Turkey: Law on the Protection of Personal Data

« Back to Glossary Index

Turkey has a data protection law called the “Law on the Protection of Personal Data” (KVKK), which was enacted on April 7, 2016, and went into effect on October 7, 2016. The KVKK is Turkey’s first comprehensive data protection law and aims to protect the personal data of Turkish citizens.

The KVKK applies to all individuals and entities that process personal data in Turkey, regardless of whether they are located in Turkey or abroad. It sets out strict rules on how personal data can be collected, processed, stored, and shared.

Some of the key provisions of the KVKK include:

  1. Consent: The KVKK requires that individuals provide informed consent before their personal data can be collected, processed, or shared.
  2. Transparency: The KVKK requires that data controllers inform individuals about how their personal data will be processed, including the purposes of processing, the categories of personal data that will be processed, and the recipients of the data.
  3. Data security: The KVKK requires that data controllers take appropriate measures to protect personal data from unauthorized access, use, or disclosure.
  4. Data subject rights: The KVKK provides individuals with a number of rights, including the right to access their personal data, the right to request that their data be corrected or deleted, and the right to object to the processing of their data.
  5. Cross-border data transfers: The KVKK requires that personal data can only be transferred outside of Turkey if certain conditions are met, such as obtaining the individual’s consent or ensuring that the recipient country has adequate data protection laws in place.

Failure to comply with the KVKK can result in significant fines and legal liabilities for data controllers.

In summary, the Law on the Protection of Personal Data (KVKK) is a comprehensive data protection law that aims to protect the personal data of Turkish citizens. It sets out strict rules on how personal data can be collected, processed, stored, and shared, and failure to comply with these rules can result in significant fines and legal liabilities.

Download this Resource