Recent development. On 18.02.2026 the Board issued Principle Decision 2026/347, holding that privacy notices and explicit consent texts may not be presented as a single intertwined text or collected with one tick-box — full explanation.
If your company employs people in Turkey, sells to Turkish customers, or processes data about individuals in Turkey, Law No. 6698 on the Protection of Personal Data — universally called KVKK — applies to you.
Most English-language material on this topic is either a machine translation of the statute or a law-firm brochure. This guide is the practical version: what the law asks for, and what you have to produce.
Note: General information, not legal advice. Turkish data protection practice is shaped by decisions of the Personal Data Protection Board; consult qualified Turkish counsel for your specific situation.
The short version
KVKK is structurally close to GDPR — same vocabulary of data controllers, data subjects, lawful bases and data subject rights — but differs in important operational details, especially around explicit consent, cross-border transfers and a public registry called VERBIS.
Four things you will need:
- A processing inventory covering every business process
- A privacy notice (aydınlatma metni) satisfying Article 10
- Explicit consent flows where no other lawful basis applies
- VERBIS registration, if you meet the registration criteria
Who is covered?
The law applies to data controllers processing personal data of individuals in Turkey. In practice this catches:
- Foreign companies with a Turkish branch, subsidiary or liaison office
- Employers with staff located in Turkey
- E-commerce and SaaS businesses with Turkish customers
- Groups whose HR, CRM or support systems hold records about people in Turkey
Being headquartered elsewhere does not remove the obligation, and GDPR compliance does not automatically satisfy KVKK. See KVKK vs GDPR.
Lawful bases (Article 5)
Processing is permitted without explicit consent when:
- It is expressly provided for in law
- It is necessary for the performance of a contract
- It is required to fulfil a legal obligation of the controller
- The data has been made public by the data subject
- It is mandatory for the establishment or protection of a right
- It is necessary for the legitimate interests of the controller, provided fundamental rights are not harmed
Otherwise, you need explicit consent — which must be specific, informed and freely given, and can be withdrawn at any time.
A frequent mistake by international teams: treating consent as the default basis. In Turkish practice, relying on consent where a contractual or legal basis exists actually weakens your position.
Special categories
Health, biometric, genetic, religious, philosophical, political, union membership, criminal record and similar data are special categories with stricter conditions. Processing them usually requires either explicit consent or a specific statutory basis, plus additional security measures determined by the Board.
The privacy notice (Article 10)
Your notice must state: the controller's identity, the categories of data processed, the purposes, the recipients of any transfers, the method and legal basis of collection, and the data subject's rights. It must be presented at the moment of collection — on the web form, in the employment file, at the reception desk.
VERBIS registration
VERBIS is a public registry of data controllers. Registration obligation depends on employee numbers, annual balance sheet totals and main activity, with specific rules for foreign-established controllers.
Two things international companies routinely miss:
- A foreign controller subject to registration may need to appoint a representative in Turkey.
- After registering, changes must be updated within 30 days.
Details: VERBIS registration for foreign companies.
Cross-border transfers
Transfers abroad are the area where KVKK and GDPR diverge most in practice. Transfers may be made on the basis of an adequacy decision, appropriate safeguards (including standard contractual clauses), or specific derogations — with notification requirements attached to some routes.
If your Turkish operation uses a cloud, CRM or email service hosted outside Turkey, you are making a cross-border transfer. Map these before you write your privacy notice.
Penalties — the 2026 figures
Administrative fines under Article 18 are nominal lira amounts, re-indexed every January by the revaluation rate. This matters more than it sounds: most English-language summaries of Turkish data protection still quote the 2025 band (TRY 68,083 – 13,620,402). Those numbers are a year out of date.
For 2026 the revaluation rate is 25.49% (General Communiqué No. 585 on the Tax Procedure Law, Official Gazette 27.11.2025 No. 33090), which puts the bands here:
| Violation (Art. 18) | Lower | Upper |
|---|---|---|
| Failure to fulfil the obligation to inform (privacy notice) | TRY 85,437 | TRY 1,709,200 |
| Failure to fulfil data security obligations | TRY 256,357 | TRY 17,092,242 |
| Failure to comply with Board decisions | TRY 427,263 | TRY 17,092,242 |
| Breach of VERBIS registration and notification obligations | TRY 341,809 | TRY 17,092,242 |
A separate band applies to failing to notify a standard contract used for a cross-border transfer: TRY 90,308 – 1,806,377.
Two things international teams routinely get wrong here. First, there is no turnover-based tier — unlike GDPR, these are absolute amounts, which makes nominal exposure lower for a large group but says nothing about the operational cost of a Board decision. Second, certain unlawful data acts carry criminal liability under Articles 135–140 of the Turkish Penal Code, a separate track from administrative fines. Full breakdown: KVKK fines in 2026.
What to do first: a practical order
- Map processes — HR, sales, support, marketing, security cameras, vendors
- Assign a lawful basis to each process (avoid defaulting to consent)
- List cross-border transfers explicitly
- Draft the privacy notice and publish it wherever data is collected
- Separate consent flows for marketing communications
- Check the registration criteria and register if required
- Set retention periods and a periodic deletion routine
- Have Turkish counsel review everything before it goes live
A ready-made checklist: KVKK compliance checklist.
FAQ
Does GDPR compliance cover KVKK?
No. The frameworks are similar but not equivalent — consent handling, transfer rules and the VERBIS registry all differ. GDPR work gives you a strong starting inventory, not compliance.
Do documents have to be in Turkish?
Privacy notices addressed to individuals in Turkey should be available in Turkish so they are genuinely understandable. Bilingual documents are common practice.
We only have customers, no office in Turkey. Are we in scope?
If you process personal data of individuals in Turkey, the law is generally considered applicable. Whether registration is also required depends on the criteria and your structure — take local advice.
Who signs off internally?
The data controller — meaning the company — remains responsible. Appointing a contact person for VERBIS does not transfer liability.
Our GDPR privacy notice is translated into Turkish. Is that enough?
Usually not, and the reason is structural rather than linguistic. Since Principle Decision 2026/347 (18 February 2026), the privacy notice and the explicit consent text must be separate documents with separate declarations, and you may not ask anyone to "accept" a privacy notice — only to confirm they have read and understood it. A translated GDPR notice that bundles acknowledgement and consent into one tick-box passes European review and fails in Turkey. See Decision 2026/347.
Sources
- Law No. 6698 on the Protection of Personal Data (full text, Turkish)
- Turkish Personal Data Protection Authority (KVKK)
- Principle Decision No. 2026/347 of 18.02.2026 — public announcement on separating privacy notice and consent
- Regulation on the Data Controllers Registry (VERBIS)
- General Communiqué No. 585 on the Tax Procedure Law — 2026 revaluation rate 25.49% (Official Gazette 27.11.2025, No. 33090)
- Turkey's data protection amendments for 2024: a closer look — IAPP
This article is based on the sources above. Legislation and Board practice change — in particular the adequacy position and the annual fine bands — so rely on the Authority's current publications and Turkish counsel before acting.
Produce the paperwork faster: KVKK Otomat turns your process map into a privacy notice, consent text, processing inventory, retention policy and VERBIS preparation list. Documents are drafts; review by Turkish counsel is recommended.
No time to do it yourself? We prepare the Turkish document set for you — including cross-border transfer mapping and an English explanatory memo. Done-for-you service, from EUR 450. The tools stay free either way.
