Türkiye's Personal Data Protection Law No. 6698 (KVKK) obliges data controllers to take all necessary technical and organisational measures, report breaches to the Personal Data Protection Board within 72 hours, register in VERBIS, and, since the 2024 amendments, move cross-border transfers onto adequacy, standard contracts or other approved safeguards. The law is modelled on the EU's 1995 Directive rather than the GDPR, so explicit consent, registration and Board decisions carry more weight than GDPR teams expect. This guide covers scope, the core duties, the Article 9 transfer regime in force since 1 June 2024, 2026 fine levels, what KVKK means for AI agents and machine credentials, and a compliance plan. It is for security, privacy and engineering leads supporting processing in or from Türkiye. For the transfer picture across regimes, see the International Data Transfers Map.
Key takeaways
- 72 hours to the Board: Board Decision 2019/10 of 24 January 2019 reads Article 12(5)'s "shortest time" as 72 hours from learning of the breach, with reasons required for any delay.
- Standard contracts must be filed: under amended Article 9(5) a signed standard contract must be notified to the Authority within five business days, and failing to do so is a separate fine under Article 18(1)(d).
- Article 9 changed on 1 June 2024: Law No. 7499 replaced the old consent-or-Board-permission model with adequacy decisions, appropriate safeguards and narrow incidental exceptions; the old first paragraph lapsed on 1 September 2024.
- Fines are revalued every year: for 2026 the data security fine under Article 18(1)(b) runs from 256,357 TL to 17,092,242 TL after a 25.49% revaluation.
- The Board publishes breaches: breach notices appear on kvkk.gov.tr, and since Decision 2025/2451 of 25 December 2025 they stay up for 60 days.
Scope: who and what is covered
Law No. 6698 was ratified on 24 March 2016 and published on 7 April 2016. It applies to natural persons whose personal data is processed, and to natural and legal persons who process that data wholly or partly by automated means, or by non-automated means that form part of a data filing system. The official English translation on kvkk.gov.tr notes that the Turkish text prevails.
| Element | KVKK position | Article |
|---|---|---|
| Data controller (veri sorumlusu) | Determines the purposes and means of processing and manages the filing system | Art. 3 |
| Data processor (veri işleyen) | Processes on the controller's behalf under its authority; jointly responsible with the controller for security measures | Arts. 3, 12(2) |
| Special categories | Race, ethnic origin, political opinion, philosophical belief, religion, appearance, association, foundation or union membership, health, sex life, criminal convictions and security measures, biometric and genetic data | Art. 6 |
| Registry | Data Controllers' Registry (VERBIS), registration before processing unless exempt | Art. 16 |
| Regulator | Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and its decision-making Board | Arts. 19-22 |
Foreign organisations: a controller outside Türkiye that processes data of people in Türkiye is generally expected to register in VERBIS through a Türkiye-resident representative. Confirm your position with local counsel before you file.
Key obligations
Principles and processing conditions
Article 4 requires processing to be lawful and fair, accurate and up to date, for specified, explicit and legitimate purposes, relevant, limited and proportionate, and kept only as long as the law or the purpose requires. Article 5 starts from the rule that personal data shall not be processed without the data subject's explicit consent, then lists alternatives: processing explicitly provided by law, protection of life or physical integrity, performance of a contract, a legal obligation of the controller, data made public by the data subject, establishing or protecting a right, and the controller's legitimate interests provided the data subject's fundamental rights are not harmed.
| Security or IT activity | Usual Article 5 or 6 condition | Watch point |
|---|---|---|
| Security monitoring, log retention | Legitimate interests (Art. 5(2)(f)) or legal obligation (5(2)(ç)) | Document the balancing; do not fall back on blanket consent |
| Customer account authentication | Contract performance (5(2)(c)) | Covers what the contract needs, not optional analytics |
| Biometric login or attendance | Special category, Art. 6(3): explicit consent or a listed ground | Board principle decision 2026/921 of 29 April 2026 addresses biometric attendance systems |
| Employer review of corporate email | Legitimate interests or legal obligation | Board principle decision 2026/2035 of 16 September 2026 sets the approach |
| Forensic evidence and litigation holds | Establishing, exercising or protecting a right (5(2)(e), 6(3)(d)) | Scope the hold and release it when the matter ends |
Since the 2024 amendments, Article 6(3) lists conditions for all special categories together (explicit consent, explicit provision by law, protection of life, data made public by the data subject, establishing a right, public health and health services, employment and social security obligations, and foundations and associations for their members). Adequate measures set by the Board still apply.
