Data protection & privacy law in Turkey (2026)

Legal framework

Law No. 6698 on the Protection of Personal Data (KVKK), enforced by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and its Personal Data Protection Board, Ankara

Key points: data & privacy in Turkey

1. 01Core Legislation

   Law No. 6698 on the Protection of Personal Data (KVKK), enacted April 7, 2016, is the primary comprehensive data protection statute, establishing principles of lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, and security across all sectors.

   kvkk.gov.tr kvkk.gov.tr

2. 022024 Amendments (KVKK 2.0)

   The 8th Judicial Package published in the Official Gazette on March 12, 2024 amended KVKK to align with GDPR: it introduced Standard Contractual Clauses and Binding Corporate Rules for cross-border transfers, expanded adequacy decisions to cover sectors and international organisations (not just countries), and harmonised legal bases for processing special-category data including health data.

   iapp.org chambers.com cms-lawnow.com

3. 03Supervisory Authority

   The Personal Data Protection Authority (KVKK/PDPA) is an independent public body with administrative and financial autonomy headquartered in Ankara. Its decision-making arm is the Personal Data Protection Board. Since 2017 the Authority has imposed TRY 1.265 billion in total administrative fines and processed over 56,896 data breach notifications.

   kvkk.gov.tr dataguidance.com

4. 04Cross-Border Data Transfers

   Since September 1, 2024, transfers abroad require one of three mechanisms: (1) a KVKK Board adequacy decision (none issued yet as of May 2026), (2) appropriate safeguards such as SCCs or BCRs, or (3) narrow exceptional circumstances including explicit data-subject consent or contractual necessity. Explicit consent alone is no longer a routine transfer basis. The Authority issued Cross-Border Personal Data Transfer Guidelines on January 2, 2025 to clarify the new rules.

   cms-lawnow.com morogluarseven.com

5. 05EU Adequacy Decision Status

   The European Commission has not granted Türkiye an EU GDPR adequacy decision; a December 2023 Commission assessment found Turkish law insufficiently aligned with GDPR. Türkiye is absent from the EU's list of adequate third countries as of May 2026.

   commission.europa.eu marpatas.com

6. 06Enforcement & Penalties

   Administrative fines are revalued annually; for 2026 (reflecting the 25.49% revaluation rate) they range from TRY 85,437 to TRY 17,092,242 per violation. Data controllers must register in the Data Controllers Registry (VERBIS) and comply with mandatory breach-notification obligations.

   searchinform.com kvkk.gov.tr

Timeline of decisions

1. 1 Jan 2026Decision
   2026 KVKK Administrative Fine Ceilings Raised 25.5%

   Annual inflation-linked revaluation pushed the maximum per-violation fine to TRY 17,092,242, the highest since the law's enactment, with the full fine band for data-security failures now running TRY 256,000-17,092,242, reflecting Turkey's standard statutory revaluation mechanism.

   GoTrust Privacy Platform

2. 21 Oct 2025Decision
   Board Issues First Authorization Decision Under New Cross-Border Transfer Rules

   The Personal Data Protection Board approved a data-sharing arrangement between the Directorate General of Migration Management and UNHCR, the first formal authorization under the June 2024 cross-border transfer regime, establishing the template for international data flows with intergovernmental organizations.

   Prighter

3. 1 Aug 2024Enforcement
   Mass VERBIS Enforcement: 16,350 Entities Fined TRY 503.9 Million

   The KVKK Authority concluded a nationwide audit of data-controller registry compliance and imposed cumulative fines of approximately TRY 504 million on domestic and foreign organizations, including public bodies, for failure to register with or notify VERBİS, marking a decisive shift from guidance to active enforcement.

   International Bar Association

4. 10 Jul 2024Guidance
   Regulation on Cross-Border Personal Data Transfers Published (OG No. 32598)

   Implementing rules for the overhauled Article 9 of Law 6698 were published in Official Gazette No. 32598, detailing adequacy decisions, standard contractual clauses (SCCs), and binding corporate rules (BCRs), and requiring controllers to notify the Board within five business days of executing SCCs.

