You answered a data subject’s request over the phone. Does that count as a response under the KVKK? According to the public announcement the Turkish Personal Data Protection Authority published on 1 October 2026, it does not. An oral explanation does not discharge the response obligation in Article 13 of Law No. 6698; the final response must be notified to the data subject in writing or electronically.
What the announcement says
In investigations opened on complaints it received, the Authority found that some data controllers were answering data subject requests only by phone call, face-to-face explanation or similar oral means. The announcement makes two points explicitly:
- The final response to a request must be notified to the data subject in writing or electronically.
- A phone call, face-to-face explanation or similar oral communication is not accepted as the response required by Article 13 of the Law and Article 6 of the Communiqué on the Procedures and Principles of Applications to the Data Controller.
The announcement does not create a new obligation. Article 13(3) of the Law already provides that the data controller accepts the request or rejects it with reasons and notifies its response to the data subject in writing or electronically. What the announcement does is spell out how that obligation must be performed, prompted by a deviation the Authority has seen in practice.
Can you still talk to the data subject?
Yes. The Authority expressly accepts that the data controller may contact the data subject by phone, in person or by similar means while assessing the request, to ask for additional information or documents, to clarify the request or to update them on the process. Those conversations do not replace the final response. Even if everything was discussed on the phone and the data subject was satisfied, the request must still be answered in writing or electronically.
What if the only answer was oral?
Since the Authority does not treat an oral explanation as a response under the Law, a request closed only on the phone risks looking, on the record, like a request that was not answered in time. Article 14 of the Law opens a complaint to the Board where the request is rejected, the response is found insufficient or no response is given in time; the complaint may be filed within thirty days of learning of the response and in any event within sixty days of the application. In such a complaint the data controller has no document showing how the request was resolved and when the response was notified. That is why the announcement stresses the written response in the context of Board complaint proceedings and possible court proceedings.
What data controllers should do
- Send the final response in writing or electronically. Whatever channel the request came through, notify the outcome in writing or by an electronic means such as email.
- Answer each request separately. If the application contains more than one request, state the extent to which each was met. If a request is rejected, give the reasons clearly.
- Record the action taken in the response. If you rectified or erased data, say so in the response.
- Keep a provable record. Retain the date the request was received, the steps taken and the date the response was sent, and track the statutory thirty-day maximum against those records.
- Review your request procedures. Check in particular whether call centres, customer service and stores close requests with an oral explanation only; staff in those channels need to know who sends the written response after the call and by when.
What a written response proves
As the Authority puts it, a response notified in writing or electronically makes the following clear, auditable and provable: whether the request was accepted, the reasons for any rejection, the steps taken under the request and the date the response was notified to the data subject. Oral communication can make the process smoother. What shows that the request was answered is the response delivered in writing or electronically.
We answered by phone and the data subject accepted. Do we still need a written response?
Yes. Under the announcement, oral communication is not accepted as the response required by Article 13 of the Law. The data subject’s acceptance of the oral explanation does not change that; the content and outcome of the call should also be notified in writing or electronically.
Is an email response enough?
The Law and the announcement require notification “in writing or electronically”, and email is electronic notification. What matters is that the content of the response and the date it was sent can be shown later.
How long do we have to respond?
Under Article 13 of the Law, the data controller concludes the requests in the application as soon as possible depending on their nature and within thirty days at the latest, free of charge; if the action requires an additional cost, the fee in the tariff set by the Board may be charged.
Related: VERBİS · records of processing · legitimate interest · KVKK decision summaries · standard contract filing.
Sources. Public Announcement on the Method of Notifying Responses to Data Subject Applications (Personal Data Protection Authority, 1 October 2026, in Turkish); Law No. 6698 on the Protection of Personal Data (Arts. 11, 13, 14; official Turkish text); Communiqué on the Procedures and Principles of Applications to the Data Controller (Art. 6).
This article is for general information only and does not constitute legal advice. Specific situations require legal advice.
Author
More from Vircon Insights
Data Subject Requests and the Obligation to Inform: Procedure in Five Decisions
August 20, 2026The Medium-Term Programme Puts a Date on KVKK-GDPR Alignment: What Changes for Compliance Programmes Caught Between Two Laws
September 8, 2026Service Provider Related Breaches: Why Does Liability Stay With the Data Controller?
August 16, 2026Türkiye's DPA Draws the Line on Biometrics: Attendance Is Out, Security Access Is Conditional
August 27, 2026Two Credit Bureau Decisions and the Full Index of the 47 Decision Summaries
August 23, 2026When Does the Board Take No Action? Five Low-Risk Breach Decisions
August 22, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →