Law on the Protection of Personal Data (KVKK)

· About Law on the Protection of Personal Data (KVKK)

Key Takeaways

  • The Law on the Protection of Personal Data No. 6698 (KVKK) is Turkey’s main personal data statute, enforced by the Personal Data Protection Authority and its decision-making body, the Personal Data Protection Board.[1][5]
  • The KVKK applies to controllers processing personal data in Turkey and, through its practical enforcement, to organizations outside Turkey when their processing is directed at Turkey-related data subjects or occurs through Turkey-facing operations.[1][5]
  • The 2024 transfer reforms moved Turkey’s cross-border transfer regime closer to the GDPR by adding standard contractual clauses and other transfer routes, and the current guidance remains that transfer compliance is a live enforcement area.[9][10]
  • In 2026, the Authority’s administrative fines were revalued upward, and the highest Article 18 fines reach TRY 17,092,242 for certain violations such as data security failures, ignoring Board decisions, and VERBIS non-compliance.[12][13][15]
  • The KVKK does not create a single GDPR-style lawful-basis framework in identical terms, but it still requires notice, security, data minimization, purpose limitation, retention control, and cross-border transfer discipline.[1][5][10]
  • Organizations that miss KVKK obligations can face administrative fines and, in serious cases, separate criminal liability under the Turkish Penal Code for unlawful data handling.[14][15]

What It Is

The KVKK is Turkey’s core personal data protection law, Law No. 6698, and the official authority page identifies it as the country’s Personal Data Protection Law.[1] The law is enforced by the Personal Data Protection Authority and the Personal Data Protection Board, which issue guidance and impose administrative sanctions.[1][5]

The law was adopted on 24 March 2016 and came into force shortly afterward in 2016, as reflected on the Authority’s official law page.[1] Its most significant modern change is the cross-border transfer reform that entered into force on 1 June 2024, which introduced new transfer mechanisms and significantly altered Article 9 practice.[9][10]

The current status in 2026 is that the KVKK is fully in force, with ongoing enforcement, updated fine levels for 2026, and continuing implementation guidance from the Authority.[1][12][15] No source reviewed shows a postponement of the law itself; instead, the post-2024 regime has been operationalized through guidance and market practice.[9][10]

Who Must Comply

The KVKK applies to data controllers and data processors handling personal data in Turkey’s legal environment, with the Authority’s guidance framing the law as covering the processing of personal data and related obligations.[1][5] In practice, the compliance burden is heaviest on controllers that determine purposes and means of processing and on processors acting on their behalf.[5]

A key threshold is the VERBIS registration and notification obligation under Article 16, which can apply depending on controller type and activity profile, and is one of the fine-triggering obligations under Article 18.[13][15] The Authority’s public materials and compliance summaries also indicate that certain small or low-risk entities may benefit from sectoral or threshold-based exemptions, but those exemptions must be checked against the current registry rules and Board practice.[5][13]

The law has an extraterritorial practical reach where an organization outside Turkey processes personal data connected to Turkish operations, Turkish customers, or Turkish-facing services, especially when transfers or local processing occur.[9][10] The 2024 transfer amendments make this especially relevant for multinational groups using standard contracts or other cross-border transfer tools.[9][10]

Core Requirements

  1. Notice and transparency: Controllers must give data subjects an information notice explaining identity of the controller, purpose, recipients, collection method, and rights, and failure to inform is a fined offense under Article 18.[13][15]
  2. Lawful and limited processing: Personal data must be processed for specified purposes and in a manner tied to those purposes, with the practical compliance expectation of purpose limitation and data minimization reflected in Authority guidance.[1][5]
  3. Data security: Controllers must take appropriate technical and organizational measures to secure personal data, and data security failures carry the highest administrative fine band.[12][13][15]
  4. Data subject rights handling: Controllers must process access, correction, deletion, and related rights requests through a workable internal procedure consistent with the law and Board practice.[5]
  5. Registry compliance where required: Entities subject to registration must register and keep VERBIS records current; failure to register or notify can be fined at the top Article 18 level.[13][15]
  6. Cross-border transfer governance: Transfers abroad now require use of a valid transfer mechanism, and the 2024 regime includes standard contractual clauses with notification duties to the Authority.[9][10][13]
  7. Board decision compliance: Controllers must comply with binding Board decisions, and non-compliance can draw one of the highest fine ranges.[13][15]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Law adopted | 24 March 2016 | KVKK enacted as Law No. 6698.[1] | | Law in force | 2016 | Core personal data protection obligations became applicable.[1] | | Cross-border transfer reform | 1 June 2024 | New transfer mechanisms, including standard contractual clauses, became effective.[9][10] | | 2026 fine revaluation | 1 January 2026 | Administrative fines increased for the 2026 calendar year.[12][15] |

