Introduction
Turkey's Law No. 6698 on the Protection of Personal Data, commonly referred to as KVKK, has governed the processing of personal data since 2016. It applies to personal data of natural persons processed wholly or partly by automated means and to non-automated processing that forms part of a data filing system. The law is built around general processing principles, limited lawful grounds, transparency, data security and enforceable rights of the data subject.1
A foreign company should not assume that GDPR compliance automatically answers the Turkish analysis. Law No. 6698 does not reproduce the GDPR's Article 3 territorial test in the same language. At the same time, the Data Controllers Registry By-Law expressly contemplates data controllers not established in Turkey and provides for a Turkish representative where a foreign controller has a registration obligation. The safe approach is therefore a fact-specific assessment of the controller, processing activity, Turkish market connection, transfer structure and any VERBIS duty, rather than a simple test based on whether the company has a local office.2
1. Data controllers, processors and the compliance map
The data controller, veri sorumlusu, is the person or entity that determines the purposes and means of processing and is responsible for establishing and managing the relevant filing system. A data processor, veri işleyen, processes personal data on behalf of the controller. The distinction is functional. A supplier described in a contract as a processor can still become a controller for processing purposes it determines independently.3
For a business, the first compliance exercise should therefore be a data map. Identify the categories of people whose information is processed, the data collected, the purpose of each processing operation, the legal basis, recipients, storage period, systems used, service providers and international data flows. That map should connect directly to the company's privacy notices, retention schedule, security controls, VERBIS filing where required, and transfer documentation.
Article 10 requires the controller to inform the data subject about the controller and any representative, the purposes of processing, recipients and transfer purposes, the collection method and legal basis, and the rights available under Article 11. Article 12 imposes security obligations, while Article 13 requires a workable channel for data subject requests. These duties should be treated as operational controls, not only as website drafting.4
2. Lawful processing: explicit consent is not the default
Article 5 contains several lawful grounds other than explicit consent, including processing expressly provided by law, processing necessary for a contract, compliance with a legal obligation, establishment or protection of a right, and processing necessary for the controller's legitimate interests where the data subject's fundamental rights and freedoms are not harmed. A controller should identify the legal basis that actually fits the purpose. Seeking consent where another legal basis is being used can create confusion about whether processing truly depends on a revocable choice.
This point became even more visible in 2026. In Principle Decision No. 2026/347, the Board stated that the information notice and an explicit-consent text are legally different instruments and should be presented separately. Where processing relies on a basis other than consent, the controller should provide the required information but should not ask for a separate consent merely as a formality.5
Consent, when genuinely required, must be specific, informed and freely given. It should not be bundled with unrelated purposes, made a condition of a service without justification, or drafted so broadly that the data subject cannot identify what is being authorised. In employment and other relationships involving a power imbalance, voluntariness requires particular care.
3. Special categories of personal data after the 2024 reform
The 2024 reform materially changed Article 6. Special categories still include information concerning race, ethnic origin, political opinion, philosophical belief, religion, appearance, association or union membership, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Law No. 7499 removed the former narrow structure and introduced a broader list of statutory conditions under which such data may be processed, including where processing is expressly provided by law, necessary for the establishment or protection of a right, or necessary for legal obligations in employment, occupational health and safety, social security, social services and social assistance.6
The reform does not make special-category data ordinary data. The controller must still satisfy the general principles in Article 4, use a valid Article 6 condition, and apply the additional safeguards required by the Board. This is particularly important for HR databases, health records, criminal record checks, biometric access systems and medical information.
The 2026 biometric attendance decision is a useful warning. In Principle Decision No. 2026/921, the Board concluded that processing biometric data merely to track working time generally cannot be justified by the other Article 6 conditions and that even consent does not cure a system that fails the proportionality requirement where less intrusive alternatives are available. The Board distinguished attendance monitoring from genuinely critical security uses, which require their own necessity and proportionality assessment.7
4. VERBIS registration: thresholds changed again in 2025
VERBIS is the Data Controllers Registry Information System. Controllers subject to registration must enter information concerning processing purposes, data subject and data categories, recipient groups, overseas transfers, security measures and maximum retention periods. Registration is not a substitute for compliance with the rest of Law No. 6698, but failing to register when required is itself sanctionable.
