Corporate & Commercial
KVKK Compliance in Turkey: Guide for Foreign Companies
KVKK for foreign companies in Turkey: VERBIS registration through a Turkish representative, lawful bases, transfers abroad after 2024 and Article 18 fines.
KVKK compliance in Turkey is a regulatory obligation for foreign companies operating in or targeting the Turkish market. Turkey's Personal Data Protection Law (Law No. 6698), known as KVKK (Kişisel Verilerin Korunması Kanunu), sets the conditions for processing personal data and the obligations of the natural and legal persons who process it (Article 1). For multinational corporations, foreign investors and technology companies serving Turkish consumers, non-compliance can mean administrative fines, orders of the Personal Data Protection Board to remedy a breach within thirty days (Article 15(5)) and, for the gravest conduct, criminal liability under the data offences of the Turkish Penal Code (Article 17).
The fines are written into Article 18 of the Law as ranges and, like other administrative fines, are increased at the start of every calendar year by the revaluation rate announced under the Tax Procedure Law (Article 17(7) of the Misdemeanours Law No. 5326). The amendments made by Law No. 7499, in force since 1 June 2024, rewrote the rules on special categories of data and on transfers abroad, added a fine for failing to notify standard contracts, and moved challenges to Board fines to the administrative courts. For C-level executives and board members of MNCs with Turkish exposure, KVKK compliance is a board-level risk management issue, not a back-office one.
Key Takeaways
KVKK applies to natural and legal persons who process personal data by wholly or partly automated means, or by non-automated means as part of a data filing system (Article 2). It has no separate territorial-scope clause, and its secondary legislation expressly provides for data controllers not resident in Türkiye.
A data controller not resident in Türkiye registers with VERBIS before it starts processing, through a data controller representative that is a legal entity established in Türkiye or a Turkish citizen, unless the Board has exempted it (Law Article 16(2); Registry Regulation Articles 4(1)(p) and 5(1)(b)).
Article 18 sets fines as statutory base ranges, from TRY 5,000–100,000 for the information duty to TRY 50,000–1,000,000 for failing to notify a standard contract; the amounts rise every year by the revaluation rate.
Cross-border data transfers rest, since 1 June 2024, on an adequacy decision, an appropriate safeguard such as binding corporate rules or the Board's standard contract, or one of the narrow occasional-transfer exceptions in Article 9(6).
Legitimate interest is a lawful basis under KVKK (Article 5(2)(f)); explicit consent is the starting point but not the only route.
Understanding KVKK: Turkey's Data Protection Framework
KVKK was published in the Official Gazette on 7 April 2016. Most of its provisions took effect on publication, while the articles on transfers, data-subject rights, applications, complaints, the registry, offences and fines took effect six months later (Article 32). The Law requires personal data to be processed lawfully and fairly, accurately and where necessary kept up to date, for specified, explicit and legitimate purposes, in a way that is relevant, limited and proportionate, and only for as long as the legislation or the purpose requires (Article 4(2)). Supervision lies with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), a public legal entity with administrative and financial autonomy (Article 19), whose decision-making body, the Personal Data Protection Board, exercises its powers independently (Article 21(1)).
Territorial Scope and Application to Foreign Companies
KVKK contains no targeting clause of the kind found in the GDPR. Article 2 applies the Law to the natural persons whose personal data is processed and to the natural and legal persons who process that data, without drawing a territorial line, and the data subject is defined simply as the natural person whose data is processed (Article 3(1)(ç)), not by residence or nationality. The secondary legislation assumes that controllers abroad are covered: the Data Controllers Registry Regulation requires a controller not resident in Türkiye to register through a data controller representative before it starts processing (Article 5(1)(b)), and the Authority communicates with such a controller through that representative (Article 12(1)(c)). A foreign company whose Turkish customers, employees or operations generate personal data should therefore work on the basis that the Law applies and map its processing accordingly.
Categories of Protected Data
KVKK distinguishes between personal data and special categories of personal data. Article 6(1) lists the special categories: race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data. Since the amendment by Law No. 7499, Article 6(3) provides that processing special categories is prohibited unless one of eight listed grounds applies: the data subject's explicit consent; express provision in law; protection of life or bodily integrity where consent cannot be given; data made public by the data subject, in line with that intention; the establishment, exercise or protection of a right; health purposes pursued by persons under a duty of confidentiality or by authorised bodies; legal obligations in employment, occupational health and safety, social security and social assistance; and certain activities of non-profit bodies towards their members. Adequate measures determined by the Board must also be taken (Article 6(4)). For MNCs operating across several jurisdictions, mapping which categories the Turkish operation processes remains the first step in any compliance programme.
