⁦Turkey KVKK⁩

⁦Türkiye⁩ پرائیویسی

حیثیت

⁦In force since 7 April 2016 (OG 29677); Articles 8-9 and 11-18 applied from 7 October 2016 (Art 32). Amended by Law No. 7499 of 2 March 2024 (in force 1 June 2024), with the old consent-based transfer rule kept alongside the new one until 1 September 2024 (Provisional Art 3).⁩✓⁦Art 32; Provisional Art 3 ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦esin.av.tr⁩

یہ کن پر لاگو ہوتا ہے

⁦Applies to natural persons whose data are processed and to every natural or legal person processing personal data by automated means, or by non-automated means as part of a filing system (Art 2). Controllers not established in Türkiye that process data of people in Türkiye are covered too: they must register in VERBIS through a Turkish representative (Registry By-Law Art 11).⁩✓⁦Art 2; Art 28 (exemptions); Registry By-Law Art 11 ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦kvkk.gov.tr⁩, ⁦pandectes.io⁩, ⁦cookieyes.com⁩

سائز کی حدیں

⁦The law itself has no size threshold. VERBIS registration exemption (Board Decision 2018/87 as amended by 2023/1154 and 2025/1572): fewer than 50 employees and an annual balance sheet under TRY 100m, provided the main activity is not processing special-category data; since 2025, controllers whose main activity is special-category data are also exempt if they have fewer than 10 employees and under TRY 10m. Controllers that do not keep balance-sheet books are judged on employee count alone (Decision 2025/2393 of 25 Dec 2025).⁩✓⁦Art 16(2); Board Decisions 2018/87, 2023/1154, 2025/1572, 2025/2393 ·⁩ ذرائع: ⁦kvkk.gov.tr⁩, ⁦kvkk.gov.tr⁩, ⁦webiis08.mondaq.com⁩, ⁦nortonrosefulbright.com⁩

ریگولیٹر

⁦Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK), an independent public legal entity; its decision-making body is the Personal Data Protection Board (Kurul).⁩✓⁦Art 19; Art 21 ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦cookieyes.com⁩, ⁦pandectes.io⁩

خلاف ورزی یا واقعے کی رپورٹنگ

⁦If personal data are obtained unlawfully by others, the controller must notify the Board and the affected people as soon as possible (Art 12(5)). Board Decision 2019/10 (24 Jan 2019) sets this as within 72 hours of learning of the breach, using the Board⁩'⁦s breach notification form. Affected individuals are told within a reasonable time, directly where possible. There is no risk threshold, so all breaches are reportable.⁩✓⁦Art 12(5); Board Decision 2019/10 ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦kvkk.gov.tr⁩, ⁦nortonrosefulbright.com⁩, ⁦pandectes.io⁩

ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ

⁦Requests must be resolved as soon as possible and within 30 days at the latest, free of charge. A fee from the Board⁩'⁦s tariff may be charged only if the action has an extra cost (Art 13(2)). The reply must be given in writing or electronically; under an Authority announcement of 1 Oct 2026, phone or face-to-face replies do not count.⁩✓⁦Art 13(2)-(3) ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦kvkk.gov.tr⁩, ⁦nortonrosefulbright.com⁩, ⁦erdem-erdem.av.tr⁩

ڈیٹا پروٹیکشن آفیسر

⁦No statutory DPO requirement. Controllers registering in VERBIS must name a⁩ '⁦contact person⁩' ⁦(irtibat kişisi) for communication with the Authority: a natural person named by a Turkish controller, or by the representative of a foreign controller. The contact person has no power to represent the controller.⁩✓⁦Registry By-Law Art 4(1)(ç), Art 11(4) ·⁩ ذرائع: ⁦kvkk.gov.tr⁩, ⁦pandectes.io⁩, ⁦nortonrosefulbright.com⁩

مقامی نمائندہ

⁦Controllers not established in Türkiye must register in VERBIS through a data controller representative before processing starts. The representative must be a legal entity established in Türkiye or a Turkish citizen, appointed by a certified designation decision. At minimum it must receive Authority notices and data subject requests.⁩✓⁦Registry By-Law Art 4(1)(p), Art 11(1)-(3) ·⁩ ذرائع: ⁦kvkk.gov.tr⁩, ⁦akkaslaw.com⁩, ⁦nortonrosefulbright.com⁩