Transparency, rights and the registry
- Duty to inform (Art. 10): at collection, tell the data subject the controller's identity, purposes, recipients, method and legal ground, and their Article 11 rights.
- Data subject rights (Art. 11): learn whether data is processed, request information, learn the purpose, know the recipients in Türkiye or abroad, request correction or erasure, object to an adverse result arising exclusively from automated analysis, and claim compensation.
- Response time (Art. 13): controllers must conclude requests within thirty days, free of charge in principle; refused or unanswered applicants can complain to the Board (Art. 14).
- VERBIS (Art. 16): register before processing unless exempt. Decision 2023/1154 of 6 July 2023 exempts controllers with fewer than 50 employees and an annual balance sheet below TRY 100 million whose main activity is not processing special category data. Decision 2025/1572 of 4 September 2025 adds an exemption for controllers whose main activity is processing special category data if they have fewer than 10 employees and a balance sheet below TRY 10 million.
Data security: Article 12
Article 12(1) requires the controller to take all necessary technical and organisational measures to prevent unlawful processing, prevent unlawful access and ensure safekeeping. Article 12(2) makes the controller jointly responsible with any processor, Article 12(3) requires the audits needed to ensure compliance, and Article 12(4) bars controllers and processors from disclosing or misusing data, a duty that continues after they leave. The Authority's Personal Data Security Guide (Technical and Administrative Measures), published in January 2018, is the reference point the Board uses to describe "necessary measures":
| Technical measures named in the guide | Administrative measures named in the guide |
|---|---|
| Authorisation matrix and authorisation control | Personal data processing inventory |
| Access logs and log records | Corporate policies on access, security, use, retention and destruction |
| User account management | Contracts between controllers and with processors |
| Network and application security, firewalls | Confidentiality undertakings |
| Encryption and key management | Periodic or random internal audits |
| Penetration testing, intrusion detection and prevention | Risk analyses |
| Data masking and data loss prevention | Employment contract and disciplinary provisions |
| Backup and up-to-date anti-virus | Corporate communication, including crisis handling and Board notification |
| Deletion, destruction or anonymisation | Training and awareness; VERBIS registration |
The authorisation matrix and user account management items are where machine identities belong: service accounts and API clients need owners, scopes and review just like staff accounts.
Breach notification
| Requirement | Rule | Source |
|---|---|---|
| Trigger | Processed personal data obtained by others by unlawful means | Art. 12(5) |
| Board notice | Without delay and at the latest 72 hours from the controller learning of the breach; reasons given for any delay | Decision 2019/10 |
| Form | Personal Data Breach Notification Form; information may be provided in stages if not all available at once | Decision 2019/10 |
| Data subjects | As soon as possible after identifying who is affected, directly where contact details exist, otherwise by notice on the controller's website | Decision 2019/10 |
| Processors | Must inform the controller as soon as possible | Decision 2019/10 |
| Records | Document the breach, its effects and measures taken, and keep them for the Authority | Decision 2019/10 |
| Response plan | Maintain and regularly review a data breach intervention plan naming who reports to whom and who is responsible | Decision 2019/10 |
| Publication | The Board may announce the breach; announcements stay on its website for 60 days, or less if the controller proves all data subjects were notified | Art. 12(5); Decision 2025/2451 |
The 72-hour clock matches the GDPR's but runs from when the controller learns of the breach, and the Board publishes notices by company name. For a multi-country workflow, see the Data Breach Notification Checklist and the Breach Notification Laws by Country Guide.
Cross-border transfers: amended Article 9
Article 9, as amended by Law No. 7499 (dated 2 March 2024), lets controllers and processors transfer data abroad in three tiers. The Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad was published in the Official Gazette on 10 July 2024.
