Sign in

KVKK

Law on the Protection of Personal Data No. 6698 — Personal Data Protection Authority of Turkiye

Also known as: KVKK, Law No. 6698, Turkey LDDP 2016, Kisisel Verilerin Korunmasi Kanunu, Turkish PDPL

Official site Subscribe to KVKK (RSS)

Current version
Law No. 6698 as amended by Law No. 7499 (in force 1 June 2024)
Published 1 June 2024. source
Status
In force
Next deadline
None announced
Who must comply
Natural and legal persons who process personal data wholly or partly by automated means, or by non-automated means as part of a data filing system. source
How it is assessed
Data controllers secure the data themselves, register with the registry and notify the data subject and the Board as soon as possible if data are obtained unlawfully. source
Authority
A law of the Grand National Assembly enforced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) of the Personal Data Protection Authority (KVKK). source
Enforced by
The Board imposes administrative fines for breaches of the information, security, registry and transfer notification duties and for ignoring its decisions; fines can be challenged in administrative courts. source
Last change
None recorded yet

Turkey's general personal data protection statute. It sets the lawful bases for processing, separate conditions for special categories of personal data and for transfers abroad, the obligations of data controllers - registration with the Data Controllers' Registry, notification, data security and answering data subject requests - and the powers of the Personal Data Protection Board, whose binding principle resolutions are published in the Official Gazette.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. The pre-2024 rule on transfers abroad stops applying alongside the new Article 9
  2. Amendments by Law No. 7499 on special categories of data and transfers abroad take effect

Amendments

  1. Law No. 6698 as amended by Law No. 7499 (in force 1 June 2024) AmendmentCurrent text

    Law No. 7499 of 2 March 2024 rewrote the rules on special categories of personal data and on transfers abroad, and added a fine for failing to notify standard contracts. source

    More
    • Transfers abroad rest on an adequacy decision of the Board, or failing that on appropriate safeguards such as binding corporate rules or standard contracts announced by the Board, or on listed occasional grounds (Article 9).
    • Standard contracts must be notified to the Authority within five business days of signature (Article 9(5)).
    • The previous transfer rule in Article 9(1) continued to apply alongside the new one until 1 September 2024 (Provisional Article 3).
  2. Decree Law No. 703 (in force 9 July 2018) Amendment

    Amended Articles 19, 20, 21 and 25 to reflect the move to the presidential system of government. source

  3. Law No. 7061 (in force 5 December 2017) Amendment

    Amended Article 27 and added Provisional Article 2. source

  4. Law No. 6698 on the Protection of Personal Data Major version

    Published in the Official Gazette No. 29677 on 7 April 2016. source

Who it applies to

The law covers everyone processing personal data by automated means, or manually within a filing system, and requires registration with the Data Controllers' Registry unless the Board grants an exemption.

Scope
It applies to natural persons whose data are processed and to natural and legal persons who process them wholly or partly by automated means, or by non-automated means as part of a data filing system (Article 2). source
Registry
Natural and legal persons processing personal data must register with the Data Controllers' Registry before processing, unless exempted by the Board on objective criteria (Article 16). source
Transfers abroad
Data may go abroad under a Board adequacy decision, appropriate safeguards or listed occasional grounds; standard contracts must be notified within five business days (Article 9). source

How compliance is assessed

Data controllers secure the data themselves, register with the registry and notify the data subject and the Board as soon as possible if data are obtained unlawfully.

Breach notification
If processed personal data are obtained by others unlawfully, the data controller must notify the data subject and the Board as soon as possible; the Board may announce it (Article 12(5)). source

Enforcement and penalties

The Board imposes administrative fines for breaches of the information, security, registry and transfer notification duties and for ignoring its decisions; fines can be challenged in administrative courts.

Appeals
Administrative fines imposed by the Board can be challenged before administrative courts (Article 18(3)). source
Public bodies
Where the acts occur in public institutions, the officials concerned face disciplinary proceedings on the Board's notification (Article 18(4)). source
Fine categories
Article 18(1) sets separate administrative fine ranges for breaching the obligation to inform (Article 10), the data security obligations (Article 12), Board decisions (Article 15), the Data Controllers' Registry obligations (Article 16) and, since Law No. 7499, the standard contract notification duty (Article 9(5)); the last applies to data controllers and data processors (Article 18(2)). source

Documents

  1. Law text 6698 sayılı Kişisel Verilerin Korunması Kanunu (Mevzuat Bilgi Sistemi)
  2. Law text Personal Data Protection Law (KVKK English translation)

Frequently asked questions

What changed in KVKK transfers abroad in 2024?

From 1 June 2024, Law No. 7499 allows transfers abroad under a Board adequacy decision, appropriate safeguards such as standard contracts or binding corporate rules, or occasional listed grounds; standard contracts must be notified to the Authority within five business days. source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to KVKK (RSS)