Skip to content
Knowledge Hub/Article
Article

What Is KVKK? Türkiye's Law No. 6698, Obligations and Fines

What personal data, a data controller and explicit consent mean, plus the processing conditions, data subject rights, data security, VERBİS and fines.

Oğuzhan Gerçek··11 min read
What Is KVKK? Türkiye's Law No. 6698, Obligations and Fines

Short answer: The KVKK (Türkiye's personal data protection law) is Law No. 6698 on the Protection of Personal Data, published in the Official Gazette on April 7, 2016. Any information relating to an identified or identifiable natural person is personal data, and it may be processed only on one of the grounds the law lists. The data controller, meaning the person or organization that decides why and how the data is processed, must inform data subjects, answer their requests, take appropriate technical and administrative measures and, unless exempt, register with VERBİS. Breaches of the duties to inform, to keep data secure and to register are subject to administrative fines, while the Turkish Penal Code applies to crimes involving personal data.

What is KVKK? Purpose and scope

According to the consolidated text on Lexpera, Law No. 6698 was adopted on March 24, 2016, and published in Official Gazette No. 29677 on April 7, 2016. Its purpose is to protect fundamental rights and freedoms, privacy above all, when personal data is processed, and to set the rules that those processing it must follow (Article 1). It applies to natural and legal persons who process such data by automated means, or by non-automated means as part of a data filing system (Article 2). Because a data filing system is one in which data is structured and processed according to specific criteria (Article 3), well-organized paper records can fall within scope too.

The law is enforced by the Personal Data Protection Authority, whose decision-making body is the Personal Data Protection Board (Article 19). You will find a short definition in our glossary.

Key concepts: personal data, data controller, data processor

The definitions in Article 3 are the shared vocabulary of data privacy in Türkiye:

  • Personal data: Any information relating to an identified or identifiable natural person. The law's definition of processing includes storage, so merely keeping data counts as processing.
  • Special categories of personal data: Listed in Article 6: data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, plus biometric and genetic data.
  • Data subject: The natural person whose personal data is processed, such as a customer, an employee or a job applicant.
  • Data controller: The natural or legal person who determines the purposes and means of processing and is responsible for setting up and managing the data filing system.
  • Data processor: The natural or legal person who processes data on the controller's behalf, under authority the controller grants; a payroll or cloud service provider can fall under this definition. The controller is jointly responsible with the processor for security measures (Article 12(2)).
  • Explicit consent: Consent on a specific matter, based on information and given freely.
  • Anonymization: Rendering data impossible, in any way, to associate with an identified or identifiable person, even when matched with other data. Data whose reason for processing no longer exists is erased, destroyed or anonymized (Article 7).

General principles and processing conditions (Articles 4, 5 and 6)

All processing must follow five principles (Article 4): lawfulness and fairness; accuracy and, where necessary, being kept up to date; specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purpose; and retention only for as long as the legislation requires or the purpose needs.

Under Article 5, explicit consent is the rule. It is not required in seven cases: when the law expressly provides for the processing; to protect the life or physical integrity of a person who cannot give consent due to actual impossibility; when necessary to conclude or perform a contract; to meet a legal obligation; when the data subject has made the data public; to establish, exercise or protect a right; and for the controller's legitimate interests, provided the data subject's fundamental rights and freedoms are not harmed. Transfers to third parties are subject to the same conditions (Article 8).

Law No. 7499, published on March 12, 2024, repealed the paragraph that banned processing special category data without explicit consent and rewrote the conditions in Article 6; the change took effect on June 1, 2024. Processing such data is still prohibited in principle, but it is allowed in eight cases, including explicit consent, express provision by law, processing for health services by persons under a duty of confidentiality, and legal obligations in employment; the adequate measures set by the Board must also be in place (Article 6). The same law rewrote Article 9 on transfers abroad; we explain the transfer routes in our cross-border transfer article.

Duty to inform and data subject rights (Articles 10, 11 and 13)

When collecting personal data, the controller must tell data subjects its identity, the purpose of processing, to whom and why the data may be transferred, the method and legal basis of collection, and their rights (Article 10). Under the communiqué on the duty to inform, this duty does not depend on a request, and where explicit consent is also obtained, the two must be handled separately.

Article 11 gives data subjects the following rights:

  • To learn whether their data is processed, the purpose of processing and the third parties it has been transferred to
  • To request correction of incomplete or inaccurate data, erasure or destruction under the conditions in Article 7, and notification of these steps to the third parties that received the data
  • To object to an adverse outcome produced solely by automated analysis
  • To claim compensation for damage caused by unlawful processing

The controller must conclude a request within 30 days at most and, as a rule, free of charge (Article 13). A data subject whose request is rejected, who finds the answer insufficient or who gets no answer can file a complaint with the Board, but only after first applying to the controller (Article 14).

Data security: technical and administrative measures (Article 12)

Article 12 requires the controller to take all necessary technical and administrative measures to prevent unlawful processing of personal data and unlawful access to it, and to ensure its preservation. It also expects the controller to audit, or have audited, how the law is applied within the organization (Article 12(3)).

