Erdem Mümtaz Hacıpaşaoğlu spoke on Türkiye’s data-protection regime (KVKK) at an event hosted by ELSA (the European Law Students’ Association), introducing students to the fundamentals of personal-data protection under Turkish law.
The talk covered the core concepts of the Law on the Protection of Personal Data No. 6698: lawful bases for processing, data-controller obligations, data-subject rights, and the role of the Turkish data-protection authority.
Why the fundamentals still decide most cases
Compliance failures rarely turn on an exotic point of law. They turn on the basics: processing without an identifiable lawful basis, a notice that does not describe what the organisation actually does, and no record of who decided what. Consent is the most over-used basis and the weakest — particularly where there is a power imbalance, as in employment. Getting the KVKK basis right at the design stage is what makes everything downstream defensible.
The obligations follow the role. A processor acting on instructions carries different duties from the controller that determines purposes and means, and the contract between them is where that allocation lives. Where the processing is high-risk, a data protection impact assessment is the document that shows the analysis was done before deployment rather than after an incident.
For what the authority has actually been penalising, see What KVKK Punished in 2026. Practical starting points: our KVKK compliance guide and the KVKK + GDPR checklist. Practice page: KVKK & GDPR Compliance.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call