Data Protection (KVKK) Lawyer in Istanbul, Turkey

This page is for companies in Turkey and for foreign companies that process the data of people in Turkey. As a data protection lawyer in Turkey, we run KVKK gap analyses, draft privacy notices, consent texts and retention policies, handle cross-border transfers, VERBİS and data breaches, and represent clients before the Data Protection Authority and the courts.

Turkey's data protection law is the Personal Data Protection Law No. 6698, known as KVKK. It looks like the GDPR at first glance. The details differ, and those differences are where most compliance gaps sit.

When you need a KVKK compliance lawyer in Turkey

The files we see usually start in one of these situations:

• You are setting up or acquiring a business in Turkey and need employee, customer and supplier data handled lawfully from day one, or you want to know what you are inheriting in a share deal.
• You are a foreign company with Turkish users or customers, such as an e-commerce site, an app or a SaaS provider, and you are unsure whether KVKK reaches you.
• Your group already follows the GDPR and assumes the same documents will work in Turkey. Some will. Several will not.
• You send data abroad, for example to a parent company, a cloud provider or a CRM hosted outside Turkey, and need to bring those transfers in line with the 2024 rules.
• Something has gone wrong: a data breach, a complaint from a customer or employee, or a letter from the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

KVKK has no express territorial clause like Article 3 of the GDPR. In practice, though, the Board treats foreign controllers that process the data of people in Turkey as within its reach, and the registry rules provide for foreign controllers to register through a representative in Turkey.

What KVKK requires from a company

Data controller and data processor

The data controller (veri sorumlusu) decides why and how personal data is processed and carries most of the obligations. A data processor (veri işleyen) processes data on the controller's behalf, such as a payroll provider or a hosting company. Under Article 12, the controller and the processor are jointly liable for taking the data security measures. Your processor contracts should say so.

A legal basis for every processing activity

Article 5 allows processing with explicit consent (açık rıza) or under one of the other listed conditions: processing expressly provided for by law, performance of a contract, a legal obligation of the controller, data made public by the person, the establishment or defence of a right, and the controller's legitimate interest. Explicit consent must be specific, informed and freely given. It is the weakest basis when another one fits, because it can be withdrawn at any time.

Special categories after the 2024 amendments

Law No. 7499, in force since 1 June 2024, rewrote Article 6 on special categories of data (özel nitelikli kişisel veriler), which include health, biometric and genetic data, religion, union membership and criminal records. Before the amendment, many employers could only rely on explicit consent for this data. The new text adds conditions closer to Article 9 of the GDPR, such as legal obligations in employment, occupational health and social security, and processing by persons under a duty of confidentiality for health purposes. The Board's additional security measures for special categories still apply.

Privacy notices and data security

Article 10 requires you to inform people at the time their data is collected: who the controller is, the purposes, to whom data is transferred and why, the method and legal basis of collection, and their rights under Article 11. Article 12 requires appropriate technical and administrative measures. Controllers obliged to register with VERBİS must also keep a personal data retention and destruction policy.

Transferring personal data abroad after the 2024 amendments

The 2024 reform changed Article 9 the most. Explicit consent is no longer the general route for transfers abroad. The structure now works in layers:

1. Adequacy decision: transfer is possible where the Board has issued an adequacy decision (yeterlilik kararı) for the country, sector or international organisation, and one of the Article 5 or Article 6 conditions exists.
2. Appropriate safeguards: without an adequacy decision, you may rely on safeguards such as standard contracts announced by the Board, binding corporate rules approved by the Board, or a written undertaking authorised by the Board.
3. Incidental transfers: with neither of the above, a limited list of exceptions applies only to occasional, non-recurring transfers.

Standard contracts must be used in the form the Board published, and, under Article 9(4), notified to the Authority within five working days of signature. Missing that notification can itself lead to an administrative fine. In practice, most transfers to group companies and foreign service providers currently run on standard contracts, so check which module fits each relationship.

VERBİS registration and the Data Controllers' Registry

VERBİS is the online Data Controllers' Registry kept by the Authority. Registration is not a formality: you declare your processing purposes, data categories, recipient groups, retention periods, transfers abroad and security measures.

The Board has exempted some controllers from registration based on employee numbers, annual balance sheet totals and the nature of their activity. Those thresholds and categories are set by Board decisions and have changed over time, so confirm your position on the Authority's website before deciding you are exempt. A foreign controller registers through a data controller representative (veri sorumlusu temsilcisi) resident in Turkey.

Data breaches, data subject requests and the Board

Under Article 12, a controller must notify the person concerned and the Board as soon as possible when data has been obtained unlawfully. The Board's decision on this sets 72 hours from learning of the breach for notifying the Board, as the rule is generally applied. People affected are to be told within a reasonable time.

Individuals can exercise their Article 11 rights by applying to the controller. Article 13 gives you 30 days at the latest to respond, as a rule free of charge. If the reply is refused, inadequate or late, the person may complain to the Board.

