Law No. 6698, Turkish and English on one fold, consolidated to March 2024. Read the statute

gdpr.com.tr
TR Contact Menu
gdpr.com.tr
TR Contact
Türkçe

KVKK is not GDPR with a Turkish accent.

Law No. 6698 borrows GDPR’s vocabulary and then diverges exactly where it costs money. We publish the primary instruments in working English, so you can test our reading against the text before you retain anybody, including us.

Scope a gap assessment Read Law No. 6698

Pudicitia Plaster cast of a Roman marble · SMK KAS199 Move the cursor across the stone Touch the stone

Sector experience

  • Automotive
  • Healthcare
  • Pharmaceuticals
  • Insurance
  • Banking
  • Finance
  • Real estate
  • Energy
  • Technology
  • Retail
  • Construction
40+ compliance projects led, end to end
2,000+ professionals trained across legal, HR, IT, security and marketing
31 jurisdictions compared in the Atlas
Before you collect.
While you process.
When the Board asks.

A lawful basis and a notice before the first record is collected. Transfers, retention and security while it is processed. And a file the Personal Data Protection Board can follow on the day it asks.

The Turkish delta

Law No. 6698 keeps a public registry with no European equivalent, a consent standard that will not carry a routine HR file, and a transfer regime that wants your signed standard contract filed with the Authority within five business days. We read the instrument, map it to what you actually do, and document the gap before anyone drafts a policy.

Services

Registration andrepresentation

Assessment of registry obligations under Article 16 against the Authority’s current exemption criteria, and preparation of the VERBİS submission where registration is required.

Discover more — Registration and representation

Data transfersand contracts

Selection and implementation of the right transfer mechanism under Article 9 and the 2024 By-Law: standard contract, binding corporate rules, written undertaking, or an occasional-transfer assessment where the derogation genuinely applies.

Discover more — Data transfers and contracts

DPO, training andongoing support

External data protection support on a standing basis: a named contact for day-to-day questions, periodic document review, role-based training for legal, HR, IT, security and marketing, and incident response — including the sequencing of Board notification, data subject communication and internal containment when the 72-hour expectation is running.

Discover more — DPO, training and ongoing support

Sector-specific andAI programmes

Focused work where the general framework is not enough: HR and workplace monitoring, healthcare and pharmaceuticals, retail and duty-free, media and adtech, and AI and LLM deployments.

Discover more — Sector-specific and AI programmes

Where the paperwork fails

Six places KVKK will not accept your GDPR file.

If your programme was built for GDPR, most of it survives the crossing. These are the parts that do not.

01 of 06

  1. VERBİS has no European equivalent

    Registration with the Data Controllers’ Registry is a standalone obligation under Article 16, with its own thresholds and exemption criteria. A controller established outside Türkiye must appoint a representative in Türkiye and complete registration before processing begins — not after the first complaint arrives.

  2. Explicit consent is narrower than you think

    Açık rıza must be specific to a defined subject, informed, and freely given. Consent bundled into a condition of service is not free, and the Board has said so. KVKK’s alternative lawful bases are a closed list — you cannot argue your way to a new one.

  3. Transfers abroad run on a Turkish ladder

    Since the March 2024 amendment and the By-Law in force from 10 July 2024: an adequacy decision first, then appropriate safeguards — standard contract, binding corporate rules, written undertaking — and only then the narrow occasional-transfer derogations. A signed standard contract must be notified to the Authority within five business days. Undertakings and binding corporate rules need the Board’s prior authorisation.

  4. Breach notification is short, and public

    Article 12(5) requires notification to the Board and communication to affected data subjects in the shortest time; the Board reads that as 72 hours. It may then publish the breach on its own website. The reputational exposure is part of the sanction, not a side effect of it.

  5. Fines are revalued every year

    Article 18 sets nominal bands. Those bands are uprated annually by the revaluation rate, which is why the ceiling a client actually faces in 2026 is TRY 17,092,242 rather than the figure on the page. Fines are imposed per violation, and since 2024 they are appealed to the administrative courts rather than the criminal judgeships of peace.

  6. Thirty days to answer a data subject

    Article 13 gives the controller thirty days at the outside, free of charge. Miss it and the data subject may complain to the Board within thirty days of your response, or sixty days of the request. Your GDPR one-month clock and your Turkish thirty-day clock are not the same clock.

Primary sources

The instruments, not a summary of them.

