# KVKK

KVKK, Law No. 6698, is Turkey's personal data protection law. Learn its principles, legal grounds, VERBIS registration, cross-border transfers and AI implications.

## Overview

KVKK is the common name for Turkey's Law on the Protection of Personal Data, Law No. 6698 (Kişisel Verilerin Korunması Kanunu). It sets the rules for processing information about identified or identifiable people in Turkey: the principles that every processing activity must follow, the legal grounds that justify it, extra protection for sensitive data, obligations to inform people and keep data secure, rules for sending data abroad, and the rights people can exercise. It is enforced by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), whose decision-making body is the Personal Data Protection Board (Kurul). The acronym KVKK is used for both the law and the authority.

An everyday analogy is a pharmacy's prescription register. The pharmacist may record your details only for dispensing, must keep the register locked, must not share it except as the rules allow, must tell you why it is kept, and must answer you if you ask what is recorded. Extra care applies to the most sensitive entries. If the register is lost, the authorities must be told quickly. KVKK applies that discipline to all personal data handled by organisations in Turkey.

For data and AI teams, KVKK matters whenever Turkish customer, employee or citizen data is used for analytics, model training, retrieval or prompts sent to model providers. The 2024 amendments changed how data may be transferred abroad, which directly affects the use of cloud and AI services hosted outside Turkey. The Authority has also published guidance on artificial intelligence and generative AI.

## What it is

The law's main elements are these.

| Element | What it covers |
|---|---|
| Scope | Natural persons' personal data processed wholly or partly by automated means, or non-automated means forming part of a filing system |
| General principles (Article 4) | Lawfulness and fairness; accuracy and currency; specific, explicit and legitimate purposes; relevance, limitation and proportionality; retention only as long as necessary |
| Legal grounds (Article 5) | Explicit consent, or conditions such as being expressly provided by law, necessity for a contract, legal obligation, data made public by the person, establishing or defending a right, and legitimate interests without harming fundamental rights |
| Special categories (Article 6) | Race, ethnic origin, political opinion, beliefs, appearance, association or union membership, health, sexual life, criminal convictions and security measures, biometric and genetic data |
| Obligation to inform (Article 10) | Telling people who the controller is, why data is processed, to whom it is transferred, how it is collected and what rights they have |
| Data security (Article 12) | Technical and administrative measures; notifying the Board and affected people of breaches |
| Cross-border transfers (Article 9) | Adequacy decisions, appropriate safeguards or limited incidental exceptions |
| Rights (Article 11) | Learning whether data is processed, access, purpose, recipients, correction, erasure, objection to automated-only analysis with adverse results, and compensation |
| VERBIS | The Data Controllers' Registry Information System, with registration duties and exemptions |
| Sanctions (Article 18) | Administrative fines, revalued annually, alongside criminal provisions in the Turkish Penal Code |

## Where it came from

Turkey's constitution gained an explicit right to the protection of personal data in a 2010 amendment. Law No. 6698 was published in the Official Gazette on 7 April 2016 and drew heavily on the EU's 1995 Data Protection Directive. Its provisions entered into force in stages during 2016 and 2017, the Authority was established, and secondary legislation followed on erasure, destruction and anonymisation, on the registry, and on the obligation to inform. The Board also set a practical rule that breaches should be notified within 72 hours.

The most significant change came with Law No. 7499, published on 12 March 2024. It amended Article 6 so that special category data may be processed either with explicit consent or under a defined list of conditions, and rewrote Article 9 on transfers abroad to resemble the GDPR's structure. The new rules took effect on 1 June 2024, with a short transition period for the old transfer regime. A Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad followed in July 2024, and the Board published standard contract templates and binding corporate rules documents.

On artificial intelligence, the Authority published recommendations on protecting personal data in AI in 2021, and a guide on generative AI and personal data in late 2025, followed in 2026 by documents on agentic AI and on the workplace use of generative AI tools. In September 2025 the Board revised the VERBIS registration exemption criteria by Decision 2025/1572, effective 1 October 2025. Bills proposing further amendments to the law, including on non-consensual AI-generated content, were submitted to parliament in 2026; check their status before relying on any change.

## How it works

### 1. Inventory processing

List personal data categories, purposes, sources, recipients, retention periods and security measures. This feeds the VERBIS registration where required and the personal data processing inventory.

### 2. Identify the legal ground

For each purpose, choose a ground in Article 5 or, for special categories, Article 6. Explicit consent must be specific, informed and freely given, and should not be used as a fallback when another ground applies; the Authority has criticised bundling consent with service terms.

