Collecting data from people in Turkiye? Know KVKK.

Turkiye's Personal Data Protection Law (No. 6698, known as KVKK) is applied to anyone who processes personal data of people in Turkiye, and its registration rules expressly address controllers based outside Turkiye. Four topics matter most for a US company: registration, transfers out of Turkiye, privacy notices and breach notification. Turkish-law work is handled by the Turkish attorneys at Sonmez Partners.

1. 01

   Registration

   VERBİS, through a representative.

   Under the VERBİS Regulation, a data controller not established in Turkiye registers through a data controller representative before processing. The Regulation defines the representative as a legal entity in Turkiye or a Turkish citizen. Size exemptions are written for controllers established in Turkiye.

2. 02

   Transfers abroad

   The 2024 rules.

   Since 1 June 2024, data can leave Turkiye under an adequacy decision, appropriate safeguards such as the Board's standard contracts or binding corporate rules, or, only occasionally, under narrow exceptions. As of October 2026, the Board has not issued an adequacy decision for any country, including the US.

3. 03

   Standard contracts

   Notify within 5 business days.

   A signed standard contract must be notified to the Authority within 5 business days. Failing to notify is a separate fine.

4. 04

   Notices and consent

   Two different things.

   When collecting data, tell people who you are, why you process their data, who receives it, how and on what legal basis it is collected, and their rights. Explicit consent is only one legal basis, and the consent request should be separate from the notice.

5. 05

   Breaches

   Notify the Board within 72 hours.

   The Board reads 'as soon as possible' as no later than 72 hours after the controller learns of a breach. Affected people must also be told within a reasonable time.

6. 06

   Fines

   Revalued every year.

   For 2026, administrative fines reach up to TRY 17,092,242 for the most serious categories, such as data security and registration failures.