Core KVKK Obligations for Foreign Companies
Appointing a Data Controller Representative in Turkey
The Law mentions a controller's representative only in passing (Articles 10(1)(a) and 16(3)(a)); the detail is in the Data Controllers Registry Regulation. A data controller representative is a legal entity established in Türkiye, or a natural person who is a Turkish citizen, authorised at a minimum to receive the Authority's notifications and correspondence on the controller's behalf, to pass the Authority's requests to the controller and its replies back, to receive data-subject applications and forward them, to convey the controller's answers to data subjects, and to carry out registry transactions (Articles 4(1)(p) and 11(3)). A certified copy of the resolution by which the foreign controller's competent body appoints the representative is filed with the registration application (Article 11(2)), and the representative records a contact person in the registry who is not authorised to represent the controller (Article 11(4)). Breach notification is not on that list. Under Article 12(5) of the Law the controller itself must notify the data subject and the Board as soon as possible where processed data is obtained by others unlawfully; the statute does not fix a number of hours.
VERBIS Registration: The Mandatory Data Controllers Registry
VERBIS (Veri Sorumluları Sicil Bilgi Sistemi) is the online system through which the Data Controllers Registry is operated; the Registry is kept by the Authority's Presidency under the Board's supervision and is open to the public (Law Article 16(1); Regulation Article 4(1)(o)). Article 16(2) of the Law requires those who process personal data to register before they start processing, but allows the Board to grant exemptions by objective criteria such as the nature and quantity of the data, whether the processing is required by law and whether data is transferred to third parties; the Regulation adds criteria including annual employee numbers and balance-sheet totals (Article 16(1)(ğ)). A controller not resident in Türkiye registers through its representative (Regulation Article 5(1)(b)). The application discloses the identity of the controller and any representative, the purposes of processing, the data-subject groups and data categories, the recipients, the data to be transferred abroad, the security measures taken and the maximum retention period (Law Article 16(3)), and controllers subject to registration must prepare a personal data processing inventory on which those entries are based (Regulation Article 5(1)(ç)). Changes are notified through VERBIS within seven days (Regulation Article 13), and a controller that becomes subject to registration later registers within thirty days (Regulation Article 8(2)). Breaching the registration and notification duty is fined under Article 18(1)(ç) of the Law.
Lawful Basis for Data Processing
Article 5(1) makes explicit consent — consent on a specific matter, based on information and freely given (Article 3(1)(a)) — the starting point, but Article 5(2) lists seven alternative conditions under which data may be processed without it: where the law expressly provides for it; where it is necessary to protect the life or bodily integrity of a person who cannot give valid consent; where processing the data of the parties is necessary and directly related to the formation or performance of a contract; where it is necessary for the controller to comply with a legal obligation; where the data subject has made the data public; where it is necessary to establish, exercise or protect a right; and where it is necessary for the controller's legitimate interests, provided the data subject's fundamental rights and freedoms are not harmed. Legitimate interest is therefore available under KVKK, as under the GDPR. What differs is the wording of each condition — the contract ground, for example, is limited to the data of the parties to the contract — so a GDPR lawful-basis analysis should be re-checked against Article 5 rather than carried over unchanged.
Transfers Abroad after the 2024 Amendment
Article 9 was rewritten by Law No. 7499 with effect from 1 June 2024, and the old first paragraph continued to apply alongside it until 1 September 2024 (Provisional Article 3(1)). Controllers and processors may transfer data abroad where one of the conditions in Articles 5 or 6 exists and there is an adequacy decision on the country, the sector within it or the international organisation; adequacy decisions are made by the Board, published in the Official Gazette and reviewed at least every four years (Article 9(1)–(2)). Without an adequacy decision, a transfer may rest on an appropriate safeguard, provided the data subject can also exercise their rights and seek effective remedies in the destination country: an agreement between public bodies authorised by the Board, binding corporate rules approved by the Board, a standard contract announced by the Board, or a written undertaking authorised by the Board (Article 9(4)). A standard contract must be notified to the Authority within five business days of signature (Article 9(5)), and failure to do so is fined under Article 18(1)(d). Only where neither route is available may data be transferred under the occasional-transfer exceptions in Article 9(6), such as explicit consent given after being informed of the possible risks, or necessity for the performance of a contract with the data subject.
Data Security and Breach Notification
Article 12(1) requires the controller to take all necessary technical and administrative measures to ensure an appropriate level of security, in order to prevent unlawful processing of and unlawful access to personal data and to safeguard it. Where a processor handles data on the controller's behalf, both are jointly responsible for those measures (Article 12(2)), and the controller must carry out or commission the audits needed within its own organisation (Article 12(3)). Controllers and processors may not disclose personal data they learn in breach of the Law or use it for other purposes, even after leaving office (Article 12(4)). If processed data is obtained by others unlawfully, the controller notifies the data subject and the Board as soon as possible, and the Board may announce the breach on its website or by another method (Article 12(5)).
Data Subject Requests and Complaints
Anyone may apply to the controller to learn whether their data is processed, to request information about it, to learn the purpose of processing, to know the third parties in Türkiye or abroad to whom it is transferred, to request correction, erasure or destruction, to object to an adverse result produced exclusively by automated analysis, and to claim compensation for damage caused by unlawful processing (Article 11). The controller must conclude the request within thirty days at the latest (Article 13(2)). If the request is refused, the answer is inadequate or no answer is given in time, the data subject may complain to the Board (Article 14(1)); the application to the controller must come first (Article 14(2)). Where the Board finds a breach it orders the controller to remedy it, and the order must be carried out without delay and within thirty days at the latest (Article 15(5)).
