Turkey. Comprehensive data protection. Act

KVKKLaw No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu)

In force

Partly verified

Medium confidence. Law No. 7499 published in the Official Gazette 2024-03-12. 2026 revalued fine amounts not verified.

§1Summary

Synopsis

Turkey's main data protection law, modelled on Directive 95/46, covering lawful grounds, special category data, rights, security, VERBIS registration and transfers. The 2024 amendments introduced GDPR-style transfer tools (adequacy, standard contracts, BCRs, undertakings) and broadened grounds for special category data.

Key themes

explicit consent
special category data
VERBIS registration
data security
breach notification
cross-border transfers
standard contracts

Unique features

Board-issued standard contracts must be notified to the Authority within 5 business days; VERBIS registration for many foreign controllers; fines revalued annually.

SaaS relevance

Foreign SaaS providers processing Turkish residents' data may need VERBIS registration and a Turkish representative, and must use Board standard contracts for exports.

§2Obligations

Extraterritorial: Limited
Breach notification: Authority within 72h; individuals as soon as possible
DPO: No
Cross-border transfers: Adequacy/Board standard contracts (notify in 5 business days)/BCRs/undertakings/occasional exceptions
Maximum penalty: Administrative fines revalued annually (2023 max ~TRY 13.6m per violation); criminal penalties under Penal Code

§3Dates

Key dates

Adopted 24 March 2016
In force 7 April 2016
Published 2016-04-07 (OG 29677); some articles from 2016-10-07; Law No. 7499 (OG 2024-03-12) amended Arts 6, 9, 18 effective 2024-06-01; cross-border Regulation published 2024-07-10; consent-only transfers to be replaced by 2024-09-01

§4Text and authority

Text

Authoritative text mevzuat.gov.tr
English text kvkk.gov.tr

Authority

Personal Data Protection Authority (KVKK) / Personal Data Protection Board

§5Where it applies

Domestic law of: Turkey

§6Sources and verification

Sources consulted

kvkk.gov.tr

Verification

Medium confidence.

Partly verified

Medium confidence. Law No. 7499 published in the Official Gazette 2024-03-12. 2026 revalued fine amounts not verified.