ڈیٹا بیرونِ ملک بھیجنا

⁦Since the 2024 amendments, a transfer abroad needs an Art 5 or Art 6 legal basis plus either a Board adequacy decision (reviewed at least every 4 years) or an appropriate safeguard: Board-approved binding corporate rules, the Board⁩'⁦s standard contract, a written undertaking approved by the Board, or a non-treaty agreement between public bodies (Art 9(1)-(4)). A standard contract must be notified to the Authority within 5 business days of signature (Art 9(5)); failing to notify carries a fine (Art 18(1)(d)). Without adequacy or safeguards, only occasional (arızi) transfers on listed grounds are allowed, such as explicit consent after risk information or contract necessity (Art 9(6)).⁩✓⁦Art 9; Art 18(1)(d); Transfer Regulation (OG 10 Jul 2024) ·⁩ ذرائع: ⁦mevzuat.gov.tr⁩, ⁦esin.av.tr⁩, ⁦koksal.av.tr⁩

کوکیز اور رضامندی

⁦No cookie-specific statute; KVKK applies to cookies that process personal data. The Authority⁩'⁦s Guide on Cookie Practices (final version 20 June 2022; the current PDF is Publication No. 69, July 2025) says that strictly necessary cookies, including first-party analytics limited to audience measurement, can rely on legal bases other than consent. Behavioural advertising, third-party tracking and similar cookies need prior opt-in explicit consent. Cookie walls that make consent a condition of access may undermine freely given consent.⁩✓⁦Art 5; Art 10; KVKK Cookie Guide ·⁩ ذرائع: ⁦kvkk.gov.tr⁩, ⁦mondaq.com⁩

زیادہ سے زیادہ سزا

⁦2026 administrative fines (Art 18, revalued each 1 January by the tax revaluation rate, 25.49% for 2026): data security failures TRY 256,357-17,092,242; non-compliance with Board decisions TRY 427,263-17,092,242; VERBIS breaches TRY 341,809-17,092,242; privacy notice failures TRY 85,437-1,709,200; failing to notify a standard contract TRY 90,308-1,806,177. Criminal penalties under Turkish Criminal Code Arts 135-140 also apply (Art 17).⁩✓⁦Art 18; Art 17; Misdemeanours Law Art 17(7) ·⁩ ذرائع: ⁦kvkk.gov.tr⁩, ⁦kvkk.gov.tr⁩, ⁦cottgroup.com⁩

جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔

آپ کو کیا کرنا ہوگا✓

• ⁦Register in VERBIS before processing unless exempt (Art 16); foreign controllers register via a Turkish representative.⁩
• ⁦Give a privacy notice (aydınlatma) when collecting data (Art 10).⁩
• ⁦Rely on a listed legal basis, with explicit consent only where required (Arts 5-6).⁩
• ⁦Take technical and administrative security measures and report breaches to the Board within 72 hours (Art 12).⁩
• ⁦Answer data subject requests in writing or electronically within 30 days (Art 13).⁩
• ⁦Transfer abroad only via adequacy, safeguards or occasional derogations, and notify standard contracts within 5 business days (Art 9).⁩
• ⁦VERBIS-registered controllers must keep a data retention and destruction policy (Erasure By-Law Art 5).⁩

حالیہ تبدیلیاں

⁦Law 7499 (2 Mar 2024, in force 1 Jun 2024) rewrote cross-border transfers (Art 9), widened the legal bases for special-category data (Art 6) and moved fine appeals to administrative courts (Art 18(3)). Board Decision 2025/1572 (4 Sep 2025) widened the VERBIS exemption to small special-category controllers (fewer than 10 staff and under TRY 10m), and Decision 2025/2393 (25 Dec 2025) applies the employee count alone where no balance sheet is kept. In 2026 the Authority clarified that DSR replies must be written or electronic (announcement of 1 Oct 2026) and issued Principle Decision 2026/2035 (16 Sep 2026) on employers monitoring corporate email and communication channels.⁩✓

ذرائع

• بنیادی ذریعہ: ⁦https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698⁩&⁦MevzuatTur=1⁩&⁦MevzuatTertip=5⁩
• دوسرا ذریعہ: ⁦https://mondaq.com/turkey/data-protection/1442172/recent-amendments-to-the-law-on-the-protection-of-personal-data⁩
• ریگولیٹر: ⁦Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK), an independent public legal entity; its decision-making body is the Personal Data Protection Board (Kurul).⁩

✓ = دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں

صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.