71%
of Turkey's 21 requirements are already met by European Union (GDPR). Here is what KVKK adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
KVKK adds2 Controllers must register in VERBIS before processing, unless exempt (under 50 employees and under TRY 100m balance sheet, or under 10 and TRY 10m if mainly sensitive data).
Art. 16; Board exemption decision published in Official Gazette No. 33034 (1 Oct 2025) · source ↗
RecordsGovernanceGap
GDPR2 Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
KVKK adds3 Controllers must keep a personal data processing inventory and file its contents in the public VERBIS registry, plus keep a retention and destruction policy.
Art. 16(2); Regulation on the Data Controllers' Registry · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
KVKK adds2 Erase, destroy or anonymize data once processing grounds end; registered controllers need a retention policy and periodic destruction at least every six months.
Art. 7; Regulation on Erasure, Destruction or Anonymization (OG No. 30224, 2017) · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
KVKK adds3 Notify affected data subjects as soon as possible after every breach, with no risk threshold.
Art. 12(5); Board Decision 2019/10 · source ↗
LocalizationTransfersGap
GDPR– Not addressed
KVKK adds1 No general rule; sector laws require local storage, e.g., large social network providers under Law 5651, plus banking and payment rules.
Law No. 5651 (2020 amendments); sector regulations · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
KVKK adds2 Penal Code offenses apply: unlawful recording, transfer or disclosure, and failing to destroy data, punishable by imprisonment of up to about 4.5 years.
Art. 17; Turkish Penal Code Arts. 135-140 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, DPIA, Tell the regulator, Transfers abroad, Maximum fine, Private action.
A gap means KVKK is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