| Tier | Mechanism | Key conditions |
|---|---|---|
| 1. Adequacy (Art. 9(1)-(3)) | Board adequacy decision for a country, sector or international organisation, published in the Official Gazette | Plus an Article 5 or 6 condition; reviewed at least every four years |
| 2. Appropriate safeguards (Art. 9(4)-(5)) | Agreements between public bodies; binding corporate rules approved by the Board; the Board's standard contract; a written undertaking approved by the Board | Data subjects must keep enforceable rights and effective remedies; standard contracts filed within five business days, including later changes and termination |
| 3. Incidental transfers (Art. 9(6)) | Explicit consent after being told of the risks; contract performance; overriding public interest; establishing a right; protecting life; certain public registries | Only for transfers that are not regular, happen once or a few times and are not continuous |
The Authority's announcement on standard contracts adds practical rules: only optional or alternative clauses may be changed, the Turkish version must be signed by authorised representatives, both signature dates must appear so the five-day deadline can be checked, and filings by registered electronic mail (KEP) must attach the full contract, with notarised Turkish translations of foreign-language documents. Article 9(8) extends these safeguards to onward transfers. Cloud hosting, SaaS support access from abroad and offshore SOC services are regular transfers: they need tier 1 or 2, not the incidental exceptions.
Timeline and current status
| Date | Event |
|---|---|
| 7 April 2016 | Law No. 6698 published in the Official Gazette |
| January 2018 | Personal Data Security Guide (Technical and Administrative Measures) published |
| 24 January 2019 | Board Decision 2019/10 on breach notification procedures (72 hours) |
| 6 July 2023 | Decision 2023/1154 sets current general VERBIS exemption thresholds |
| 2 March 2024 | Law No. 7499 amends Articles 6, 9 and 18 and adds Provisional Article 3 |
| 1 June 2024 | Amended Article 9 transfer regime in force |
| 10 July 2024 | Transfer Regulation published in the Official Gazette |
| 1 September 2024 | Old Article 9(1) stops applying under Provisional Article 3 |
| 4 September 2025 | Decision 2025/1572 adds VERBIS exemption for small special-category controllers |
| 27 November 2025 | 2026 revaluation rate of 25.49% published (Official Gazette 33090) |
| 25 December 2025 | Decision 2025/2451 limits breach announcements to 60 days |
| 29 April and 16 September 2026 | Principle decisions 2026/921 (biometric attendance) and 2026/2035 (employer email audits) |
Status as of October 2026: Law No. 6698 is in force as amended by Law No. 7499, with the Article 9 regime fully applicable since 1 September 2024. Fine amounts change every 1 January, so check the Authority's published table before quoting a figure.
Enforcement and penalties
Article 18 sets administrative fines, which are revalued each year. The 2026 ranges are:
| Violation | Article 18 | 2026 range (TL) | Who is fined |
|---|---|---|---|
| Failure to inform (Art. 10) | (1)(a) | 85,437 to 1,709,200 | Controller |
| Failure of data security obligations (Art. 12) | (1)(b) | 256,357 to 17,092,242 | Controller |
| Failure to comply with Board decisions (Art. 15) | (1)(c) | 427,263 to 17,092,242 | Controller |
| Registry and notification breaches (Art. 16) | (1)(ç) | 341,809 to 17,092,242 | Controller |
| Failure to notify a standard contract (Art. 9(5)) | (1)(d) | 90,308 to 1,806,377 | Controller, processor or other private-law person |
Since 2024, Article 18(3) sends appeals against fines to the administrative courts. The Board can also order processing to stop, and its decisions are binding. Criminal liability for unlawful recording, transfer or failure to destroy data sits in the Turkish Criminal Code, which Article 17 cross-refers to.
What it means for AI agents and non-human identities
- Leaked machine credentials are an Article 12(5) event: if a token, API key or service account password is used by an outsider to reach personal data, data has been obtained unlawfully and the 72-hour clock starts. The Microsoft SAS token exposure shows how one over-permissive storage token can expose large internal datasets. See the Secrets Management Guide.
- Authorisation matrix covers agents: the security guide's authorisation matrix and user account management measures should list every service account, agent and API client with personal data access, its owner and its scope. See the Service Account Security Guide.
- Model APIs abroad are transfers: sending prompts with personal data to an LLM hosted outside Türkiye is a regular transfer that needs adequacy or a filed standard contract, not explicit consent.
- Automated analysis objections: Article 11 lets data subjects object to an adverse result produced exclusively by automated analysis, so agent-driven decisions about people need a human review path and logged inputs.
- Log records are a named measure: keep agent action logs that show which identity accessed which data, to support both breach scoping and Article 12(3) audits. See the AI and Privacy Guide.