Administrative Fines under Article 18
| Breach | Obligation breached | Statutory base range | Provision |
|---|---|---|---|
| Failing to inform data subjects | Art. 10 | TRY 5,000 – 100,000 | Art. 18(1)(a) |
| Failing to meet data security obligations | Art. 12 | TRY 15,000 – 1,000,000 | Art. 18(1)(b) |
| Failing to comply with Board decisions | Art. 15 | TRY 25,000 – 1,000,000 | Art. 18(1)(c) |
| Breaching the registry registration and notification duty | Art. 16 | TRY 20,000 – 1,000,000 | Art. 18(1)(ç) |
| Failing to notify a standard contract for transfers abroad | Art. 9(5) | TRY 50,000 – 1,000,000 | Art. 18(1)(d) |
These are the amounts written into the Law. Under Article 17(7) of the Misdemeanours Law No. 5326, administrative fines are increased at the start of every calendar year by the revaluation rate determined and announced under the Tax Procedure Law, so the figures applied in any given year are higher than the table shows. The fines in (a) to (ç) are imposed on data controllers; the fine in (d) may be imposed on controllers or processors who are natural persons or private-law legal entities (Article 18(2)). Where the breach occurs within a public institution, disciplinary proceedings are taken against the officials concerned (Article 18(4)). Since 1 June 2024, fines imposed by the Board are challenged by an action before the administrative courts (Article 18(3)). Separately, Article 17 applies the data offences in Articles 135 to 140 of the Turkish Penal Code and makes failure to erase or anonymise data punishable under Article 138.
Common questions about this topic
Does KVKK apply to foreign companies without a physical presence in Turkey?
KVKK has no separate territorial-scope clause. Article 2 applies it to the natural persons whose personal data is processed and to the natural and legal persons who process that data, and the Data Controllers Registry Regulation expressly provides for data controllers not resident in Türkiye, who register through a data controller representative (Article 5(1)(b)). A foreign company processing personal data in connection with Turkish customers or operations should therefore work on the basis that the Law applies and take advice on its own processing.
What is VERBIS and why must foreign companies register?
VERBIS (Veri Sorumluları Sicil Bilgi Sistemi) is the online system of the Data Controllers Registry, which the Authority's Presidency keeps under the Board's supervision (Law Article 16(1)). Those who process personal data must register before they begin processing, unless the Board has exempted them on objective criteria (Article 16(2)); a controller not resident in Türkiye registers through its representative. Breaching the registration and notification duty is fined under Article 18(1)(ç), from a statutory base range of TRY 20,000 to TRY 1,000,000 that is increased every year by the revaluation rate.
Do foreign companies need a local representative in Turkey for KVKK?
A data controller not resident in Türkiye must register with the Data Controllers Registry through a data controller representative (Data Controllers Registry Regulation Article 5(1)(b)). The representative must be a legal entity established in Türkiye or a Turkish citizen, and its appointment must at least cover receiving the Authority's notifications, passing requests and replies between the Authority and the controller, receiving data-subject applications and conveying the controller's answers, and carrying out registry transactions (Articles 4(1)(p) and 11(3)).
What are the KVKK administrative fines for 2026?
Article 18 sets the fines as statutory base ranges: TRY 5,000 to 100,000 for breaching the information duty; TRY 15,000 to 1,000,000 for data security breaches; TRY 25,000 to 1,000,000 for failing to comply with Board decisions; TRY 20,000 to 1,000,000 for registry breaches; and TRY 50,000 to 1,000,000 for failing to notify a standard contract for transfers abroad. Under Article 17(7) of the Misdemeanours Law No. 5326 these amounts are increased at the start of each calendar year by the revaluation rate announced under the Tax Procedure Law, so the figures applied in 2026 are higher than the base amounts; check the figures for the relevant year before relying on a number.
How does KVKK compare to GDPR for multinational corporations?
Several differences are smaller than often assumed. Legitimate interest is a lawful basis under KVKK (Article 5(2)(f)), and since 1 June 2024 transfers abroad rest on adequacy decisions, binding corporate rules, standard contracts and other safeguards (Article 9). What is specific to KVKK includes the Data Controllers Registry and VERBIS (Article 16), the duty to notify a signed standard contract to the Authority within five business days (Article 9(5)), and the closed list of grounds for processing special categories of personal data (Article 6(3)).
How quickly must a data subject request be answered?
Within thirty days at the latest. Article 13(2) requires the controller to conclude the request as soon as possible according to its nature and within thirty days, free of charge unless the process involves an additional cost, when the fee in the Board's tariff may be charged. If the request is refused, the answer is inadequate or no answer is given in time, the data subject may complain to the Board within thirty days of learning the answer and in any event within sixty days of the application (Article 14(1)).
This guide is general information on Turkish law, not legal advice on your own matter. Rules and practice change; check the position before you act.