Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Breach notification
cite Law No. 6698, Art. 12(5)
stage IN FORCE in force since 2016-04-07
binds public and private bodies
source official statute text, KVKK Kurumu consolidated English translation
What it requires →
Art. 12(5) requires a controller to notify the affected data subject and the Board within the shortest time where personal data has been obtained unlawfully by others; the Board may make the breach public. KVKK's own text sets no numeric deadline. Any numeric standard would sit in KVKK Board secondary guidance, which was not read for this document.
Comprehensive regime
What it requires →
KVKK is Turkey's single omnibus personal-data statute, broadly General Data Protection Regulation (GDPR)-modeled, covering both public institutions and private-sector data controllers. Art. 5 sets the lawful bases: explicit consent by default, or one of six alternative grounds (a legal provision, vital-interest necessity, contract necessity, a legal obligation, the data subject's own publication of the data, the controller's legitimate interest, or establishment or exercise of a right).
Controller and processor are defined at Art. 3(g)/(i). Law No. 7499 (2 March 2024) amended the special-categories and cross-border transfer articles without changing this general lawful-basis structure.
Cross border transfer
What it requires →
Post-2024 Art. 9 requires an Art. 5/6 lawful basis for the underlying processing plus a cross-border mechanism: a Board adequacy decision published in the Official Gazette for the destination, or, absent adequacy, Board-approved binding corporate rules, a Board-published standard contract, a Board-approved written commitment, or an international convention Turkey is party to.
A party relying on the standard-contract route must notify the Authority within 5 business days of signature (Art. 9(5)); failure carries its own fine tier added by the 2024 amendment. The pre-2024 near-blanket explicit-consent requirement remained in force in parallel until 1 September 2024 under Provisional Art. 3, so the amended, adequacy-first regime described here is genuinely in effect only from that date. No data localization is compelled.
Data subject rights
cite Law No. 6698, Art. 11
stage IN FORCE in force since 2016-04-07
binds public and private bodies
source official statute text, KVKK Kurumu consolidated English translation
What it requires →
Art. 11 gives a data subject the right to learn whether their data is processed, to request information on processing, to learn its purpose and whether use matches that purpose, to know the data's domestic and foreign transferees, to request rectification, to request erasure or destruction under Art. 7, to have those operations reported to prior transferees, to object to a result produced solely through automated analysis, and, at Art. 11(1)(g), to claim compensation for damage from unlawful processing.
Enforcement supervision
cite Law No. 6698, Arts. 11(1)(g), 18
stage IN FORCE in force since 2016-04-07
binds public and private bodies
source official statute text, KVKK Kurumu consolidated English translation
What it requires →
The Personal Data Protection Board (KVKK) enforces the Act with tiered administrative fines under Art. 18: 5,000 to 100,000 TL for notice failures, 15,000 to 1,000,000 TL for security failures, 25,000 to 1,000,000 TL for noncompliance with a Board decision, 20,000 to 1,000,000 TL for registry failures, and, added by Law No. 7499 in 2024, 50,000 to 1,000,000 TL for Art. 9(5) transfer-notification failures; fines are now appealable to administrative courts under Art. 18(3), also added in 2024.
Art. 11(1)(g) lets a data subject claim compensation for the damage arising from the unlawful processing, which requires proof of damage, unlike a no-proof-of-damage statutory-damages tort found elsewhere in this region.
Sensitive categories
What it requires →
Art. 6(1) lists biometric and genetic data, alongside race, ethnic origin, political opinion, philosophical belief, religion, health, sexual life, criminal convictions, and trade-union or association membership, as special-category data.
Processing requires one of the Art. 6(3) grounds added by the 2024 amendment: explicit consent, a legal provision, vital-interest necessity, the subject's own publication of the data consistent with the subject's intention to make it public, rights establishment, public health necessity, employment or social security law, or a closed list of nonprofit-association member data; the pre-2024 text instead required near-universal explicit consent.
KVKK gives no statutory definition of biometric data, voiceprint, or faceprint anywhere in the Act, so the term must be read inclusively: a voiceprint or faceprint captured for identification falls within the undefined biometric data category and triggers this special-category regime, even though no provision names either modality or sets a biometric-specific retention rule.