Framework mapping
| KVKK requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Processing conditions (Arts. 5-6) | GV.OC-03 | PT-2, PT-3 | A.5.34 |
| Processing inventory, VERBIS (Art. 16) | ID.AM-07 | PT-3, SI-12 | A.5.9 |
| Authorisation matrix, account management (Art. 12) | PR.AA-05 | AC-6, IA-5 | A.5.15, A.5.18 |
| Encryption, logs, backups (Art. 12) | PR.DS-01 | SC-28, AU-2, AU-11 | A.8.24, A.8.15, A.8.13 |
| Processor contracts and transfers (Arts. 9, 12(2)) | GV.SC-05 | SA-9 | A.5.19, A.5.20 |
| Breach notification (Art. 12(5)) | RS.CO-02, RS.CO-03 | IR-6, IR-8 | A.5.24, A.5.26 |
| Risk analyses | GV.OC-03 | RA-3 | A.5.7 |
Compliance steps
- Build the processing inventory by purpose, data category, legal condition, retention, recipients and transfers, including systems used by agents and service accounts. It feeds VERBIS and the authorisation matrix.
- Decide VERBIS status against Decisions 2023/1154 and 2025/1572, then register or document the exemption.
- Replace default consent: move security, contract and HR processing onto the right Article 5 or 6 conditions and keep explicit consent for what genuinely needs it.
- Map controls to the security guide: evidence each technical and administrative measure, with pilots for data masking or DLP in high-risk areas.
- Fix transfers: list every foreign recipient, sign the Board's standard contract without changes, file it within five business days, and track changes and terminations.
- Rewrite the incident plan for 72 hours: pre-fill the breach notification form, assign who files, prepare Turkish data subject notices, and test with a tabletop that starts on a Friday.
- Audit annually as Article 12(3) expects, and roll findings into the risk analysis.
Small versus large organisations: a small controller may be VERBIS-exempt but still has every Article 12 duty and the 72-hour rule. A multinational should treat Türkiye as its own transfer jurisdiction: EU SCCs do not substitute for the Board's standard contract, and each signed contract has its own filing deadline.
Detection and measurement
- Hours from awareness to Board notification per breach and exercise (target: under 72).
- Standard contracts filed within five business days as a share of contracts signed (target: 100%).
- Coverage of the authorisation matrix: percentage of human and machine accounts with personal data access that have an owner and a review date.
- Data subject requests closed within 30 days (target: 100%).
- Secrets exposures found by scanning per month for credentials that reach personal data, and median time to revoke.
Common failure patterns
- Signing but not filing: the standard contract is valid only with notification, and missing the five-day window is fined separately.
- Editing the standard contract: merging it into a vendor DPA and changing core clauses breaks it.
- Relying on consent for regular transfers: explicit consent is an incidental exception after 2024, not a basis for continuous cloud transfers.
- Slow internal escalation: if the SOC knows and the privacy lead does not, the 72 hours are gone before anyone files.
- Machine accounts outside the authorisation matrix: service accounts and agents with broad database access appear in neither the inventory nor the access reviews.
Practitioner checklist
- Maintain a processing inventory that includes agents and service accounts.
- Confirm and record VERBIS registration or exemption.
- Assign an Article 5 or 6 condition to every security and HR processing activity.
- Evidence each measure in the Authority's security guide, including the authorisation matrix.
- Use the Board's standard contract unchanged and file it within five business days.
- Keep a 72-hour breach runbook with the notification form pre-filled.
- Keep the data breach intervention plan current and the breach records available.
- Rotate and scope machine credentials that reach personal data.
Standards and references
- Personal Data Protection Authority (KVKK): Law No. 6698 on Personal Data Protection (English translation)
- Personal Data Protection Authority: Administrative fine amounts under Law No. 6698
- Personal Data Protection Authority: Personal Data Security Guide (Technical and Administrative Measures)
- Personal Data Protection Authority: Board decisions
- CMS: KVKK limits publication period for data breach notices to 60 days
- CMS: Expanded VERBIS exemptions for small-scale data controllers
- Erdem and Erdem: Public announcement on key considerations for standard contracts
- Cottgroup: Administrative fine amounts in KVKK for 2026
This guide summarises Türkiye's Law No. 6698 and Personal Data Protection Board decisions as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: International Data Transfers Map · Global Privacy Regulatory Map · GDPR Compliance Guide for Security Teams · DPIA Guide