Law No. 6698 (KVKK) governs personal data protection in Turkey. Foreign companies processing data of Turkish residents must comply with KVKK obligations.
Scope and Applicability
Applies to data controllers and processors in Turkey.
Extraterritorial reach for data of Turkish residents.
Processing requires legal basis (consent, contract, etc.).
VERBIS Registration
Data Controllers Registry mandatory for most companies.
Annual updates required for changed processes.
Failure to register: TRY fines up to TRY 1,000,000+.
International Transfers
Adequacy decisions limited; explicit consent often required.
Standard Contractual Clauses (SCC) acceptable.
Binding Corporate Rules (BCR) approved by Authority.
Frequently Asked Questions
Does GDPR compliance satisfy KVKK?
Significant overlap but Turkish-specific obligations exist; gap analysis recommended.
What are KVKK fines?
TRY 100,000 to TRY 6,000,000+ for serious violations.