Law note · Turkey

Personal Data Protection Law (KVKK), enforcement and compensation

cite Law No. 6698, Arts. 11(1)(g), 18 stage IN FORCE in force since 2016-04-07 kind Enforcement supervision binds public and private bodies reviewed 2026-08-29

What it requires

An app processing the personal data of a person in Turkey must be prepared to answer to the KVKK Board for its lawful basis and safeguards, facing tiered administrative fines for a violation, and an individual harmed by unlawful processing may claim compensation in court, but only on proof of the damage suffered.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Private right of action: Yes

What we found

The Personal Data Protection Board (KVKK) enforces the Act with tiered administrative fines under Art. 18: 5,000 to 100,000 TL for notice failures, 15,000 to 1,000,000 TL for security failures, 25,000 to 1,000,000 TL for noncompliance with a Board decision, 20,000 to 1,000,000 TL for registry failures, and, added by Law No. 7499 in 2024, 50,000 to 1,000,000 TL for Art. 9(5) transfer-notification failures; fines are now appealable to administrative courts under Art. 18(3), also added in 2024.

Art. 11(1)(g) lets a data subject claim compensation for the damage arising from the unlawful processing, which requires proof of damage, unlike a no-proof-of-damage statutory-damages tort found elsewhere in this region.

Primary source

official statute text, KVKK Kurumu consolidated English translation

← Back to the example · Lint your app →