Overview of Turkey’s Personal Data Protection Law (KVKK)

Introduction Turkey’s Personal Data Protection Law No. 6698, also known as Kişisel Verileri Koruma Kanunu (KVKK), was enacted on April 7, 2016. This law was Turkey’s first comprehensive regulation dedicated to the protection of personal data, setting obligations for those handling personal data.

Establishment of the Turkish Data Protection Authority (TDPA) The TDPA was established in early 2017 as an independent authority tasked with enforcing the KVKK, promoting data protection awareness, and overseeing compliance among data controllers and processors.

Scope and Application The KVKK applies to data controllers and processors that collect or process personal data from individuals in Turkey, including both domestic and foreign entities. The law defines “personal data” broadly and includes special provisions for sensitive personal data.

Key Requirements and Provisions

• Registration with VERBIS: Data controllers are required to register with VERBIS (Data Controllers Registry Information System) before starting any data processing activities. This involves appointing a representative in Turkey and creating a Data Processing Inventory.
• Deadlines and Exemptions: Registration deadlines have been extended multiple times, with certain exemptions for smaller entities or those processing data non-electronically.
• Cross-border Data Transfers The law permits international data transfers with explicit consent from the data subject or if adequate protective measures are in place, similar to GDPR standards.
• Compliance Obligations and Penalties.
• Data Breach Notifications: Controllers must notify the TDPA of any breaches within 72 hours and have a Data Breach Response Plan.
• Penalties: Non-compliance can lead to substantial administrative fines and, in some cases, criminal penalties under the Turkish Penal Code.