For controllers whose main activity is not processing special-category data, the current general exemption covers natural or legal person controllers with fewer than 50 annual employees and an annual financial balance sheet total below TRY 100 million. Both conditions must be considered together with the nature of the main activity.8
A significant 2025 change introduced a separate micro-enterprise exemption for controllers whose main activity is special-category data processing. Board Decision No. 2025/1572 exempts such controllers where the annual employee count is below 10 and the annual balance sheet total is below TRY 10 million. The Authority later published implementation guidance for the decision. A company should therefore use the current 2025 criteria, not an older checklist stating that every controller whose main activity involves sensitive data must register regardless of size.9
Foreign controllers require a separate assessment. The Registry By-Law provides for a representative in Turkey for controllers not established in Turkey where the registry rules apply. Corporate groups should not assume that a parent company, Turkish subsidiary and service provider can be treated as a single controller simply because they share systems.
5. Retention, deletion and processor governance
Lawful collection does not justify indefinite storage. Article 4 requires personal data to be retained only for the period prescribed by relevant legislation or necessary for the processing purpose. Article 7 and the By-Law on Erasure, Destruction or Anonymization require deletion, destruction or anonymisation when all processing conditions cease to exist. Controllers subject to the relevant policy requirement should maintain a personal data retention and destruction policy and periodic destruction schedule.10
Outsourcing also does not transfer the controller's responsibility away. Article 12 requires appropriate technical and organisational measures to prevent unlawful processing and access and to ensure preservation of the data. Where processing is carried out by another person on behalf of the controller, the controller and processor share responsibility for the security measures specified by the Law. Contracts should therefore deal expressly with security, access controls, confidentiality, incident escalation, sub-processors, deletion or return of data, audits and any international transfer mechanism.11
6. Cross-border transfers after the 2024 reform
Cross-border transfer was one of the areas most substantially changed by Law No. 7499. The amended Article 9, effective from 1 June 2024, introduced a structured system based on adequacy decisions, appropriate safeguards and, only where neither is available, specified exceptional transfer grounds. The Authority also issued the By-Law on the Procedures and Principles for the Transfer of Personal Data Abroad and standard contract texts in 2024.12
Where there is no adequacy decision, a recurring transfer may proceed if an Article 5 or Article 6 processing condition exists, data subjects can exercise rights and effective remedies in the destination, and one of the recognised safeguards is used. Those safeguards include approved binding corporate rules, the Board's standard contracts, a written undertaking with Board authorisation, and the specified public-sector agreement mechanism.
For private businesses, standard contracts are often the most practical mechanism. Article 9 requires the standard contract to be notified to the Authority within five business days after signature. The 2024 reform also introduced a separate administrative fine for failure to make that notification. Businesses should therefore maintain a signed-contract register and a calendar for the notification step, rather than treating the contract itself as the end of the process.13
Explicit consent still appears in Article 9, but its role is narrower than before. In the absence of adequacy and appropriate safeguards, consent is one of the exceptional grounds for an occasional transfer, and the data subject must be informed of the possible risks. It should not be presented as a general substitute for a durable mechanism supporting routine, repetitive intra-group HR transfers or permanent foreign cloud hosting.14
7. Data subject rights and complaint procedure
Article 11 gives data subjects rights including learning whether their data are processed, requesting information about processing, learning recipients, seeking correction, requesting deletion or destruction when the conditions are met, objecting to an adverse result produced exclusively by automated analysis, and claiming compensation for unlawful processing. The starting procedural step is normally an application to the data controller under Article 13.15
The controller must answer the application as soon as possible and, at the latest, within thirty days. If the request is rejected, the response is inadequate or no response is given in time, the data subject may complain to the Board within thirty days of learning the controller's response and, in any event, within sixty days from the original application. A business should therefore maintain a request log showing receipt date, identity-verification steps, internal owner, response date and the documents supplied.16
8. Data breaches: the 72-hour Board rule
Article 12(5) requires a controller to notify the data subject and the Board in the shortest time where processed personal data are obtained by others through unlawful means. Board Decision No. 2019/10 interprets the phrase "in the shortest time" for Board notification as no later than 72 hours after the controller becomes aware of the breach. A delayed notification should explain the reasons for the delay. Affected data subjects should be informed within the shortest reasonable period after they are identified.17
The breach team should therefore be able to answer, quickly and in writing, what happened, when the organisation became aware of it, which systems and categories of data were affected, how many people may be affected, what containment measures were taken, what risks exist for data subjects and what further remedial steps are planned. Waiting for a complete forensic report before deciding whether the 72-hour clock has started is not a safe process.
