract must be notified to the Authority within five business days of signing (Article 9(5)); failing to do so carries a separate fine (Article 18(1)(d)). This shift gives multinational groups practical, GDPR-style mechanisms that did not previously exist under Turkish law, but the mechanisms only protect you if the paperwork is actually in place and filed on time.
If your group moves Turkish employee or customer data to a parent company, a cloud provider, or a shared service centre abroad, the transfer needs a documented legal basis under the KVKK. Doing it on the strength of a global GDPR policy alone is not enough.
KVKK and GDPR side by side
For groups that already run a GDPR programme, the fastest way to scope the Turkish work is to see where the regimes diverge:
Read the full section
| Topic | GDPR | KVKK |
|---|---|---|
| Default lawful ground | Six co-equal legal bases | Explicit consent as the rule, with listed exceptions |
| Registry obligation | No general registry | VERBIS registration for most controllers |
| Foreign controllers | EU representative in some cases | Data controller representative + VERBIS registration |
| Cross-border transfers | Adequacy, SCCs, BCRs | Similar routes since 1 June 2024; standard contracts must be notified to the Authority within five business days |
| Enforcement | National supervisory authorities | KVKK Board; fines rise each year by the revaluation rate and are challenged before administrative courts |
The practical takeaway: a GDPR-compliant group usually needs a focused local layer (Turkish-language notices, VERBIS and filed transfer documents) rather than a rebuilt programme.
Enforcement and penalties
Non-compliance carries real exposure. Article 18 of the KVKK sets ranges of administrative fines for failing to meet the duty to inform, breaching data security obligations, not implementing Board decisions, breaching VERBIS registration and notification duties, and not notifying a standard contract. Under Article 17(7) of the Misdemeanours Law, the amounts rise at the start of each year by the revaluation rate announced under the Tax Procedure Law, so the figures printed in the KVKK are not the current ones. Since 1 June 2024, Board fines are challenged before the administrative courts (Article 18(3)); applications already pending before the criminal judgeships of peace on that date stay there (Provisional Article 3).
Read the full section
Separately, the Turkish Penal Code (Articles 135-140, applied through Article 17 of the KVKK) criminalises unlawfully recording personal data (Article 135), unlawfully giving, disseminating or obtaining it (Article 136) and failing to destroy data when the legal periods have expired (Article 138). Article 17(2) of the KVKK adds that failing to erase or anonymise data contrary to Article 7 is punished under Article 138. These offences are prosecuted without a complaint (Article 139), can expose individuals within a company to personal liability, and allow security measures against the legal person (Article 140). Affected individuals may also bring civil compensation claims under the general rules (Article 14(3)).
Because many Board decisions are published, the practical cost of a serious failure often exceeds the headline fine: prospective partners, investors and customers can see it.
If the Board opens an investigation, on a complaint or on its own initiative once it learns of an alleged breach (Article 15(1)), the quality of your written response matters enormously. The controller must send the information and documents the Board requests within 15 days and, where needed, allow an on-site inspection (Article 15(3)). Answering late, incompletely or without the supporting records (consent logs, notices, security policies) weakens the file. This is one of the areas where preparing before any incident pays off most directly.
What compliance looks like in practice
Companies operating in Türkiye should:
- map their processing activities and maintain accurate records;
- issue compliant privacy notices (aydınlatma metni) and, where required, collect valid explicit consent;
- complete and keep current their VERBIS entry;
- put data transfer mechanisms in place before moving data abroad;
- implement technical and organisational security measures and a breach-response plan; and
- train staff so that compliance is embedded rather than reactive.
Read the full section
We advise clients across the full lifecycle, from gap assessments and policy drafting to VERBIS filings, transfer agreements, breach notifications and representation before the Board. A common assumption is that a company broadly compliant with the GDPR is therefore compliant in Türkiye; often it is not, because of VERBIS, the consent default, and local notification rules. Early, structured compliance is far less costly than responding to an investigation after the fact.
Related Practice Areas & Strategic Legal Guides
Show the 4 points
- Real Estate & Property Law: Title deed due diligence, foreign property acquisitions, and Land Registry (TKGM) transfers.
- Intellectual Property & Trademark Litigation: Trademark, patent, and copyright enforcement before TÜRKPATENT and IP Courts.
- Personal Data Protection (KVKK/GDPR): VERBİS registration, data inventory mapping, and cross-border data transfer compliance.
- Legal Matters in Istanbul for Foreign Clients and Companies: Full-service commercial and civil advocacy before Istanbul courthouses.
