Turkey's Regulatory Landscape at a Glance
Turkey's framework rests on Law No. 6698, together with secondary regulation, Board decisions, and guidance. Two features define it operationally: the VERBIS registry of data controllers, and a transfer regime that was until recently among the most restrictive anywhere and has now been brought closer to European practice.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Turkey
- Primary data protection framework
- Law No. 6698 on the Protection of Personal Data (KVKK), 2016
- Major amendment
- Law No. 7499, with the revised transfer regime effective 1 June 2024
Key Regulations in Turkey
Law No. 6698 (KVKK)
Law No. 6698 took effect in 2016 and was closely modelled on the European Data Protection Directive rather than on the GDPR, which it predates. It applies to natural and legal persons processing personal data, and to data controllers resident outside Turkey whose processing relates to data subjects in Turkey.
The Law is explicit consent oriented. Consent must be freely given, informed, and expressed through a specific affirmative act, and the Board has interpreted the conditions for consent strictly.
Depending on applicability, organisations may need to address:
- Explicit consent or another condition in the Law for processing.
- Stricter conditions for special categories of personal data.
- The information obligation owed to data subjects at collection.
- Registration in the VERBIS data controllers registry.
- A personal data processing inventory.
- Data security obligations specified by Board decision.
- Notification of data breaches to the Board and data subjects.
- Conditions for transferring personal data abroad.
Because the Law predates the GDPR, concepts such as legitimate interests exist but are framed differently and should not be mapped across without checking.
VERBIS Registry
Data controllers must register with the Data Controllers Registry Information System, known as VERBIS, before beginning to process personal data, unless an exemption applies. Exemption criteria have been set by the Board by reference to the number of employees, annual financial balance, and the nature of the processing.
Registration requires disclosure of the purposes of processing, data categories, recipients, retention periods, transfers abroad, and the measures taken, and must be kept up to date.
Organisations assessing registration may need to consider:
- Whether an exemption applies on employee numbers or financial criteria.
- That processing special categories of data as a main activity removes some exemptions.
- Designation of a contact person for the registry.
- The requirement for non-resident controllers to register through a representative.
- Keeping the registration current as processing changes.
VERBIS entries are publicly accessible, so registrations should be accurate and consistent with published privacy notices.
The 2024 Transfer Reforms
Before the amendment, transferring personal data abroad required either the data subject's explicit consent or, in the absence of an adequacy decision, an undertaking signed by the parties and approved in advance by the Board. No adequacy decisions had been issued and Board approvals were slow and few, so in practice explicit consent was the only workable route.
Law No. 7499 introduced additional mechanisms from 1 June 2024, including standard contractual clauses published by the Board and binding corporate rules for group transfers, together with provision for transfers based on the conditions in the Law where an adequacy decision does not exist.
Organisations transferring data abroad may need to consider:
- Whether an adequacy decision covers the destination.
- Use of the Board's standard contractual clauses.
- Binding corporate rules for intra-group transfers.
- Notification of executed standard contractual clauses to the Authority.
- Whether reliance on explicit consent remains appropriate.
- Documentation of the transfer basis for each flow.
Executed standard contractual clauses must be notified to the Authority within the period set by the regulation, which is a procedural step that is easy to miss.
Special Categories of Personal Data
Special categories include race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
The 2024 amendment revised the conditions for processing special categories, moving from a narrow list towards a set of conditions closer to Article 9 of the GDPR.
Organisations processing special categories may need to consider:
- Which condition in the amended Law applies.
- Explicit consent where no other condition is available.
- Additional security measures required by Board decision.
- That appearance is treated as a special category, which affects photographs and video.
- Restrictions on transferring special categories abroad.
Turkey treats physical appearance as a special category, which brings routine photography and video footage into a stricter regime than in most jurisdictions.
Data Security and Breach Notification
The Law requires appropriate technical and organisational measures, and the Board has published detailed guidance specifying expectations, with additional measures for special categories of personal data. Compliance is assessed against that guidance in practice.
Where personal data is unlawfully obtained by others, the data controller must notify the Board and the affected data subjects. The Board has determined that notification to it should be made within seventy-two hours of becoming aware.
Organisations responding to an incident may need to consider:
- The seventy-two hour period for notifying the Board.
- Notification to affected data subjects at the earliest opportunity.
- The Board's prescribed notification form and content.
- Additional measures expected where special categories are involved.
- Record-keeping of incidents and the assessment made.
The seventy-two hour period comes from a Board decision rather than the Law itself, which is characteristic of how the Turkish regime develops.
Representation and Sectoral Rules
A data controller not resident in Turkey must appoint a representative in Turkey, which may be a Turkish legal person or a Turkish citizen resident there, and register through that representative. Sectoral legislation applies alongside the Law, including banking and payment services regulation, electronic communications rules, and e-commerce legislation governing commercial electronic messages.
Organisations may need to consider:
- Appointment and powers of the Turkey representative.
- Banking and payment sector data localisation expectations.
- Electronic communications confidentiality requirements.
- Consent requirements for commercial electronic messages.
- Sector guidance issued by the relevant regulators.
Financial sector rules in Turkey have included expectations about keeping certain systems and data in-country, which should be assessed separately from the Law.
Who Needs to Comply With Turkish Data Protection Law?
Law No. 6698 and related requirements may apply to:
Organisations in Turkey
Natural and legal persons processing personal data wholly or partly by automated means or as part of a filing system.
Non-resident data controllers
Organisations outside Turkey processing the personal data of data subjects in Turkey, which must appoint a Turkey representative.
