What is special category personal data?
Special category personal data (Turkish: özel nitelikli kişisel veri; international counterpart: sensitive personal data) is a sub-category of personal data requiring heightened protection. Under KVKK Article 6, processing is prohibited unless one of the conditions listed in Article 6(3) applies, explicit consent being only one of them.
Categories listed in KVKK Article 6
- Race, ethnic origin
- Political opinion
- Philosophical belief, religion, sect, or other beliefs
- Appearance and dress
- Membership in associations, foundations, or unions
- Health and sexual life
- Criminal convictions and security measures
- Biometric and genetic data
Processing requirements
Article 6(3), as amended by Law No. 7499 (2024), allows processing of all special categories only where: (a) the data subject has given explicit consent; (b) it is expressly provided for by law; (c) it is necessary to protect the life or bodily integrity of a person unable to give valid consent; (d) the data subject has made the data public; (e) it is necessary to establish, exercise or protect a right; (f) persons under a duty of confidentiality or authorised institutions need it for public health, preventive medicine, diagnosis, treatment and care, or health-service planning and financing; (g) it is necessary to meet legal obligations in employment, occupational health and safety, social security, social services and social assistance; or (h) foundations, associations and other non-profits with political, philosophical, religious or trade-union aims process it for their members under the statutory conditions. Article 6(4) also requires the adequate measures set by the Board.
Additional technical and organizational measures
The KVKK Authority issued specific guidelines requiring encryption, access logging, isolated environments, and special authorization workflows for special category data. Where remote access to the data is needed, at least two-factor authentication is required. Read the Authority’s official decisions.
Practical implications for tech founders
HealthTech, EdTech (especially with under-18 users), HRTech (health screenings, background checks), facial recognition products, biometric authentication apps all process special category data. Budget for security audits and explicit consent UX before launch. See KVKK Tracker for past Authority fines on biometric and health data mishandling.
Sources. Law No. 6698 on the Protection of Personal Data (KVKK).