9. Enforcement and judicial perspective
Article 18 provides separate administrative fine categories for failures concerning the information duty, data security, Board decisions, VERBIS obligations and, following the 2024 reform, notification of a standard contract under Article 9(5). The statutory amounts are revalued annually, and the Authority publishes the current table. Law No. 7499 also changed the judicial route so that actions against Board administrative fines are brought before the administrative courts.18
Enforcement is not limited to fines. The Board may order the controller to remedy an infringement, and a company may also face contractual, employment, consumer, criminal or reputational consequences depending on the facts. Remediation should therefore address the underlying processing design, not only the amount of the administrative sanction.
Constitutional Court: employee e-mail monitoring
In Celal Oraj Altunörgü, Application No. 2018/31036, 12 January 2021, the Constitutional Court considered an employer's review of a corporate e-mail account. It found no violation on the facts, placing weight on the contractual notice that the account was for business use and could be monitored, the employer's legitimate purpose and the proportionality of the review. The decision should not be read as a general permission to inspect every employee message. Its value for businesses lies in the need for prior transparency, a legitimate purpose and a proportionate method.19
Danıştay: purpose limitation and sensitive health data
Danıştay 10th Chamber, E. 2019/10346, K. 2023/5654, 17 October 2023, reviewed provisions of the Regulation on Personal Health Data. The judgment emphasised that even processing carried out for a legitimate public purpose must remain connected with that purpose, limited and proportionate. The Court annulled parts of the regulation while rejecting other claims. For private businesses, the broader lesson is that a valid legal basis does not remove the separate requirements of purpose limitation and proportionality.20
10. Practical compliance steps for foreign businesses
A foreign business should begin with the Turkish data flows rather than with a global template. Identify the Turkish controller or controllers, any processor relationships, the current lawful basis for each significant activity, special-category data, retention rules, transfer destinations and the organisation responsible for responding to data subjects and incidents.
The next step is documentary alignment. The data map, privacy notices, consent texts where actually needed, VERBIS information, contracts with processors, international transfer documents and retention schedule should describe the same processing reality. The 2026 principle decision on consent notices is a reminder that copying a generic privacy text from another entity is not an adequate compliance method.
Finally, test the system operationally. Run a sample data subject request, a mock breach escalation and a cross-border transfer review. Confirm who can stop an unlawful processing activity, who files the 72-hour notification, who controls the standard-contract notification deadline and who is authorised to communicate with the Authority. A compliance program that exists only as documents may fail precisely when the organisation needs it most.
Frequently Asked Questions
Does KVKK apply if our company has no office or employees in Turkey?
Potentially. Law No. 6698 does not use the GDPR's territorial test verbatim, but the Turkish regulatory framework expressly contemplates controllers not established in Turkey and requires a local representative where a foreign controller has a registry obligation. Applicability should be assessed from the actual processing, controller role, Turkish connection and registry rules rather than office location alone.
