Eti Mah. Toros Sok. No: 15/5, Hikmet Ünal Business Centre, 06570 Çankaya / Ankara, Türkiye
Practice area
KVKK compliance, breach response and cross-border transfers for companies operating in Türkiye.
Listen to this pageAbout 3 min · read aloud
Law No. 6698 on the Protection of Personal Data (KVKK) applies to every company processing personal data in Türkiye, including foreign groups with Turkish subsidiaries. It resembles the GDPR in structure but differs in important details — particularly registration and cross-border transfers.
We build KVKK compliance programmes, respond to data breaches and data subject complaints, and represent companies before the Personal Data Protection Board in Ankara.
At a glance
A compliance programme starts with a data inventory: which data is processed, why, on what legal basis, where it is stored and who receives it. Retention and destruction policies, technical and organisational measures and employee training follow.
Data controllers above the thresholds set by the Board must register with the VERBIS data controller registry. Privacy notices must be given at the time data is collected; explicit consent is required only where no other legal basis applies, and must not be bundled with the provision of a service.
Data breaches must be notified to the Board within 72 hours of discovery and to affected individuals as soon as possible. A prepared response plan determines how well a company handles those first hours.
Data subjects may request information, correction, deletion and objection; the controller must reply within thirty days. Rejected or unanswered requests may be taken to the Board.
Breaches of KVKK obligations attract administrative fines, while unlawful recording, disclosure or failure to destroy data may also constitute offences under the Turkish Criminal Code.
Since 1 June 2024, transfers abroad may rely on an adequacy decision, appropriate safeguards — such as the Board’s standard contractual clauses, which must be notified to the Authority within five business days of signature — or limited occasional exceptions.
It is a good basis, but not enough: VERBIS registration, Turkish-language notices, the standard contract notification and some consent rules are specific to KVKK.
Discuss your data protection law matter
Tell us briefly what happened and whether any deadline is running; we will explain the options and next steps. We work in English, French and Turkish.
Guides
Data Protection Law2 min read
How Turkey’s Personal Data Protection Law (KVKK) differs from the GDPR: legal bases, VERBIS registration, notices, breach notification and the 2024 cross-border transfer rules.
Get in touch
If a deadline is running, let’s talk today.
Search topicsSearch practice areas, articles, tools and questions.
Severance pay Inheritance shares Legal deadlines Mediation check
