Law note · Turkey
Personal Data Protection Law (KVKK), comprehensive regime and lawful basis
cite Law No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10
stage IN FORCE in force since 2016-04-07
kind Comprehensive regime
binds public and private bodies
reviewed 2026-08-29
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Turkey must establish one of KVKK Art. 5's lawful bases, most commonly explicit consent, before processing, and must confine use to the stated purpose of collection.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
KVKK is Turkey's single omnibus personal-data statute, broadly General Data Protection Regulation (GDPR)-modeled, covering both public institutions and private-sector data controllers. Art. 5 sets the lawful bases: explicit consent by default, or one of six alternative grounds (a legal provision, vital-interest necessity, contract necessity, a legal obligation, the data subject's own publication of the data, the controller's legitimate interest, or establishment or exercise of a right).
Controller and processor are defined at Art. 3(g)/(i). Law No. 7499 (2 March 2024) amended the special-categories and cross-border transfer articles without changing this general lawful-basis structure.