Personal data is any information relating to an identified or identifiable natural person. An employee's payroll, a customer's phone number, a camera recording and device information obtained from cookies on a website all fall within this definition. Personal Data Protection Law No. 6698 (KVKK) imposes a series of obligations on companies and institutions that process such data in their capacity as "data controllers", and compliance is supervised by the Personal Data Protection Board (the Board).
KVKK compliance is not a one-off exercise in preparing documents. When a company starts using new software, moves to a cloud service abroad or plans a new marketing campaign, the legal basis for the processing activity should be checked again.
Basic principles and processing conditions
Every processing activity must comply with the general principles in KVKK Art. 4: lawfulness and fairness, accuracy and, where necessary, being kept up to date, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purpose, and retaining data only for as long as necessary. These principles serve as the yardstick for interpreting all other provisions.
Processing must also rest on a legal ground. Besides explicit consent, KVKK Art. 5 lists conditions such as being expressly provided for by law, the formation or performance of a contract, compliance with a legal obligation, the establishment, exercise or protection of a right, and the data controller's legitimate interest provided this does not harm the data subject's fundamental rights. A common mistake in practice is trying to obtain explicit consent for every operation. Asking for consent for processing that rests on another legal ground misleads the data subject, and when consent is withdrawn, the basis for the processing becomes questionable.
Special categories of personal data
Data such as health, sex life, biometric and genetic data, race, ethnic origin, political opinion, religion, membership of an association or trade union and criminal convictions are considered special categories (KVKK Art. 6). The conditions for processing such data were reorganised by the amendment made by Law No. 7499, which entered into force on 1 June 2024. Besides explicit consent, the following may now also serve as a basis for processing: being expressly provided for by law; protecting vital interests where consent is physically impossible; processing limited to data made public by the data subject; the establishment or protection of a right; processing by persons under a duty of confidentiality for public health and medical diagnosis purposes; and legal obligations in the fields of employment and social security. The additional security measures prescribed by the Board must also be taken for these data.
Cross-border transfers
Uploading data to a server abroad, sharing a customer list with a group company abroad or using a foreign software service is, as a rule, a cross-border transfer. Law No. 7499 entirely amended KVKK Art. 9 and tied transfers to a three-tier system:
- An adequacy decision of the Board regarding the country, sector or international organisation to which the transfer is made
- If there is no adequacy decision, one of the appropriate safeguards: the standard contract announced by the Board, binding corporate rules approved by the Board, or a written undertaking with the Board's permission
- If none of these is available, the occasional (non-recurring) transfer situations listed exhaustively in the Law
Where a standard contract has been signed, it must be notified to the Board within five working days of signature. The text of the standard contract must be used without amendment; provisions the parties wish to add to meet their own needs should be set out in a separate contract in a way that does not conflict with the standard contract.
Notice, requests and complaints
When obtaining data, the data controller must inform the data subject of its identity, the purpose of processing, to whom and for what purpose the data may be transferred, the method of collection and legal ground, and the data subject's rights (KVKK Art. 10). The privacy notice and the explicit consent text should be separate documents; combining the two in a single text is a practice frequently criticised in Board decisions.
The data subject exercises their rights (KVKK Art. 11), such as learning whether their data is processed, correction, erasure, knowing the third parties to whom it was transferred and claiming compensation if they have suffered damage, by first applying to the data controller. The data controller must conclude the request within thirty days at the latest (Art. 13). If the request is rejected, the answer is found inadequate or no answer is given in time, the data subject may complain to the Board within thirty days of learning of the answer and in any event within sixty days of the date of the request (Art. 14). A complaint cannot be made directly to the Board without first applying to the data controller.
Data breaches and data security
The data controller must take appropriate technical and organisational measures to prevent unlawful processing of and unlawful access to data; if a service provider that processes data is used, it is jointly responsible with that provider for these measures (KVKK Art. 12). If processed data is obtained by others through unlawful means, the data subject and the Board must be notified as soon as possible. In a 2019 decision, the Board set this period at no later than 72 hours from learning of the breach.
What is done in the first hours after a breach determines the whole process that follows: establishing the scope of the breach and the categories of data affected, preserving technical logs, completing the Board's notification form in full, and the language and channel of the notice to data subjects. In breaches caused by cyber attacks, a criminal complaint, notification to insurers and notification to contracting companies often arise at the same time.