Organisations requiring VERBIS registration
Data controllers not covered by an exemption, which must register before processing begins and keep the entry current.
Data processors
Service providers processing on a controller's instructions, which share responsibility for data security under the Law.
Employers
Organisations handling employee data, including health information and biometric access systems treated as special categories.
Organisations using photography or video
Businesses processing images, since appearance is a special category of personal data in Turkey.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under KVKK
Explicit Consent and Lawful Conditions
Processing requires the data subject's explicit consent unless one of the conditions in the Law applies, such as necessity for a contract, a legal obligation, establishment or protection of a right, or the legitimate interests of the controller where fundamental rights are not harmed.
The Board requires consent to be separate from other declarations and has rejected consent bundled into general terms.
The Information Obligation
At the time personal data is obtained, data subjects must be informed of the identity of the controller and any representative, the purposes of processing, to whom and for what purpose data may be transferred, the method and legal basis of collection, and their rights under the Law.
The information obligation is separate from consent and must be discharged even where consent is not the basis for processing.
VERBIS Registration and Inventory
Unless exempt, data controllers must register with VERBIS before processing begins, designate a contact person, and prepare a personal data processing inventory on which the registration is based and which must be kept current.
Data Security
Controllers must take technical and organisational measures to prevent unlawful processing and access and to preserve personal data, following the detailed expectations the Board has published, with enhanced measures where special categories are processed.
Controllers remain jointly responsible with their processors for data security under the Law.
Breach Notification
Where personal data is unlawfully obtained by others, the controller must notify the Board, which by Board decision should be within seventy-two hours of awareness, and notify the affected data subjects at the earliest opportunity.
Transfers Abroad
Transfers abroad require an adequacy decision, or one of the mechanisms introduced by the 2024 amendment including the Board's standard contractual clauses or binding corporate rules, or reliance on the conditions in the Law, with explicit consent remaining available in defined circumstances.
Standard contractual clauses must be notified to the Authority within the prescribed period after signature.
Data Subject Rights Under KVKK
Law No. 6698 gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Learn and Access
Data subjects may learn whether their personal data is processed and request information about the processing.
Purpose Verification
Data subjects may learn the purpose of processing and whether their data is used in accordance with that purpose.
Correction
Data subjects may request correction of incomplete or inaccurate personal data, and that recipients be notified.
Deletion or Destruction
Data subjects may request erasure or destruction where the conditions for processing no longer exist.
Objection to Automated Decisions
Data subjects may object to an adverse outcome resulting from analysis of their data solely by automated means.
Compensation
Data subjects may claim compensation for damage suffered as a result of unlawful processing.
Requests must generally be answered within thirty days, and data subjects must apply to the controller before complaining to the Board.
Turkey's Regulatory Timeline
Turkey legislated in 2016 and reformed its transfer regime in 2024.
- April 2016
Law No. 6698 Enacted
Turkey's data protection law took effect, modelled on the pre-GDPR European framework, establishing the Authority and the Board.
- 2018
VERBIS Opens
The data controllers registry became operational, with registration deadlines phased by category of controller.
- 2019
Breach Notification Period Set
A Board decision established that notification of data breaches to the Board should be made within seventy-two hours of awareness.
- June 2024
Transfer Reforms Effective
The amended transfer regime took effect, introducing standard contractual clauses and binding corporate rules alongside adequacy decisions.
Important: administrative fines under the Law are revalued annually for inflation, and much of the operational detail sits in Board decisions. Confirm current amounts and requirements from official sources.
Data Protection Authorities in Turkey
The Personal Data Protection Authority, with the Personal Data Protection Board as its decision-making organ, administers Law No. 6698. The Board issues binding decisions, publishes guidance and standard contractual clauses, operates VERBIS, investigates complaints, and imposes administrative fines. Its published decisions are the principal source of interpretation.
Other authorities are relevant depending on sector, including the Banking Regulation and Supervision Agency and the Central Bank for financial institutions, the Information and Communication Technologies Authority for electronic communications, and the trade ministry for commercial electronic messages.
Because much of the regime is developed through Board decisions rather than statute, monitoring published decisions is part of staying compliant in Turkey.
Penalties for Non-Compliance
The Law provides administrative fines for breaches of the information obligation, data security obligations, failure to comply with Board decisions, and failure to register with VERBIS where required. The amounts are set out in the Law but are revalued each year in line with the statutory revaluation rate, so the figures change annually. This page therefore does not quote them, and current amounts should be taken from official sources.
Fines are imposed on the data controller, and in the case of public institutions disciplinary proceedings may follow instead. The Turkish Criminal Code separately criminalises unlawfully recording, transferring, or obtaining personal data and failing to destroy data when required, with penalties including imprisonment. Data subjects may also claim compensation for damage through the civil courts.
How RegulatoryBridge Supports Compliance in Turkey
RegulatoryBridge helps organisations assess Turkey's regulatory requirements and coordinate their compliance activities with wider international programmes.
KVKK Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Contact Person and Representative Assessment
Review your VERBIS contact person designation and, for non-resident data controllers, the Turkey representative requirement and how it is evidenced.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and KVKK Board Notification
Evaluate breach assessment procedures, escalation responsibilities, KVKK Board notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers abroad under the amended regime, including standard contractual clauses, binding corporate rules, and the notification each route requires.
Sectoral Compliance Coordination
Help organise requirements across KVKK, banking and payment rules, electronic communications, and e-commerce legislation.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, KVKK Board guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Turkey Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Turkey.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Turkey Compliance
Need KVKK support in Turkey?
We support your VERBIS registration, Turkey representative arrangements, and transfer documentation - so your global product team doesn't have to.