Scope

Personal data protection law governs the conditions for processing data relating to identified or identifiable natural persons, the obligations of data controllers and data processors, and the rights of data subjects. The principal legislation is Law No. 6698 on the Protection of Personal Data (Personal Data Protection Law, KVKK). The Law is implemented by the Personal Data Protection Authority and its decision-making body, the Personal Data Protection Board; the Board’s decisions and guidelines are decisive in practice. Data controllers such as companies, public institutions, associations and foundations process the data of customers, employees, visitors and suppliers within this framework.

The Law covers the processing of data wholly or partly by automated means, and by non-automated means provided that the data form part of a data filing system. For data to be processed, one of the legal grounds in Article 5 of the Law must exist; explicit consent is only one of them. Special categories of personal data, such as health, biometric and genetic data, are subject to stricter rules under Article 6. Incidents such as unauthorised access to information systems and data leaks may also be assessed under the provisions of Turkish Criminal Code No. 5237 on cybercrime and under cybersecurity legislation.

Frequently encountered matters

Preparing a data inventory and linking processing activities to legal grounds.
Preparing information notices and, where necessary, explicit consent texts.
Assessing the obligation to register with the Data Controllers Registry (VERBİS).
Domestic and cross-border data transfers; standard contracts and other safeguards.
Data processor agreements and supplier relationships.
Retention, erasure, destruction and anonymisation policies.
Employee data, camera surveillance in the workplace and the processing of special categories of data.
Responding to data subject requests.
Data security measures and, in the event of a data breach, notification to the Board and to data subjects.
Complaints to the Board, investigation processes and judicial remedies against administrative sanction decisions.

Process and points to note

Compliance work begins with mapping the data processed and the purposes of processing. This work determines which legal ground each item of data relies on, to whom it is transferred and for how long it is retained. The obligation to inform must be fulfilled at the time the data is obtained. Under Article 9, as reorganised by the 2024 amendment, transfers abroad are based on one of the safeguards such as an adequacy decision or standard contracts; standard contracts must be notified to the Authority.

A request made by the data subject to the data controller must be concluded within thirty days at the latest, depending on the nature of the request (Art. 13). If the request is rejected, the response is insufficient or no response is given in time, the data subject may file a complaint with the Board within thirty days of learning of the response and, in any event, within sixty days of the date of the request (Art. 14). In the event of a data breach, a Board decision provides for notification to the Board within seventy-two hours of becoming aware of the breach; this time limit should be checked against the current regulation.

Article 18 of the Law regulates administrative fines; these fines are updated every year by the revaluation rate. Decisions of the Board are challenged before the administrative courts, while decisions imposing fines are challenged through the remedy provided in the relevant law. The unlawful recording, disclosure or failure to destroy data are also defined as criminal offences under Articles 135, 136 and 138 of the Turkish Criminal Code.

Our office’s approach

In personal data compliance work, data flows and existing documents are reviewed first; missing policies, information notices and contract texts are then prepared. In breach cases and applications to the Board, time limits are identified as a priority.

Personal DataProtection