Contents
Law No. 6698 on the Protection of Personal Data (KVKK) was modelled on the EU’s former Data Protection Directive and has since moved closer to the GDPR. International groups often assume that GDPR compliance covers Türkiye. It is a solid foundation, but several Turkish requirements have no GDPR equivalent.
At a glance
- Regulator
- Personal Data Protection Authority (KVKK), Ankara
- Registration
- VERBIS, above thresholds
- Breach notification
- 72 hours to the Board
- Transfers abroad
- Adequacy, safeguards or occasional exceptions (since June 2024)
Legal bases and explicit consent
As under the GDPR, processing must rely on a legal basis — contract, legal obligation, legitimate interest and others. Explicit consent is required only where no other basis applies. A frequent mistake is asking for consent for everything “to be safe”: consent bundled with a service or obtained when another basis exists is itself criticised by the Board.
VERBIS registration
Data controllers above the employee and balance-sheet thresholds set by the Board — and foreign controllers processing data of persons in Türkiye — must register with VERBIS, the data controllers’ registry, and keep the entry up to date. Foreign controllers appoint a data controller representative in Türkiye.
Notices
A privacy notice in Turkish must be given at the time data is collected. It must be separate from consent text, so that individuals understand what they are told and what they are agreeing to.
Law No. 7499 changed the transfer regime as of 1 June 2024. Without an adequacy decision, transfers may rely on appropriate safeguards — most commonly the Board’s standard contractual clauses, which must be notified to the Authority within five business days of signature — or on limited occasional exceptions.
Data breaches
Breaches must be notified to the Board within 72 hours of discovery and to affected individuals as soon as possible. The Board publishes many breach notifications on its website, so communication must be prepared with care.
Data subject rights
Individuals may request access, correction, deletion and objection. The controller must answer within thirty days, free of charge in principle. Rejected requests may be taken to the Board.
Sanctions
Breaches of KVKK obligations attract administrative fines updated each year, and certain acts — unlawful recording, disclosure, failure to destroy data — are also criminal offences under the Turkish Criminal Code.
See our data protection law page for how we support compliance programmes.
Do we need a data protection officer?
KVKK has no DPO requirement like the GDPR, but VERBIS registration requires a contact person, and foreign controllers need a representative.
Is using a cloud provider outside Türkiye a transfer abroad?
Yes, storing personal data on servers abroad is a transfer and must meet the cross-border transfer rules.
This article is for general information only and does not constitute legal advice. Time limits, rates and thresholds may change with new legislation; please have your specific situation assessed by a lawyer before taking action.
Prepared by
Candan Law & Consultancy
An Ankara-based law firm practising since 1997, representing individuals, companies and public-sector contractors in Turkish, English and French.
