Regulations › Rest of world › Turkey
KVKK
Law on the Protection of Personal Data No. 6698
WhenIn effect since 7 April 2016
Who enforces itPersonal Data Protection Authority (KVKK) and Personal Data Protection Board
Who it applies toNatural and legal persons that process personal data of natural persons wholly or partly by automated means, or non-automated means forming part of a filing system.
Tell the regulatorNotify the Board as soon as possible, interpreted by the Board as within 72 hours of discovery…
DPO requiredNo DPO requirement
RegistrationControllers must register in VERBIS before processing, unless exempt (under 50 employees and u…
Transfers abroadNeeds a Board adequacy decision
Request deadline30 days, free of charge unless extra cost is incurred under the Board tariff
Maximum fineAdministrative fines up to TRY 17,092,242 per violation in 2026, revalued each year
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws