Data Protection & Privacy Law

The principal legislation in Türkiye is the Personal Data Protection Law No. 6698 (KVKK). Its application is supervised by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

The law regulates the legal conditions for processing personal data, sensitive personal data, transparency obligations, data security and transfers abroad. Depending on the activities and geographic reach of a business, the EU General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR), may also be relevant.

The Data Controllers Registry Information System (VERBİS) applies to data controllers subject to registration requirements. Exemptions are determined by the Board and may depend on workforce, financial and processing criteria.

Data protection assessments. We examine how personal data is collected and used across company departments. The review may cover employees, customers, suppliers, website visitors and business contacts. Data categories, processing purposes, lawful bases, retention practices and disclosures to third parties are identified.

Privacy documentation. Businesses may need privacy notices, personal data processing policies, retention and destruction policies, contractual provisions and data processing arrangements. We review these documents against the relevant processing activities and legal requirements.

VERBİS and internal records. Where registration is required, companies must determine the appropriate data categories, processing purposes, recipient groups and retention information. We assess registration obligations and exemptions, including the applicable Board decisions, before preparing the relevant records.

International transfers. Cross-border transfers require a separate assessment under Article 9 of Law No. 6698. Depending on the circumstances, an applicable adequacy decision or appropriate safeguard may be required. Standard contracts, when used under the statutory framework, must be notified to the Authority within five business days of signature.

Data incidents and regulatory processes. Suspected personal data breaches require assessment of the information affected, the circumstances of the incident and the applicable notification obligations. We review correspondence, incident records and regulatory requirements, including requests from data subjects and the Authority.

Our data protection practice concerns companies processing customer or employee information, technology businesses, e-commerce operators, service providers, multinational groups and in-house legal, human resources, compliance and information security teams.

The September 2025 Board decision No. 2025/1572 revised certain VERBİS registration exemptions. The amended international transfer regime, introduced in 2024, also provides mechanisms involving adequacy decisions and appropriate safeguards, including standard contracts.