Guides
English-language guidance for companies with staff, customers or operations in Turkey.
Turkey Now Requires Privacy Notices and Consent to Be Separate Documents (Decision 2026/347)
Turkey's Data Protection Board ruled that privacy notices and explicit consent texts cannot be combined into one document or one tick-box. What Decision 2026/347 requires, what it prohibits, and how to remediate your Turkish-facing forms.
Transferring Personal Data Out of Turkey: What Replaced Explicit Consent
Since September 2024 explicit consent is no longer a routine basis for transferring personal data out of Turkey. What the three-tier framework requires, why standard contractual clauses are the practical route, and the five-business-day notification that trips companies up.
KVKK Fines in 2026: The Actual Amounts and What Triggers Them
Turkey's 2026 administrative fine bands under Article 18 of Law No. 6698, the separate band for cross-border standard contract notification, how the amounts are indexed each year, and why they are not comparable to GDPR fines.
VERBIS Registration for Foreign Companies: What You Need to Know
Whether foreign-established data controllers must register with VERBIS, who can serve as the Turkey-resident data controller representative, the five powers the appointment decision must grant, and what the declaration asks for.
Turkish Data Protection Law (KVKK): A Guide for Foreign Companies
What Law No. 6698 requires, who it applies to, and what foreign companies operating in or selling to Turkey must do. Documents, VERBIS registration and penalties explained.
KVKK vs GDPR: The Differences That Actually Change Your Compliance Work
Turkey's KVKK looks like GDPR but differs on consent, cross-border transfers, the VERBIS registry and data subject rights. A practical comparison for compliance teams.
KVKK Compliance Checklist for Companies Operating in Turkey
A practical, step-by-step KVKK compliance checklist in English: inventory, privacy notice, consent, transfers, VERBIS, retention and security measures.