The law does not list the measures one by one. The Board's decision No. 2018/10 on special category data does: cryptographic storage, logging of all operations on the data, at least two-step authentication for remote access, VPN or sFTP for transfers between servers, and immediate removal of access rights when an employee leaves. These headings also work as a starting list for Article 12:

  • Inventory: The registry regulation requires those obliged to register to prepare a personal data processing inventory showing purposes, data categories, retention periods and security measures (Article 5(1)(ç)).
  • Access rights: Who can access which data, with what scope and for how long, should be defined; see our IAM article and, for the second factor, our MFA article.
  • Encryption and logging: Data is stored encrypted and operations are logged; how long to keep those records is the subject of our log retention article.
  • Data loss prevention and backup: We cover the layer that controls data leaving the organization in our DLP article, and what is expected of backups in our backup article.

If processed data is obtained by others through unlawful means, the controller notifies the data subject and the Board as soon as possible (Article 12(5)). We cover notification readiness in our data breach notification article and the technical side on our Data Security & DLP page.

VERBİS and the Data Controllers' Registry (Article 16)

The registry is kept open to the public by the Authority's Presidency under the Board's supervision. Natural and legal persons who process personal data must register before they start processing, but the Board can grant exemptions based on objective criteria such as the nature and volume of the data, whether the processing stems from law, or whether the data is transferred to third parties (Article 16(2)). Check the current Board decisions for the exemptions.

Registration is done through VERBİS (the Data Controllers' Registry Information System), as defined in the registry regulation; the notification also covers security measures and the maximum retention period (Article 16(3)). Under the deletion regulation, those obliged to register also prepare a retention and destruction policy, and the interval for periodic destruction cannot exceed six months. We describe the inventory and policy side on our Governance, Risk & Compliance (GRC) page and compliance as a whole on our KVKK / GDPR page.

KVKK fines: administrative fines and crimes (Articles 17 and 18)

Article 18 attaches administrative fines to breaches of these duties: informing data subjects (Article 10), data security (Article 12), complying with Board decisions (Article 15), registering with and notifying the registry (Article 16) and, since 2024, notifying the Authority of standard contracts (Article 9(5)). The fines apply to natural persons and private-law legal entities acting as controllers; for the standard contract notification, a processor can be fined as well (Article 18(2)). In public institutions, the officials concerned face disciplinary proceedings instead (Article 18(4)). Since 2024, these fines can be challenged before the administrative courts (Article 18(3)).

The law sets the amounts as Turkish lira ranges, but under the Misdemeanors Law they are increased at the start of each calendar year by the revaluation rate announced for that year (Article 17(7)). That is why we do not quote amounts here.

For crimes, Article 17 refers to Articles 135–140 of the Turkish Penal Code; anyone who fails to erase or anonymize data whose reason for processing no longer exists is punished under Article 138 of that code. We examine how the data security duty turned into a fine in a ransomware case in our KVKK fine article.

How the KVKK differs from the GDPR

The EU's General Data Protection Regulation (GDPR) of April 27, 2016 differs from the KVKK on several concrete points:

  • Legal basis: In the Regulation, consent is one of six legal bases, legitimate interests being another (Article 6). Under the KVKK, explicit consent is the rule and the other grounds are exceptions.
  • Registration: The Regulation abolished the general notification obligation of Directive 95/46/EC (Recital 89); instead, controllers, with some exemptions, keep a record of processing activities and make it available to the supervisory authority on request (Article 30). The KVKK requires registration in a public registry.
  • Special categories: Dress, membership of associations and foundations, and criminal convictions, all on the KVKK's list, are not in Article 9 of the Regulation; data relating to criminal convictions is governed by its Article 10.
  • Fines: According to the European Commission, GDPR fines can reach €20 million or 4% of a business's total annual worldwide turnover; KVKK amounts are not tied to turnover.

This article is general information, not legal advice.

Frequently asked questions

What does KVKK mean? It is the abbreviation of Türkiye's Law No. 6698 on the Protection of Personal Data. The law sets the conditions under which personal data may be processed and the obligations of whoever processes it.

What is a data controller? It is the natural or legal person who determines the purposes and means of processing and is responsible for the data filing system. A party that processes data on its behalf is a data processor.

Is explicit consent always required? No. If one of the grounds in Article 5 applies, such as performing a contract, meeting a legal obligation or pursuing legitimate interests, explicit consent is not needed.

What are the KVKK fines? Breaches of the duties on informing data subjects, data security, Board decisions, registration and standard contract notification carry administrative fines, and the amounts are revalued every year. The Turkish Penal Code applies to crimes involving personal data.

Is VERBİS registration mandatory for everyone? As a rule, yes, but the Board can grant exemptions from registration based on objective criteria.

What is the difference between KVKK and GDPR? They differ in how the legal bases are structured, in registration, in the list of special categories and in how fines are set.

Sources