Is VERBIS registration optional for a small foreign-owned subsidiary?
Not automatically. For ordinary controllers, the current exemption generally requires both fewer than 50 annual employees and an annual balance sheet total below TRY 100 million, provided the main activity is not special-category processing. Since 2025, a separate exemption applies to controllers whose main activity is special-category processing where they have fewer than 10 employees and a balance sheet below TRY 10 million. Other exemptions and entity-specific rules should also be checked.
Can we use employee consent for routine transfers to our foreign headquarters?
Routine transfers should normally be analysed first under the durable mechanisms in Article 9, such as an applicable adequacy decision, standard contract or approved binding corporate rules. The explicit-consent exception under the current Article 9 is framed for occasional transfers where the relevant safeguards are not available, after the data subject has been informed of the risks. It is not a reliable default for permanent intra-group data flows.
What happens if we suffer a personal data breach?
The controller should immediately contain and investigate the incident, record when awareness occurred, and assess notification. Under Board Decision No. 2019/10, notification to the Board should be made without delay and no later than 72 hours after awareness. Affected individuals should be informed in the shortest reasonable period once identified.
How long do we have to answer a data subject request?
The controller must answer as soon as possible and no later than thirty days. The response should be reasoned and should address the particular right exercised. An ignored request can become the procedural foundation for a complaint to the Board.
Can we use fingerprint or facial recognition simply because employees consent?
Not safely for ordinary attendance tracking. Board Principle Decision No. 2026/921 states that biometric processing for working-time attendance generally fails the lawful-basis and proportionality analysis where less intrusive methods are available, even if consent has been obtained. A genuinely critical security use requires a separate necessity and proportionality assessment.
Are KVKK fines fixed amounts?
No. Article 18 provides ranges for different categories of infringement, and the statutory amounts are revalued. The Authority publishes the applicable annual figures. The Board also considers matters such as the nature of the infringement, culpability and the economic circumstances of the controller when imposing a sanction.
Conclusion
KVKK compliance is not a one-time privacy-policy exercise. The core task is to connect each processing activity to a lawful purpose and legal basis, tell the data subject accurately what is happening, keep the data only as long as justified, protect it with proportionate technical and organisational measures, and document any domestic or international disclosures. The 2024 transfer and special-category reforms, the 2025 VERBIS exemption update and the 2026 principle decisions show that an older compliance package can become incomplete even where the business model itself has not changed.
For foreign companies, the most efficient approach is a Turkish-law gap analysis built on the group's real data architecture. That review should identify where group practices can be retained, where Turkish notices or registry steps are required, and where cross-border arrangements need a current Article 9 mechanism. The objective is not to produce the longest privacy file. It is to create a compliance record that accurately describes how the organisation actually uses personal data and can be demonstrated when a data subject, auditor or regulator asks.
Bibliography
Legislation and Official Rules
Personal Data Protection Law No. 6698, particularly Articles 2 to 18. Personal Data Protection Authority, official statutory text: https://www.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law.
Law No. 7499 on Amendments to the Code of Criminal Procedure and Certain Laws, Articles 33 to 36, Official Gazette No. 32487, 12 March 2024. TBMM official text: https://www.tbmm.gov.tr/Yasama/Kanun/dfab4c12-e3cd-4d22-a085-018db209a74b.
By-Law on the Data Controllers Registry, particularly Articles 5, 8, 9, 10 and 11. Personal Data Protection Authority: https://www.kvkk.gov.tr/Icerik/6635/By-Law-On-Data-Controllers-Registry.
By-Law on Erasure, Destruction or Anonymization of Personal Data. Personal Data Protection Authority: https://www.kvkk.gov.tr/Icerik/6636/By-Law-on-Erasure-Destruction-or-Anonymization-of-Personal-Data.
By-Law on the Procedures and Principles for the Transfer of Personal Data Abroad and standard contract texts, announced by the Personal Data Protection Authority in 2024: https://www.kvkk.gov.tr/Icerik/7999/Announcement-on-the-Translation-of-By-Law-on-The-Procedures-And-Principles-For-The-Transfer-of-Personal-Data-Abroad-and-Standard-Contract-Texts.
Judicial Decisions
Constitutional Court, Celal Oraj Altunörgü, Application No. 2018/31036, 12 January 2021. Official Decisions Database: https://kararlarbilgibankasi.anayasa.gov.tr/BB/2018/31036.
Danıştay 10th Chamber, E. 2019/10346, K. 2023/5654, 17 October 2023. Official Danıştay decision search: https://karararama.danistay.gov.tr/.
Constitutional Court, E. 2024/125, K. 2025/178. Official Norm Review Decisions Database.
Institutional and Official Materials
Personal Data Protection Board, Principle Decision No. 2026/347, 18 February 2026, on separating information notices and explicit-consent texts: https://www.kvkk.gov.tr/Icerik/8710/.
Personal Data Protection Board, Principle Decision No. 2026/921, 29 April 2026, on biometric data processing for attendance tracking: https://www.kvkk.gov.tr/Icerik/8762/.
Personal Data Protection Board, Decision No. 2025/1572, 4 September 2025, and related implementation announcement concerning VERBIS exemption criteria: https://www.kvkk.gov.tr/Icerik/8388/ and https://www.kvkk.gov.tr/Icerik/8577/.
Personal Data Protection Board, Decision No. 2019/10, 24 January 2019, on personal data breach notification: https://www.kvkk.gov.tr/Icerik/6647/.
Personal Data Protection Authority, Special Categories of Personal Data Processing Guide, updated after Law No. 7499: https://www.kvkk.gov.tr/Icerik/8184/.
Personal Data Protection Authority, annual administrative fine table for Law No. 6698, including 2026 revalued amounts: https://www.kvkk.gov.tr/Icerik/8145/.
Footnotes
1 Personal Data Protection Law No. 6698, arts. 1-4.
2 By-Law on the Data Controllers Registry, arts. 5 and 11.
3 Personal Data Protection Law No. 6698, art. 3.
4 Personal Data Protection Law No. 6698, arts. 10, 12 and 13.
5 Personal Data Protection Board, Principle Decision No. 2026/347, 18 February 2026.
6 Law No. 7499, art. 33, amending Law No. 6698, art. 6; Personal Data Protection Authority, Special Categories of Personal Data Processing Guide.
7 Personal Data Protection Board, Principle Decision No. 2026/921, 29 April 2026.
8 Personal Data Protection Board, Decision No. 2023/1154, 6 July 2023.
9 Personal Data Protection Board, Decision No. 2025/1572, 4 September 2025, and the Authority implementation announcement.
10 Law No. 6698, arts. 4 and 7; By-Law on Erasure, Destruction or Anonymization of Personal Data.
11 Law No. 6698, art. 12; Personal Data Protection Authority, Obligations Concerning Data Security.
12 Law No. 7499, art. 34, replacing Law No. 6698, art. 9; By-Law on Transfers Abroad.
13 Law No. 6698, art. 9(5) and art. 18(1)(d), as amended in 2024.
14 Law No. 6698, art. 9(6)(a), as amended by Law No. 7499.
15 Law No. 6698, arts. 11 and 13; Personal Data Protection Authority, Right to Make a Request.
16 Law No. 6698, arts. 13 and 14; Personal Data Protection Authority, Right to Lodge a Complaint.
17 Personal Data Protection Board, Decision No. 2019/10, 24 January 2019.
18 Law No. 6698, art. 18; Law No. 7499, art. 35; Personal Data Protection Authority, 2026 administrative fine table.
19 Constitutional Court, Celal Oraj Altunörgü, App. No. 2018/31036, 12 January 2021.
20 Danıştay 10th Chamber, E. 2019/10346, K. 2023/5654, 17 October 2023.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