   CottGroup

5. 1 Jun 2024Law
   Law No. 7499 KVKK Amendments Enter Into Force

   The most significant reform of Law 6698 since enactment took effect, replacing the consent-only cross-border transfer rule with a GDPR-aligned three-tier mechanism (adequacy decision → SCCs/BCRs → Board authorisation) and introducing expanded lawful bases for processing special-category data.

   Esin Attorney Partnership

6. 1 Sept 2021Enforcement
   WhatsApp Fined TRY 1.95 Million for Coercive Privacy-Policy Update

   The Board imposed TRY 1.95 million on WhatsApp for conditioning continued app access on acceptance of a 2021 policy update that bundled data-sharing with Meta, ruling that tying service to explicit consent violates KVKK's requirement that consent be freely given.

   DataGuidance

7. 1 May 2019Enforcement
   Facebook Fined TRY 1.65 Million for Photo API Data Breach (Decision 2019/104)

   In Decision No. 2019/104 the Board fined Facebook TRY 1.65 million, the first major fine against a global tech platform under KVKK, for failing to implement adequate technical safeguards that allowed third-party apps to access ~300,000 Turkish users' photos via an API bug, and for delayed notification to the Authority.

   Tasnim News Agency

8. 1 Jan 2018Law · official
   VERBİS Data Controllers Registry By-Law Enters Into Force

   The secondary legislation establishing the mandatory online Data Controllers Registry (VERBİS) took effect, requiring data controllers above prescribed thresholds to register before processing personal data, creating Turkey's central compliance infrastructure and the basis for subsequent enforcement sweeps.

   Personal Data Protection Authority (KVKK)

9. 1 Jan 2017Decision · official
   Personal Data Protection Board (KVK Kurul) Becomes Operational

   After all nine Board members were appointed, Turkey's independent supervisory authority (Kişisel Verileri Koruma Kurumu) began accepting complaints, opening investigations, and publishing guidance, completing the institutional enforcement framework required by Law No. 6698.

   Personal Data Protection Authority (KVKK)

10. 7 Apr 2016Law · official
    Law No. 6698 on Protection of Personal Data (KVKK) Enacted

    Turkey's first comprehensive data-protection statute was published in the Official Gazette, establishing data-subject rights, lawful bases for processing, obligations on controllers and processors, and the independent Personal Data Protection Board, modelled on EU Directive 95/46/EC and enacted weeks before the EU finalised GDPR.

    Personal Data Protection Authority (KVKK)

Sources

1. 1.kvkk.gov.tr/Icerik/6649/Personal-Data-Protection-Law
2. 2.kvkk.gov.tr/Icerik/7456/Purpose-and-Scope-of-The-Personal-Data-Protection-Law-No-
3. 3.kvkk.gov.tr/Icerik/7329/Data-Protection-in-Turkiye
4. 4.kvkk.gov.tr/Icerik/6635/By-Law-On-Data-Controllers-Registry
5. 5.iapp.org/news/a/turkeys-data-protection-amendments-for-2024-a-closer-look
6. 6.chambers.com/articles/amendments-to-the-personal-data-protection-law
7. 7.cms-lawnow.com/en/ealerts/2025/03/tuerkiye-s-personal-data-protection-overhaul-new-e
8. 8.morogluarseven.com/wp-content/uploads/2025/01/Turkish-Data-Protection-Law-2024_Moroglu-A
9. 9.commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection
10. 10.marpatas.com/en/european-commission-rejects-turkeys-data-protection-adequacy-impac
11. 11.searchinform.com/blog/2026/1/28/kvkk-2026-updates-what-turkish-businesses-must-know/
12. 12.dataguidance.com/jurisdictions/turkey