Regulations › Rest of world › Turkey
KVKK
Law on the Protection of Personal Data No. 6698
WhenIn effect since 7 April 2016
Who enforces itPersonal Data Protection Authority (KVKK) and Personal Data Protection Board
Who it applies toNatural and legal persons that process personal data of natural persons wholly or partly by automated means, or non-automated means forming part of a filing system.
Tell the regulatorNotify the Board as soon as possible, interpreted by the Board as within 72 hours of discovery…
DPO requiredNo DPO requirement
RegistrationControllers must register in VERBIS before processing, unless exempt (under 50 employees and u…
Transfers abroadNeeds a Board adequacy decision
Request deadline30 days, free of charge unless extra cost is incurred under the Board tariff
Maximum fineAdministrative fines up to TRY 17,092,242 per violation in 2026, revalued each year
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
The law is silent on territory, but the Board requires foreign controllers processing data of people in Turkey to register in VERBIS through a local representative.Art. 2 (scope); Art. 16 and Regulation on the Data Controllers' Registry (foreign controller representative) · secondary source · source ↗
Scored from regulator practice, not statutory text. Separately, Law No. 5651 requires a local representative for social networks with 1m+ daily users from Turkey.
Lawful basis
1
Explicit consent is the default, but processing without consent is allowed on listed grounds, including contract, legal obligation and legitimate interests.Art. 5(1)-(2) · source ↗
The law is drafted with consent as the rule and the other grounds as exceptions. In practice the Board expects controllers to rely on another ground before consent. Source is the English text of the statute on a university site, not an official publication.
Consent
2
Explicit consent must be freely given, specific and informed; the Board rejects consent bundled with service terms or the privacy notice.Art. 3(1)(a) · source ↗
The point about bundled consent comes from Board guidance, not the statute.
Sensitive data
2
Processing special categories, including appearance, clothing and association membership, is prohibited unless an Art. 6(3) exception applies, such as explicit consent, law or employment obligations. Board-set measures are required.Art. 6(1), 6(3)(a)-(g), 6(4); Board Decision 2018/10 · source ↗
Law No. 7499 (in force 1 June 2024) repealed the old two-tier rule and added GDPR-like exceptions. Biometric and genetic data are included.
Children
0
No specific rule; under-18s are minors under the Civil Code, so a parent or guardian generally gives consent.Not addressed in Law No. 6698 · secondary source · source ↗
People's rights
Rights
2
Learn whether data is processed and get information (access), rectification, erasure, notice to third-party recipients, objection to solely automated outcomes, and compensation.Art. 11(1) · source ↗
Counted 4 of the 7 standard rights: access, correction, deletion and automated-decision objection. There is no portability, no general objection and no restriction right.
Request deadline
2
30 days, free of charge unless extra cost is incurred under the Board tariff.Art. 13(2) · source ↗
Marketing
2
Commercial electronic messages need prior opt-in consent recorded in the national IYS system; opt-outs must be honored within 3 business days.Law No. 6563 on Electronic Commerce, Art. 6; Regulation on Commercial Communication · secondary source · source ↗
The DLA page names the e-commerce law but not its number; Law 6563 Art. 6 is from knowledge of the law. Tradespeople messaging businesses are exempt from opt-in but must register in IYS.
Governance
DPO required
0
No DPO requirement; registered controllers must appoint a contact person for the Authority and data subjects.Not in Law No. 6698; contact person under Regulation on the Data Controllers' Registry · secondary source · source ↗
The contact person handles communication and is not a DPO. Raise to 1 if your tool treats a mandatory contact person as a DPO-like role.
DPO qualifications
0
No DPO, so no qualifications are set.Not addressed in Law No. 6698 · secondary source · source ↗
There is a voluntary personal-data-protection expert certification scheme. This is from background knowledge and was not verified in this round.
Registration
2
Controllers must register in VERBIS before processing, unless exempt (under 50 employees and under TRY 100m balance sheet, or under 10 and TRY 10m if mainly sensitive data).Art. 16; Board exemption decision published in Official Gazette No. 33034 (1 Oct 2025) · source ↗
The exemption thresholds come from Cottgroup (https://cottgroup.com/tr/component/zoo/item/changes-in-exceptions-to-the-obligation-to-register-with-verbis), a secondary source. Registration has no fee.
Records
3
Controllers must keep a personal data processing inventory and file its contents in the public VERBIS registry, plus keep a retention and destruction policy.Art. 16(2); Regulation on the Data Controllers' Registry · secondary source · source ↗
Applies to non-exempt controllers. The registry regulation article number was not confirmed.
Retention
2
Erase, destroy or anonymize data once processing grounds end; registered controllers need a retention policy and periodic destruction at least every six months.Art. 7; Regulation on Erasure, Destruction or Anonymization (OG No. 30224, 2017) · secondary source · source ↗
Destruction records must be kept 3 years. Raise to 3 if a fixed six-month destruction cycle counts as a regulator-set period. The regulation's article number was not confirmed.
Breaches
Tell the regulator
2
Notify the Board as soon as possible, interpreted by the Board as within 72 hours of discovery, with no risk threshold.Art. 12(5); Board Decision 2019/10 · source ↗
The statute says 'as soon as possible'. The 72-hour rule is from Board Decision 2019/10, as reported by DLA Piper. Every breach is notifiable, with no risk threshold.
Tell people
3
Notify affected data subjects as soon as possible after every breach, with no risk threshold.Art. 12(5); Board Decision 2019/10 · source ↗
The Board may also publish the breach.
Transfers
Transfers abroad
2
Needs a Board adequacy decision; else Board-approved BCRs or undertakings, or a Board standard contract filed within five business days. Incidental transfers allowed on listed grounds.Art. 9(1)-(6) as amended by Law No. 7499; Transfer Regulation (OG No. 32598, 10 July 2024) · source ↗
In force 1 June 2024. Before that, without explicit consent the Board's permission was effectively required. Undertakings and BCRs still need Board approval. Failing to file a standard contract is a fine under Art. 18(1)(d).
Localization
1
No general rule; sector laws require local storage, e.g., large social network providers under Law 5651, plus banking and payment rules.Law No. 5651 (2020 amendments); sector regulations · secondary source · source ↗
Enforcement
Maximum fine
2
Administrative fines up to TRY 17,092,242 per violation in 2026, revalued each year.Art. 18(1) · secondary source · source ↗
The statutory base is TRY 1,000,000, revalued by 25.49% for 2026 (OG No. 33090, 27 Nov 2025). That is about USD 400,000. The cap for failing to file a standard contract is TRY 1,806,377.
Criminal liability
2
Penal Code offenses apply: unlawful recording, transfer or disclosure, and failing to destroy data, punishable by imprisonment of up to about 4.5 years.Art. 17; Turkish Penal Code Arts. 135-140 · source ↗
Prison ranges come from DLA Piper. They are 1-3 years for unlawful recording (more for sensitive data), 2-4 years for unlawful transfer or disclosure, and 1-2 years for failing to destroy data.
Private action
2
Data subjects can claim compensation in civil courts for damage from unlawful processing; complaints to the Board come after a request to the controller.Art. 11(1)(ğ); Art. 14 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws