Part of our KVKK Compliance Guide — Open the guide →
What is KVKK (Turkish Data Protection Law)?
KVKK (Law No. 6698 on the Protection of Personal Data, 2016) is Türkiye’s general data protection statute: the Turkish counterpart to the GDPR, enforced by the Personal Data Protection Authority and its Board (KVK Kurumu / Kurulu). It governs every processing of personal data by controllers and processors with a Turkish nexus, from HR files to product analytics.
Where it differs from GDPR
KVKK predates the GDPR (it was modeled on the 1995 EU Directive), and the differences bite in practice. Explicit consent plays a larger role, especially historically for special-category data; the 2024 amendments introduced GDPR-style legal bases for sensitive data and rebuilt the cross-border transfer regime around adequacy decisions, standard contractual clauses (which must be notified to the Authority within five business days) and binding corporate rules. Distinctly Turkish: the VERBİS registry, where qualifying controllers must register before processing, and a data-breach notification window of 72 hours under Board practice.
What enforcement looks like
The Board publishes decisions and fines regularly; recurring themes are unlawful cross-border transfers, missing VERBİS registration, disproportionate data collection (biometrics for attendance is a standing target), unsolicited marketing and inadequate security measures. Administrative fines are updated annually by revaluation and can reach into the tens of millions of lira for the most serious categories; beyond fines, the Board can order processing suspended: operationally the sharper sanction.
We comply with GDPR: are we automatically KVKK-compliant?
No. GDPR compliance covers much of the substance, but KVKK adds Turkish-specific mechanics: VERBİS registration, Turkish-language disclosure texts (aydınlatma metni), consent wording standards and the transfer-notification requirements have no GDPR equivalent.
Does KVKK apply to foreign companies?
The Board applies KVKK to foreign controllers processing data of persons in Türkiye, particularly where goods or services target the Turkish market: several enforcement decisions against global platforms confirm the extraterritorial reading.
Working on this? Vircon Legal advises on KVKK & GDPR Compliance and KVKK compliance guide. Talk to us →
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call