Meet KVKK data protection duties with clear, mapped controls

KVKK is Turkey's Personal Data Protection Law, Law No. 6698, published on 7 April 2016. The name comes from the Turkish title, Kişisel Verilerin Korunması Kanunu. It sets the conditions for lawfully processing personal data, gives individuals rights over their data, imposes data security and breach notification duties, and regulates transfers of personal data within Turkey and abroad. It is enforced by the Personal Data Protection Authority and its decision making Board.

Any natural or legal person that processes personal data in Turkey, by automated means or as part of a filing system, must comply with KVKK. This includes foreign companies that process the data of people in Turkey. Data controllers carry most obligations, including informing data subjects, securing data and registering with the Data Controllers' Registry (VERBIS) unless the Board has granted an exemption based on criteria such as data volume or company size.

KVKK sets administrative fines in Article 18 for failing to inform data subjects, failing to meet data security obligations, ignoring Board decisions, breaching VERBIS registration duties and, since 2024, failing to notify the Authority of standard contracts used for transfers. Fine bands are revalued each year. Article 17 also applies the Turkish Penal Code to unlawful recording, disclosure or failure to destroy personal data, so individuals can face criminal liability.

VERBIS is the online Data Controllers' Registry kept by the Personal Data Protection Authority under Article 16 of KVKK. Data controllers must register before processing personal data, declaring their processing purposes, data subject groups, data categories, recipients, planned transfers abroad, security measures and maximum retention periods. The Board can exempt some controllers based on objective criteria, and any changes to registered information must be notified promptly.

Law No. 7499, effective 1 June 2024, amended KVKK in three main areas. It added new lawful grounds for processing special category data in Article 6, replaced the international transfer regime in Article 9 with adequacy decisions, appropriate safeguards such as standard contracts and binding corporate rules, and limited occasional transfers, and moved appeals against Board fines to the administrative courts. The old consent based transfer route ran alongside the new rules until 1 September 2024.

KVKK was largely modelled on the EU's earlier Data Protection Directive, so it shares many concepts with GDPR, such as lawful bases, special category data and data subject rights. Key differences include the mandatory VERBIS registration, Turkey's own transfer regime and standard contracts, and criminal penalties under the Turkish Penal Code. GDPR compliance is a strong foundation, but it does not by itself satisfy KVKK.

KVKK Article 12 requires data controllers to take all necessary technical and organisational measures to secure personal data, and ISO 27001 provides a recognised management system for doing that. ISO 27001 certification does not mean KVKK compliance, because KVKK also covers lawful processing, notices, data subject rights, registration and transfers. Many organisations use ISO 27001 controls as evidence for the KVKK security obligations.

Yes. KVKK is supported in OneClickComply today. Your existing privacy and security controls are traced to the KVKK articles, so evidence collected for frameworks such as ISO 27001 or GDPR counts towards KVKK too. Our in-house auditors can also answer questions through Ask an Auditor.