### 3. Inform people

Provide a clear notice at the time of collection, separate from any consent request, explaining the controller, purposes, recipients, collection method and legal ground, and rights.

### 4. Secure the data

Apply technical and administrative measures appropriate to the risk, with stricter measures for special categories. The Board has published guidance on security measures and on special category data.

### 5. Register where required

Controllers that meet the criteria register in VERBIS and keep entries updated. Exemptions depend on factors such as employee numbers, annual balance sheet totals and whether the main activity is processing special category data; the thresholds were most recently revised in 2025. Controllers established outside Turkey generally must register and appoint a representative in Turkey.

### 6. Transfer abroad lawfully

Under the amended Article 9, data may go abroad if one of the Article 5 or 6 conditions exists and there is an adequacy decision for the destination. Without adequacy, the parties may use appropriate safeguards: binding corporate rules approved by the Board, standard contracts published by the Board, or written undertakings with Board permission. Standard contracts must be notified to the Authority within five business days of signing. Limited exceptions, for incidental transfers only, cover cases such as explicit consent after being informed of the risks.

### 7. Handle requests and breaches

Respond to data subject applications within 30 days. Notify breaches to the Board within 72 hours and inform affected people.

### 8. Erase or anonymise

When the purpose ends, delete, destroy or anonymise data according to a retention and destruction policy, at the intervals set in the relevant regulation.

## Key concepts and terms

| Term | Meaning |
|---|---|
| Kişisel veri | Personal data: any information relating to an identified or identifiable natural person. |
| Veri sorumlusu | Data controller: decides purposes and means of processing and runs the filing system. |
| Veri işleyen | Data processor: processes data on the controller's behalf. |
| Açık rıza | Explicit consent: specific, informed, freely given consent. |
| Özel nitelikli kişisel veri | Special category personal data under Article 6. |
| Aydınlatma yükümlülüğü | Obligation to inform data subjects. |
| VERBIS | The data controllers' registry information system. |
| Yeterlilik kararı | Adequacy decision for transfers abroad. |
| Standart sözleşme | Standard contract published by the Board for transfers. |
| Bağlayıcı şirket kuralları | Binding corporate rules for intra-group transfers. |
| Kurul | The Personal Data Protection Board. |
| Anonimleştirme | Anonymisation: making data no longer linkable to a person. |

## A worked example

This scenario is illustrative. A Turkish online retailer wants to use a large language model hosted outside Turkey to summarise about 30,000 customer-support chats per month and suggest replies. Chats include names, phone numbers, order details and occasionally health information, such as a customer explaining a medical reason for a return.

The compliance team starts with a transfer analysis. No adequacy decision covers the provider's country, so they sign the Board's standard contract for controller-to-processor transfers with the provider and notify it to the Authority within five business days. The processing purpose, improving support response, is assessed under the legitimate-interest ground, with a balancing note on file.

Because health information is special category data, they decide it must not leave Turkey for this purpose. A pre-processing step running on servers in Turkey, built with a PII detection tool such as [Presidio](/tools/presidio), detects and removes health-related passages and replaces names and phone numbers with placeholders before any text is sent. Tests on 2,000 sample chats show the filter catches 98% of names and phone numbers; the remaining cases are reviewed and the rules improved. The privacy notice is updated to mention service providers abroad, the VERBIS entry is updated with the new recipient group and transfer, and the processor agreement sets a 30-day deletion period for prompts and outputs. Support agents review every suggested reply, so no decision with adverse effect is made solely by automated analysis.

## Strengths and limitations

**Strengths:**

- A comprehensive framework aligned with European principles.
- 2024 transfer reforms provide practical tools such as standard contracts.
- An active authority that publishes decisions, guides and AI-specific guidance.
- Clear rights for individuals and defined response times.
- Registry and inventory duties encourage organised data governance.

**Limitations:**

- In practice most transfers rely on safeguards such as standard contracts, which add paperwork and notification duties.
- Some concepts differ from the GDPR, so EU compliance does not automatically mean KVKK compliance.
- Detailed guidance on AI training and model use is still developing.
- Registry thresholds and procedures change, requiring periodic review.
- Explicit consent remains central in practice, which can be hard to apply to large datasets.