Most consultancies quote the law. We laid the whole of it out. Article 1 through Article 33: the Personal Data Protection Authority’s English translation set against the binding Turkish clause by clause, every enumerator aligned, every amendment marker kept where the legislature put it, and the March 2024 amendments under Law No. 7499, which rewrote the transfer regime, on a redline of their own. The Turkish alone binds. Read it, disagree with our reading, and tell us; that conversation is usually the beginning of a good engagement.

  1. Law No. 6698 on the Protection of Personal Data

    Authority’s English text · Articles 1–33 · 7 chapters

    The complete statute in the Authority’s English beside the binding Turkish, with amendment markers, the repealed Article 6(2), and Provisional Article 3 preserved as structured metadata rather than flattened into prose.

  2. By-Law on the Transfer of Personal Data Abroad

    Authority’s English text · In force 10 July 2024

    The operative rules behind Article 9: adequacy, standard contracts, binding corporate rules, undertakings, and the narrow occasional-transfer derogations — plus the notification mechanics that catch most groups out.

  3. Board Principle Decisions

    Digest · Continuously updated

    The Board’s principle decisions are where the statute acquires its real edges — on consent bundling, on transfers, on security measures. A working digest of what the Board has actually decided, not what commentators expect it to decide.

One caution we repeat to every client: the administrative fine figures printed in Article 18 are the original nominal amounts. Turkish administrative fines are revalued each year by the revaluation rate (yeniden değerleme oranı). Budget against the current year’s revalued bands, not the statutory text.

Atlas Mundi Privaticus

Thirty-one jurisdictions on one globe.

We built an interactive atlas comparing Türkiye’s KVKK with the 27 EU member states and 3 EEA countries — supervisory authorities, penalty ceilings, implementing legislation and representative decisions, in Turkish and English. It exists because the question we are asked most often is not “what does KVKK say?” but “how far is KVKK from the regime we already run?”. Now you can look.

Open atlas.gdpr.com.tr

Use the arrow keys to step through the jurisdictions.
JURISDICTIONS
31
EU MEMBER STATES AND EEA COUNTRIES
27 + 3
FULLY BILINGUAL
TR / EN

The 31 jurisdictions, drawn from the Atlas’s own data

TÜRKİYE

  • Türkiye

EU · 27

  • Austria
  • Belgium
  • Bulgaria
  • Cyprus
  • Czechia
  • Germany
  • Denmark
  • Estonia
  • Spain
  • Finland
  • France
  • Greece
  • Croatia
  • Hungary
  • Ireland
  • Italy
  • Lithuania
  • Luxembourg
  • Latvia
  • Malta
  • Netherlands
  • Poland
  • Portugal
  • Romania
  • Sweden
  • Slovenia
  • Slovakia

EEA · 3

  • Iceland
  • Liechtenstein
  • Norway

Who we work for

Two problems, one body of law.

GDPR → KVKK

International businesses processing data of people in Türkiye

You already run GDPR, UK GDPR or CCPA. You do not need a second privacy programme; you need the Turkish delta identified, documented and closed without disturbing what already works. That is a mapping exercise, and we have done it more than forty times.

KVKK → GDPR

Turkish companies aligning KVKK with GDPR

You are compliant at home and now a European customer, investor or parent is asking for evidence against a standard you were not built to. We reconcile the two records — one inventory, one retention schedule, one transfer register that satisfies both the Board and a European auditor.

Us in numbers

The record behind the reading.

Compliance projects led
40+
End-to-end KVKK programmes, audits and remediation for companies operating in or targeting Türkiye.
Industries
15+
Technology, e-commerce, pharma, aviation, HR and more — deliverables tailored to sector-specific obligations.
Professionals trained
2,000+
Role-based workshops for legal, HR, IT, security and marketing teams, with practical exercises.
Data transfer frameworks
20+
Implemented across standard contracts, written undertakings, binding corporate rules and occasional-transfer assessments.

Knowledge Centre

Notes from the practice.

All notes
  1. COMPLIANCE ARTICLES

    Cross-border data transfers under Turkey’s KVKK

    The July 2024 Regulation implementing amended Article 9 of the KVKK: adequacy decisions, appropriate safeguards, five-day SCC notification, occasional exceptions.

    5 min read
  2. KVKK GUIDES

    Explanatory Note on Chatbots (ChatGPT Example) under Turkey’s KVKK

    The Authority’s June 2025 note on conversational AI: what chatbots process, where the risks sit, and the privacy-by-design duties it places on developers.

    5 min read
  3. KVKK GUIDES

    Explanatory Note on Deepfake Technology under Turkey’s KVKK

    The Authority’s April 2025 note on synthetic media: how deepfakes depend on biometric data, how to spot them, and the measures expected of organisations.

    5 min read