{ "jurisdiction_id": "TR", "jurisdiction": "Turkey", "url": "https://dataprotection.gi/jurisdictions/turkey/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 36, "sub_modules": 57, "source_register": 39 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive statute in force with an operational, actively enforcing regulator (KVKK) and a functioning registration system (VERBIS).", "claims": [ { "statement": "The Personal Data Protection Authority (KVKK) is Turkey's supervisory authority for the Law on the Protection of Personal Data No. 6698.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-issues-announcement-security-camera-use-0", "source_tier": null, "observed_at": null }, { "statement": "The Law on Protection of Personal Data No. 6698 (LPPD) was published in the Official Gazette on 7 April 2016 and entered into force as Turkey's first general data protection law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance / Esin Attorney Partnership", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey.pdf", "source_tier": null, "observed_at": null }, { "statement": "Law No. 7499, amending the Code of Criminal Procedure and Certain Laws, introduced amendments to Articles 6, 9 and 18 of the LPPD, with the first segment published in the Official Gazette on 12 March 2024 and effective 1 June 2024.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/turkeys-data-protection-amendments-for-2024-a-closer-look", "source_tier": null, "observed_at": null }, { "statement": "The LPPD and GDPR provide comparable definitions of 'processing', 'personal data' and 'sensitive data', and both apply to automated or filing-system-based processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance / Esin Attorney Partnership", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey.pdf", "source_tier": null, "observed_at": null }, { "statement": "VERBIS registration requirements extend extraterritorially to foreign (non-Turkey-established) data controllers that collect or process personal data originating in Turkey.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/turkish-dpa-extends-data-controllers-registry-deadline", "source_tier": null, "observed_at": null }, { "statement": "Turkish data controllers with 50 or more employees, or annual turnover of TRY 25,000,000 or more, must register with VERBIS; failure to register can trigger fines up to TRY 1,802,000 plus a second fine for non-compliance with Board decisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/turkish-dpa-extends-data-controllers-registry-deadline", "source_tier": null, "observed_at": null }, { "statement": "In a March 2026 public announcement, KVKK clarified that partners in business partnerships, consortiums and ordinary partnerships must incorporate partnership-related personal data processing into their own individual VERBİS registrations rather than creating separate registrations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-issues-public-announcement-verbis", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": null, "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Core lawful-basis and special-category architecture is codified and enforced, but consent-thresholds guidance is comparatively thin relative to GDPR-level granularity, and some 2024 amendment detail was not independently verified this run.", "claims": [ { "statement": "Personal data may be transferred and otherwise processed on legal grounds set out under Article 5 of the LPPD, which operates as the general lawful-basis gateway analogous to GDPR Article 6.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-long-awaited-amendments-in-turkish-data-protection-law", "source_tier": null, "observed_at": null }, { "statement": "Article 6 of the LPPD regulates special categories of personal data, covering race, ethnicity, political opinion, philosophical belief, religion, sect or other belief, association/foundation/trade-union membership, health and sexual life, among other attributes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-long-awaited-amendments-in-turkish-data-protection-law", "source_tier": null, "observed_at": null }, { "statement": "Law No. 7499 (2024) amended Article 6 of the LPPD concerning the processing of special categories of personal data, effective 1 June 2024.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/turkeys-data-protection-amendments-for-2024-a-closer-look", "source_tier": null, "observed_at": null }, { "statement": "KVKK's Regulation on the deletion, destruction and anonymisation of personal data requires data controllers to prepare retention and destruction policies with applicable time periods, and to delete, destroy or anonymise data once the processing purpose ceases to exist.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-releases-regulation-deletion-destruction", "source_tier": null, "observed_at": null }, { "statement": "In the absence of a KVKK-issued safe-country list, obtaining the data subject's explicit consent has been, in practice, the only readily viable method to legalize cross-border personal data transfers under the pre-2024 regime.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-long-awaited-amendments-in-turkish-data-protection-law", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Access-right and erasure-adjacent mechanisms are confirmed and codified, but restriction/objection, portability, and precise response-deadline provisions could not be independently verified with primary citations this run.", "claims": [ { "statement": "KVKK published a supplementary Regulation on 10 March 2018 consolidating the procedure to be followed by data subjects and controllers with respect to subject access requests under Article 11 of the LPPD.