The current 2026 maximum administrative fine under Article 18 for data security failures, Board non-compliance, and VERBIS-related failures is TRY 17,092,242, while transparency failures and transfer-notification failures carry lower maximums.[12][13][15] The law also exposes violators to criminal penalties under the Turkish Penal Code where the conduct meets criminal thresholds for unlawful processing or disclosure.[14][15]

How to Comply

  1. Map processing activities and legal roles. Identify whether each entity is a controller, processor, or both, then inventory personal data, special categories, retention periods, and transfer paths.[1][5]
  2. Build a KVKK notice and rights workflow. Align privacy notices, consent records where used, and data subject request handling so Article 10 and rights obligations are operational rather than paper-only.[13][15]
  3. Implement security controls to ISO 27001 depth. Use ISO 27001-style controls for access control, logging, encryption, vendor management, incident response, and evidence retention, because data security is a major fine driver under Article 12.[12][13]
  4. Use NIST CSF 2.0 for operational resilience. Map Identify, Protect, Detect, Respond, and Recover functions to KVKK security duties, especially for breach readiness and management reporting.[12][14]
  5. Create an AI and governance overlay using ISO 42001 where relevant. If automated decision-making, profiling, or GenAI tools touch personal data, use ISO 42001 governance to document accountability, human oversight, and risk treatment even though KVKK itself is not an AI law.[5][10]
  6. Re-paper cross-border transfers. Replace legacy transfer assumptions with 2024-compliant mechanisms, including standard contractual clauses where applicable, and build a transfer register for notifications and audits.[9][10][13]
  7. Test VERBIS and Board-readiness. Maintain current registry entries, preserve approval evidence, and prepare a documented escalation process for Board inquiries or remedial orders.[13][15]

Related Regulations

Turkey’s Law No. 5651 overlaps with KVKK where online service providers handle personal data, but it adds content, hosting, and internet-intermediary obligations that can create parallel compliance tracks.[4][7]

The Turkish Penal Code matters because unlawful recording, disclosure, or retention of personal data can trigger criminal exposure in addition to KVKK administrative fines.[14][15]

The GDPR is the closest foreign analogue and often the benchmark for multinational programs, but KVKK differs on transfer mechanics, notice practice, and some special-category data rules, so GDPR compliance is not automatically KVKK compliance.[9][10][15]

Sectoral rules for health, telecoms, and advertising can narrow or expand permissible processing and often override generic KVKK assumptions in operational detail.[4][7]

FAQ

Does KVKK apply to companies outside Turkey?

Yes, if they process personal data in a way that connects to Turkish data subjects, Turkish operations, or Turkey-facing services. The practical effect of the law and the transfer rules is that foreign groups cannot assume they are outside scope just because they lack a Turkish legal entity.[9][10]

Do I need to register in VERBIS?

Not every organization must register, but many controllers do, and failure to register where required is one of the KVKK’s specific fined offenses. The exact threshold depends on controller profile and current Authority rules, so the registry analysis should be done before launch or restructuring.[13][15]

What changed in the 2024 cross-border transfer reform?

The 2024 amendments introduced a more structured transfer regime and brought standard contractual clauses into practice as a recognized mechanism. This was a major move toward a GDPR-like transfer architecture, but the Turkish rules still have their own notification and documentation requirements.[9][10]

What are the biggest KVKK fines in 2026?

The highest Article 18 fine band reaches TRY 17,092,242 for data security failures, failure to comply with Board decisions, and certain VERBIS breaches. Lower maximums apply to transparency failures and transfer-notification failures.[12][13][15]

Is consent always required under KVKK?

No. KVKK compliance is not built only on consent, and organizations also need to consider notice, legitimate statutory grounds, and separate transfer rules. Consent remains relevant in some situations, especially for sensitive or otherwise restricted processing, but it is not a universal substitute for compliance.[1][5][10]

Sources

Put it into practice

More compliance guides