Article 18 sets administrative fines for breaches of the notice, security, registry and transfer notification duties and for failing to comply with Board decisions. The amounts are revalued every year, so check the current figures when assessing exposure. Since the 2024 amendment, Board fines are challenged before the administrative courts, generally within 60 days of notification. Some unlawful processing is also a crime under the Turkish Criminal Code.

KVKK vs GDPR: the differences that matter

A GDPR programme is a good starting point. It still needs Turkish-language notices, VERBİS, Turkish transfer instruments and Turkish retention periods.

Building a KVKK compliance programme step by step

1. Kick-off and scoping: we identify the entities, departments, systems and data flows in scope.
2. Data inventory: interviews and questionnaires with HR, sales, marketing, IT and finance to map each processing activity, its legal basis and its retention period.
3. Gap analysis report: a written list of gaps, ranked by risk, with the fix for each.
4. Documents: privacy notices, consent texts where consent is really needed, a retention and destruction policy, processor agreements and transfer contracts.
5. Registration and notifications: VERBİS entries, and notification of standard contracts to the Authority.
6. Breach and request procedures: an internal procedure for breaches and for data subject requests, with training for the people who will use them.

For a small or mid-sized company with a clear structure, the first five steps usually take around four to ten weeks. A group with several entities and many foreign vendors can take longer. Our KVKK compliance legal checklist covers the same ground in a shorter format.

Documents and information we ask for

• Company documents, organisation chart and the list of group companies.
• Current privacy notices, consent forms, website and cookie texts, and your privacy policy.
• Employment contracts, HR forms and any CCTV, access control or monitoring setup.
• Contracts with service providers that touch personal data, including cloud and IT vendors.
• Where data is stored and which countries it travels to.
• Your IT security policies and any past incidents or complaints.

If you are writing your privacy policy from scratch, our guide on what to include in your company's privacy policy is a useful first read.

What our law firm does

• Assessment: KVKK gap analysis, data inventory and a written risk report.
• Drafting: privacy notices (aydınlatma metinleri), explicit consent texts, retention and destruction policies, processor agreements, data transfer agreements and internal procedures.
• Filing: VERBİS registration and updates, and standard contract notifications to the Authority.
• Breach response: assessment of the incident, the notification to the Board and the message to the people affected.
• Representation: replies to Board inquiries and complaints, and actions against Board decisions and fines before the administrative courts.
• Follow-up: updates when the law, Board decisions or your processing change.

Clients abroad do not need to travel. We work remotely and, where filings or court work need it, by power of attorney signed before a Turkish notary or consulate, or abroad with an apostille. Related work for your company falls under our IT law and commercial law services. To discuss your position, contact our office.

Common KVKK compliance mistakes

• Asking for consent for everything. If processing rests on a contract or a legal obligation, asking for consent as well creates confusion and a problem when consent is withdrawn. Pick the right basis per activity.
• Merging the notice and the consent. The Board expects them to be separate. A single "I have read and accept" box usually fails both.
• Copying GDPR texts. A translated EU notice often misses the Article 10 points or cites GDPR bases that do not exist in KVKK.
• Forgetting the five-day notification. Signing a standard contract and filing it away leaves the transfer exposed.
• No breach plan. In our practice, the most stressful breach files are the ones where nobody knows who decides on notification, and the 72 hours run out while people look for a policy.

For more on corporate exposure, see our articles on data privacy obligations and liabilities for companies, handling data breaches legally and the key points of Turkey's KVKK.

Frequently Asked Questions

Does KVKK apply to a foreign company with no office in Turkey?

It can. KVKK has no express territorial clause, but the Board applies it in practice to foreign controllers that process the data of people in Turkey, for example by selling to Turkish customers online. Registration rules also provide for foreign controllers to register through a representative in Turkey.

Is GDPR compliance enough for KVKK?

Not on its own. It covers much of the substance, but KVKK has its own notice content, the VERBİS registry, Turkish transfer instruments with a notification duty, and no right to data portability. Expect to adapt rather than start from zero.

Do we need explicit consent to send data to our parent company abroad?

Generally no, since the 2024 amendments. Transfers abroad now rely on an adequacy decision or on appropriate safeguards such as the Board's standard contracts, which must be notified to the Authority within five working days. Consent remains only among the narrow exceptions for occasional transfers.

Is every company required to register with VERBİS?

No. The Board has exempted certain controllers based on employee numbers, annual balance sheet totals and activity type. The criteria are set by Board decisions and can change, so check the current decision on the Authority's website.

How quickly must we report a data breach?

KVKK says "as soon as possible". Under the Board's decision, the Board should generally be notified within 72 hours of learning of the breach, and the people affected within a reasonable time afterwards.

How long do we have to answer a data subject request?

Article 13 sets a maximum of 30 days from receipt, and the reply is as a rule free of charge. A refused, incomplete or late reply can lead to a complaint to the Board.

Can a KVKK fine be challenged?

Yes. Since the 2024 amendment, administrative fines imposed by the Board are challenged before the administrative courts, generally within 60 days of notification. The fine amounts under Article 18 are revalued each year.

Do we need a data protection officer in Turkey?

KVKK does not require a GDPR-style DPO. Controllers that register with VERBİS name a contact person, and foreign controllers appoint a data controller representative in Turkey.