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/turkey-sars/", "source_tier": null, "observed_at": null }, { "statement": "Data controllers must delete, destroy or anonymise personal data once the legal reasons for its processing cease to exist, per KVKK's regulation on deletion, destruction and anonymisation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-releases-regulation-deletion-destruction", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Security and breach-notification duties are well-evidenced and actively enforced; DPIA and formal DPO-independence requirements are absent relative to GDPR, which is a structural gap rather than a mere evidentiary one.", "claims": [ { "statement": "Unlike the GDPR, the LPPD does not include any requirement to undertake a Data Protection Impact Assessment or any similar formal obligation to evaluate the risk of personal data processing.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey_update_april_2023.pdf", "source_tier": null, "observed_at": null }, { "statement": "KVKK introduced the concept of a data protection officer via the Communiqué on the Procedures and Principles Regarding the Personnel Certification Mechanism (6 December 2021); however, appointment of a DPO is not a mandatory requirement under the LPPD.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey_update_april_2023.pdf", "source_tier": null, "observed_at": null }, { "statement": "VERBIS is principally kept and maintained by KVKK and is fundamentally different from GDPR Article 30 records kept directly by controllers, though it requires controllers to submit a data-processing inventory.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance / Esin Attorney Partnership", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey.pdf", "source_tier": null, "observed_at": null }, { "statement": "Where personal data is processed by a natural or legal person on behalf of a data controller, the controller is jointly responsible with data processors, who are in turn prohibited from disclosing or using data obtained from the controller for purposes other than the original processing purpose.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance / Esin Attorney Partnership", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey.pdf", "source_tier": null, "observed_at": null }, { "statement": "Article 18 of the LPPD imposes fines for failure to fulfil data-security provisions (historically ranging roughly TRY 15,000 to TRY 1,000,000, revalued annually), and this security-violation category has produced the highest observed fines in KVKK enforcement practice.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/revealing-the-methodology-behind-the-fines-given-by-turkish-dpa", "source_tier": null, "observed_at": null }, { "statement": "KVKK's Board issued a principle decision interpreting the Article 12(5) breach-notification deadline as 72 hours, requiring controllers to report delay reasons, use a standard breach notification form, log breach information, and prepare a data breach response plan.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/revealing-the-methodology-behind-the-fines-given-by-turkish-dpa", "source_tier": null, "observed_at": null }, { "statement": "KVKK's Regulation on deletion, destruction and anonymisation requires data controllers to prepare data retention and destruction policies specifying applicable time periods.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-releases-regulation-deletion-destruction", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "amber", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "A GDPR-aligned SCC/BCR framework is now codified and operative (2024), representing significant convergence, but no safe-country/adequacy list has been published and no reciprocal adequacy status with the EU/UK was confirmed.", "claims": [ { "statement": "Under the pre-2024 regime, in the absence of a KVKK adequacy decision, data could be transferred abroad via notification to KVKK with a standard undertaking, submission of a written agreement with protective measures and obtaining a permit, approval of BCRs, or agreement between compatible public entities.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-long-awaited-amendments-in-turkish-data-protection-law", "source_tier": null, "observed_at": null }, { "statement": "The By-Law on the Procedures and Principles for the Transfer of Personal Data Abroad, implementing amended Article 9 of the LPPD, was published and entered into force in July 2024, alongside KVKK's publication of Turkish standard contract and BCR documents.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/turkey-amendments-transfer-personal-data", "source_tier": null, "observed_at": null }, { "statement": "As KVKK has not issued a safe-country list, the adequacy-based transfer ground under Article 9 of the LPPD has not been practically available.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/the-long-awaited-amendments-in-turkish-data-protection-law", "source_tier": null, "observed_at": null }, { "statement": "Turkish Standard Contractual Clauses are bilateral, require careful data-flow analysis and KVKK notification, and must be executed with wet-ink or secure e-signatures; BCRs also require KVKK approval.