KVKK
Law No. 6698 on the Protection of Personal Data (Kisisel Verilerin Korunmasi Kanunu), as amended by Law No. 7499
KVKK is Turkey's general data protection law, published in the Official Gazette on 7 April 2016. Amendments under Law No. 7499 (published 12 March 2024, effective 1 June 2024) widened the legal bases for processing special category data such as biometrics and replaced the cross-border transfer rules with adequacy decisions, standard contracts, binding corporate rules and limited exceptions.
Who it applies to
Natural and legal persons processing personal data in Turkey, wholly or partly by automated means or as part of a filing system. Many controllers must also register in the Data Controllers Registry (VERBIS).
Identity requirements
- Process biometric and genetic data (special categories under Article 6) only on the specific legal bases the law allows, which since 2024 include, but are not limited to, explicit consent
- Transfer personal data abroad only under an adequacy decision, appropriate safeguards such as standard contracts notified to the Authority within five business days, binding corporate rules, or limited occasional-transfer exceptions
- Take technical and organizational measures to prevent unlawful access to personal data (Article 12)
- Notify the Board of data breaches as soon as possible, which the Board has set at 72 hours, and inform affected individuals
- Provide transparency notices at the time of collection and register in VERBIS where required
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Facial and fingerprint verification is special category processing and needs a valid Article 6 basis. |
| Data residency & cross-border transfer | Using foreign identity or cloud providers requires an Article 9 mechanism, often standard contracts filed with the Authority. |
| Breach notification | The Board's 72-hour expectation applies to account compromise and credential leaks. |
| Audit, logging & accountability | Article 12 security duties include access controls and logging of access to personal data. |
Penalties
Administrative fines are revalued each year. For 2026 the Authority lists fines of up to 17,092,242 Turkish lira for failing data security obligations, breaching Board decisions or failing VERBIS duties, with lower ranges for transparency and transfer-notification failures. Criminal penalties under the Turkish Penal Code also apply to unlawful processing.
Status and dates last verified against primary sources on 2026-10-31.
KVKK: frequently asked questions
- How fast must breaches be reported under KVKK?
- The law requires notification as soon as possible, and the Personal Data Protection Board has set this as within 72 hours of the controller becoming aware of the breach.
- What changed in KVKK in 2024?
- Law No. 7499 widened the legal bases for special category data beyond explicit consent and replaced the old cross-border transfer rules with adequacy decisions, standard contracts, binding corporate rules and limited exceptions, from 1 June 2024.