VERBİS and administrative sanctions
Data controllers must register with the Data Controllers' Registry (VERBİS) before they start processing (KVKK Art. 16). The Board has exempted from the registration obligation data controllers whose number of employees and annual balance sheet total fall below certain thresholds and whose main activity is not processing special categories of data. As the thresholds can be changed by Board decision, the company's position should be checked against the current decision.
Breaches of the obligation to inform, data security obligations, Board decisions and the VERBİS registration obligation are subject to administrative fines under KVKK Art. 18. As fine amounts are increased each year by the revaluation rate, current amounts should be followed in the Authority's announcements. Following the amendment made by Law No. 7499, since 1 June 2024 administrative fines imposed by the Board have been challenged before the administrative court rather than the criminal judgeship of peace. The general rule in Administrative Procedure Law No. 2577 applies to the time limit for filing an action.
Unlawfully recording personal data, giving it to others, obtaining it and failing to destroy data whose retention period has expired are criminal offences (Turkish Criminal Code No. 5237, Arts. 135–140). If the Board detects a suspected offence during an investigation, it may report the matter to the public prosecutor.
How is a compliance project carried out?
Although every company's data structure is different, compliance work usually follows the same backbone. The first step is a personal data inventory showing which department processes which data, for what purpose, on what legal ground and with whom it is shared. Next, privacy notices and explicit consent texts, a personal data retention and destruction policy, contracts with data processors, cross-border transfer mechanisms, cookie management for the website and a procedure for answering data subject requests are prepared. In the final stage, employees are trained and a timetable is set for reviewing the processes at regular intervals.
Employee data is the most sensitive part of compliance projects: recruitment, performance appraisal, camera and vehicle tracking systems and e-mail monitoring concern both the KVKK and employment law. See also our Employment and Social Security Law page. For sector-specific requirements, the Telecommunications and Technology and Life Sciences and Healthcare pages may be helpful.
Our work in this area
We run KVKK compliance projects for companies and prepare inventories, policies, privacy notices and explicit consent texts, data processing agreements and standard contracts. We manage the notification process in data breaches, prepare responses to data subject requests and Board investigations, and follow up court actions against administrative fines. Information about our firm's own processing activities can be found on the Privacy Notice page.
Main topics
- KVKK compliance projects and personal data inventories
- Privacy notices, explicit consent and cookie management (KVKK Arts. 5, 10)
- Special categories of personal data (KVKK Art. 6)
- Cross-border data transfers and standard contracts (KVKK Art. 9)
- Data breach management and notification to the Board (KVKK Art. 12)
- Data subject requests and Board complaints (KVKK Arts. 11, 13, 14)
- VERBİS registration (KVKK Art. 16)
- Actions against administrative fines and personal data offences
Frequently asked questions
Is explicit consent needed for every processing activity?
No. Explicit consent is only one of the processing conditions listed in KVKK Art. 5. If the processing rests on another condition, such as performance of a contract, a legal obligation or legitimate interest, consent should not be requested; an unnecessary request for consent may mislead the data subject and has been criticised in Board decisions.
Does using a cloud service abroad count as a data transfer?
Transferring personal data to servers abroad or making it accessible from there is, as a rule, a cross-border transfer. In that case, reliance must be placed on an adequacy decision, appropriate safeguards or one of the occasional transfer situations in KVKK Art. 9; if a standard contract is used, the Board must be notified within five working days.
When must we notify the Board of a data breach?
KVKK Art. 12 requires notification "as soon as possible"; the Board has set this at no later than 72 hours from learning of the breach. If not all the information is yet clear, notification can be made with the information available and the gaps filled in later.
How can an administrative fine imposed by the Board be challenged?
Since 1 June 2024, an annulment action is filed before the administrative court against Board fines. The time limit for filing is calculated from notification of the decision under the general rule in Law No. 2577; it is advisable to check the time limit immediately against the notification date of the specific decision.
Is our company required to register with VERBİS?
The registration obligation applies, as a rule, to all data controllers. However, the Board has exempted data controllers that fall below the employee number and annual balance sheet thresholds and whose main activity is not processing special categories of data. As the thresholds may change, the company's position should be assessed against the current Board decision.
Legislation and sources
- Personal Data Protection Law No. 6698 (in Turkish)
- Personal Data Protection Authority – Board decisions and guidelines
- Turkish Criminal Code No. 5237 (in Turkish)
- Administrative Procedure Law No. 2577 (in Turkish)
- Official Gazette (Law No. 7499 of 12 March 2024)
The information on this page is general and does not constitute legal advice. As legislation may change, the current rules must be assessed separately for your particular situation.