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/opinion/turkey-amendments-transfer-personal-data", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "red", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Only the employment_data sub-module has direct, substantive evidentiary support this run; the remaining six sub-modules lack confirmed sector-specific overlay findings.", "claims": [ { "statement": "KVKK's June 2026 announcement on workplace security cameras requires employers to ensure that data processing via CCTV has a legal basis under Article 5 of the LPPD and adheres to fundamental processing principles.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-issues-announcement-security-camera-use", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "red", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "No sub-module in this module reached a substantive, citable evidentiary threshold this run; all six sub-modules carry explicit absent_field_provenance.", "claims": [] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Biometric-data guidance is well-evidenced; AI-specific and ADM-transparency findings rest on title-level sources only and are marked Uncertain pending primary-text confirmation.", "claims": [ { "statement": "KVKK published guidance on 16 September 2021 on the considerations for processing biometric data, defining biometric data and requiring that processing methods be suitable for and proportionate to the purpose, that data be retained only as long as necessary, and that data subjects be informed in accordance with Article 10.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-publishes-guidance-considerations-biometric", "source_tier": null, "observed_at": null }, { "statement": "Both the GDPR and the LPPD provide similar exclusions from their application, including for processing of personal data in the context of public security or law enforcement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance / Esin Attorney Partnership", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey.pdf", "source_tier": null, "observed_at": null }, { "statement": "A parliamentary bill to regulate artificial intelligence in Turkey was reported as introduced around November 2025, alongside a KVKK guide addressing generative AI and personal data protection.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-parliamentary-bill-introduced-regulate", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "red", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "This is a confirmed statutory gap: the LPPD contains no children-specific consent, age-verification, or profiling-ban regime, and no dependent-adult-specific regime was found.", "claims": [ { "statement": "The LPPD does not set an age limit for consent, and there is no age limit set for the notification requirement.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey_update_april_2023.pdf", "source_tier": null, "observed_at": null }, { "statement": "Unlike the GDPR, the LPPD does not grant special protection to children's personal data, nor does it specify whether the consent of a parent or guardian is needed when processing children's data or providing information-society services to a child.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey_update_april_2023.pdf", "source_tier": null, "observed_at": null }, { "statement": "KVKK's only substantive output addressing children's data is a 23 April 2020 brochure bearing similarities with GDPR protective measures, rather than a binding profiling ban.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/gdpr_v_turkey_update_april_2023.pdf", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/turkey/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Powers, penalty tiers, and enforcement-activity evidence are strong; funding/capacity, collective-redress, and private-right-of-action sub-modules remain evidentiary gaps.", "claims": [ { "statement": "Article 18 of the LPPD defines four administrative fine categories: failure to fulfil the obligation to inform, failure to fulfil data-security provisions, failure to fulfil Board decisions, and failure to fulfil VERBIS registration/notification obligations, with amounts revalued annually.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/revealing-the-methodology-behind-the-fines-given-by-turkish-dpa", "source_tier": null, "observed_at": null }, { "statement": "Failure to register in time with VERBIS may result in an administrative fine of up to TRY 1,802,000, plus a second administrative fine of up to TRY 1,802,000 for non-compliance with KVKK's decisions, and KVKK may restrict the controller's data-processing activities in Turkey.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/turkish-dpa-extends-data-controllers-registry-deadline", "source_tier": null, "observed_at": null }, { "statement": "KVKK has fined controllers for late breach notification, including Clickbus Travel Services (TRY 100,000 for notifying two months late), Marriott International (TRY 350,000 for late notification to the DPA and data subjects), and Cathay Pacific Airways (TRY 100,000 for a five-month delay).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/revealing-the-methodology-behind-the-fines-given-by-turkish-dpa", "source_tier": null, "observed_at": null }, { "statement": "On 31 December 2025, KVKK announced updated administrative fine amounts under Article 18 of the LPPD, reflecting the revaluation rate for 2017-2026.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/turkey-kvkk-publishes-administrative-fine-amounts-2", "source_tier": null, "observed_at": null } ] } ] }