## How it compares with alternatives

| Law | Jurisdiction | Key differences from KVKK |
|---|---|---|
| [GDPR](/tools/gdpr) | EU and EEA | More detailed duties such as DPIAs and DPOs; legitimate interests used more widely; higher fine ceilings based on turnover |
| UK GDPR | United Kingdom | GDPR-based, with its own adequacy regime and regulator |
| [EU AI Act](/tools/eu-ai-act) | European Union | AI-specific risk rules; can apply to Turkish providers selling into the EU |
| Brazil's LGPD | Brazil | GDPR-modelled, with its own lawful bases and authority |
| Sector rules (banking, health, electronic communications) | Turkey | Additional requirements, such as data localisation, alongside KVKK |

## Practical guidance and best practices

1. Keep a personal data processing inventory that includes analytics, AI training data, prompts and logs.
2. Use explicit consent only where no other legal ground fits, and keep it separate from the notice.
3. Treat special category data with extra care and avoid sending it abroad unless clearly lawful.
4. For cloud and AI providers abroad, check for adequacy, otherwise use standard contracts or other safeguards, and meet the five-business-day notification.
5. Pseudonymise or remove direct identifiers before sending text to external models, for example with [data tokenization](/tools/data-tokenization).
6. Update VERBIS entries and privacy notices when you add recipients or transfers.
7. Prepare breach response procedures that meet the 72-hour notification expectation.
8. Read the Authority's AI and generative AI guidance and reflect it in internal [AI governance](/tools/ai-governance) policies.
9. If you also serve EU users, map KVKK and GDPR duties separately rather than assuming one covers the other.

## Common mistakes

- Relying on explicit consent buried in terms of service.
- Combining the privacy notice and the consent request in one text.
- Using foreign SaaS or model APIs without a transfer mechanism.
- Signing a standard contract but failing to notify it in time.
- Forgetting that VERBIS registration and entries must be kept current.
- Assuming GDPR documentation automatically satisfies KVKK.

## Frequently asked questions

### Does KVKK apply to foreign companies?

It applies to processing of personal data of people in Turkey by controllers that fall under it, and foreign controllers in scope generally must register in VERBIS through a representative in Turkey. The exact position depends on the facts.

### How did the 2024 amendments change transfers abroad?

Before June 2024, transfers without explicit consent required an adequacy finding or Board permission for written undertakings, which was rarely granted. Since 1 June 2024, transfers can rely on adequacy, standard contracts, binding corporate rules or Board-approved undertakings, with limited incidental exceptions.

### Can I use cloud AI services hosted outside Turkey?

Yes, if the transfer meets Article 9: a legal ground, plus adequacy or an appropriate safeguard such as the Board's standard contract notified within five business days. Minimising and pseudonymising the data first reduces risk.

### Do I need to register in VERBIS?

It depends on your organisation. The Board sets exemptions based on factors such as number of employees, annual balance sheet total and the nature of the main activity; the criteria were revised by Decision 2025/1572 effective 1 October 2025. Check the current criteria on the Authority's website.

### How is KVKK related to the GDPR?

KVKK was modelled on the EU's 1995 Directive and shares its principles. The 2024 reforms brought transfer rules closer to the GDPR, but the laws still differ in legal grounds, registration, procedures and sanctions.

### Is there AI-specific guidance?

Yes. The Authority published recommendations on AI in 2021, a generative AI guide in late 2025 and further documents in 2026 on agentic AI and workplace use of generative AI tools.

## Glossary

- KVKK: Law No. 6698 on the Protection of Personal Data, and also the Authority.
- Kurul: the Personal Data Protection Board.
- VERBIS: the data controllers' registry.
- Data controller: the party deciding purposes and means.
- Data processor: the party processing on the controller's behalf.
- Explicit consent: specific, informed and freely given consent.
- Special category data: sensitive data listed in Article 6.
- Standard contract: a Board-published transfer contract.
- Adequacy decision: recognition of a destination's protection level.
- Anonymisation: making data no longer linkable to a person.

## Summary

KVKK, Law No. 6698 of 2016, is Turkey's personal data protection law, setting principles, legal grounds, special-category rules, information and security duties, registry obligations and rights, enforced by the Personal Data Protection Authority. The 2024 amendments under Law No. 7499 reshaped special category processing and transfers abroad from 1 June 2024, introducing adequacy, standard contracts and binding corporate rules. For AI work, teams should inventory data, choose legal grounds carefully, minimise and pseudonymise before using external models, secure transfers with the right mechanism and notifications, and follow the Authority's AI guidance while tracking pending legislative changes. This page is general information, not legal advice.