Data Protection
Seven KVKK obligations companies in Türkiye must not overlook
Translated from the Turkish original. Türkçe aslı →
Every company that processes the data of customers, employees or website visitors is a data controller under Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). Administrative fines imposed by the Personal Data Protection Board rise every year in line with the revaluation rate, and the 2024 amendments introduced a new regime for special categories of data and cross-border transfers. Compliance is not a one-off paperwork exercise but a process built into the company's daily operations. This article covers, in order, the seven obligations companies most often overlook.
Key concepts first
Personal data is any information relating to an identified or identifiable individual: a name, phone number, email address, IP address, camera footage or payroll information. The data controller is the person or company that decides why and how the data is processed. A data processor processes data on the controller's behalf - for example an accounting firm, a cloud provider or a payroll software company.
1. The duty to inform
A privacy notice must be provided when data is collected. It must state at least:
- The identity of the data controller,
- The purposes of processing,
- To whom and for what purposes the data may be transferred,
- How the data is collected and the legal basis for processing,
- The individual's rights under Article 11 of the KVKK.
The duty to inform is separate from explicit consent. The Board does not accept combining the privacy notice and the explicit consent form in a single document. The burden of proving that the notice was given lies with the controller, so when and how it was provided should be recorded.
2. Choosing the right legal basis
The most common mistake is trying to obtain explicit consent for every processing activity. The KVKK lists legal bases other than consent:
- Processing expressly provided for by law,
- Processing directly related to the conclusion or performance of a contract,
- Compliance with a legal obligation of the controller,
- The establishment, exercise or protection of a right,
- The controller's legitimate interests, provided the individual's fundamental rights are not harmed.
Explicit consent is the route to take when none of these applies, and it can be withdrawn. Processing an employee's bank details to pay their salary, for example, is performance of a contract; asking for consent is unnecessary and makes the processing questionable if consent is withdrawn.
3. Data security
The controller must take the technical and organisational measures needed to prevent unlawful processing of and access to data. The main ones are:
- An authorisation matrix showing who may access which data, and access logs,
- Encryption, up-to-date software, firewalls and backups,
- Confidentiality undertakings and regular training for employees,
- Data security clauses in contracts with processors (software vendors, accountants, cloud services) and audits of those processors.
The controller is jointly liable with the processor for breaches caused by the processor.
4. VERBİS registration
Data controllers must register with the Data Controllers' Registry Information System (VERBİS) before processing. Board decisions, however, exempt certain companies.
| Type of company | Registration |
|---|---|
| Fewer than 50 employees and an annual balance sheet total below TRY 100 million, with a main activity that does not involve special categories of data | Exempt |
| Companies exceeding either threshold | Mandatory |
| Controllers whose main activity involves special categories of data, with fewer than 10 employees and a balance sheet total below TRY 10 million | Exempt (since October 2025) |
| Controllers whose main activity involves special categories of data and exceed those thresholds | Mandatory |
A Board decision of December 2025 clarified that for companies keeping balance-sheet accounts both criteria are assessed together, while for those that do not, only the number of employees is considered. Registration deadlines for companies crossing the thresholds are announced separately by the Board; for example, the deadline for companies that became subject to registration because of their 2025 balance sheet was set at 5 June 2026.
5. Data subject requests
Individuals have the right to learn whether their data is processed, to request information, to ask for correction or deletion and to claim compensation if they have suffered loss. The company must answer such requests within thirty days at the latest, as a rule free of charge. An individual whose request is refused or not answered in time may complain to the Board. The channel for receiving requests, who assesses them and how they are recorded should therefore be decided in advance.
6. Breach notification
If personal data is unlawfully obtained by others, the Board must be notified within 72 hours of the breach becoming known, and the individuals affected must be informed within a reasonable time. Seventy-two hours is very short in a crisis, so a response plan setting out who does what should be prepared in advance.
The first 72 hours of a data breach
- Stop the breach and record itIsolate the affected systems and document when and how the breach became known.
- Establish the scopeIdentify which data, how many people and which categories are affected.
- Assess the riskIdentify the possible consequences for the people affected and the measures that can be taken.
- Notify the BoardComplete the Board's breach notification form within 72 hours; missing details can be added later.
- Inform the people affectedInform them within a reasonable time and in plain language.
7. Cross-border transfers
Email, CRM or cloud services hosted on servers abroad also count as transfers of data abroad. Since 1 June 2024, a new system has applied under Law No. 7499:
| Transfer route | When it is used |
|---|---|
| Adequacy decision | Transfers to countries or sectors the Board has found to offer adequate protection |
| Standard contract | Signing the Board's published text without changes; notification to the Authority within 5 business days of signature |
| Binding corporate rules | Transfers within multinational groups; Board approval required |
| Written undertaking | Between parties undertaking adequate protection; Board authorisation required |
| Occasional transfer | Where none of the above is available, in exceptional cases listed by law, provided the transfer is not regular |
Failing to notify a standard contract in time is itself an administrative offence subject to a fine.
Retention and destruction
Personal data may be kept only as long as necessary for the purpose of processing. Companies subject to VERBİS registration must prepare a data retention and destruction policy and periodically delete, destroy or anonymise data whose retention period has expired.
Sanctions
Breaches of the duty to inform, data security obligations, Board decisions and VERBİS obligations are subject to administrative fines. Since 1 June 2024, fines imposed by the Board are challenged before the administrative courts rather than the criminal judgeships of peace. Unlawfully recording, disclosing or failing to destroy data may also constitute criminal offences under Articles 135-140 of the Turkish Criminal Code, and individuals whose personality rights are violated may claim damages.
Frequently asked questions
Must every company register with VERBİS?
No. Companies with fewer than 50 employees and a balance sheet total below TRY 100 million, whose main activity does not involve special categories of data, are exempt. Being exempt from VERBİS does not, however, exempt a company from the KVKK's other obligations.
Can the privacy notice and consent form be one document?
They should not be. The Board takes the view that the duty to inform and explicit consent are separate obligations to be fulfilled through separate texts.
Do we need explicit consent for employees' data?
In most cases, no. Payroll, social security filings and occupational health rely on legal obligations or performance of the employment contract. Consent is needed only in the limited cases where no such basis exists.
How is a KVKK fine challenged?
Since 1 June 2024, administrative fines imposed by the Board are challenged by filing a lawsuit before the administrative court. The deadline is short, so legal advice should be sought as soon as the decision is served.
Legislation and sources
- Personal Data Protection Law No. 6698: Arts. 5, 6, 9, 10, 12, 16 and 18
- Law No. 7499 (cross-border transfers and administrative courts, 1 June 2024)
- Regulation on the Procedures and Principles for Cross-Border Transfers of Personal Data
- Regulation on the Data Controllers' Registry and the Personal Data Protection Board's VERBİS decisions
The current texts of Turkish laws and regulations are available on the official Legislation Information System, and decisions and amendments in the Official Gazette.
To set up or review your company's KVKK compliance, please contact us. Details of our services are on our Data Protection page.
This article is for general information only and does not constitute legal advice. It reflects the law as at the date of publication; please consult a lawyer about your specific situation.
A question about this article?
Your question reaches our firm directly by WhatsApp or email; it is never published or stored on this site. Our lawyers will get back to you.