KVKK Compliance: Turkish Data Protection Rules for Companies

Turkey’s Law on the Protection of Personal Data, commonly called KVKK, is now a core compliance issue for companies operating in or with Turkey. It affects local employers, e-commerce platforms, SaaS companies, banks, fintechs, hospitals, insurers, retailers, marketing teams, HR departments, and foreign businesses that process Turkish personal data through local operations or service relationships.

This guide is part of the Kurums Law pillar on data privacy law, GDPR, KVKK, CCPA, and cross-border compliance inside the Kurums Law department. It focuses on practical KVKK compliance for companies: what data is covered, which legal bases apply, when explicit consent is needed, how notices should be drafted, what happens with international transfers, and how a business should respond to requests and incidents.

What is KVKK?

KVKK is Turkey’s main data protection statute governing the processing of personal data by data controllers and processors. It establishes core principles, processing conditions, special category data rules, transfer restrictions, data subject rights, security duties, breach notification obligations, and administrative sanctions.

The law is enforced by the Turkish Data Protection Authority, known as the Kisisel Verileri Koruma Kurumu. For business purposes, KVKK should be treated as a governance system. A company must know which data it processes, why it processes it, which condition supports the processing, how it informs individuals, how it controls vendors, how it secures systems, and how it proves compliance.

What personal data is protected under KVKK?

KVKK protects any information relating to an identified or identifiable natural person. This includes ordinary identifiers such as name, phone, email, address, tax number, national ID number, employee records, customer records, IP addresses, location data, and transaction histories.

Special category personal data receives stronger protection. This includes race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance, association membership, foundation membership, trade union membership, health, sexual life, criminal conviction, security measures, and biometric and genetic data. Businesses should separate these categories in their processing inventory because the compliance standard is higher.

What are the KVKK processing principles?

KVKK processing must follow core principles of lawfulness, fairness, accuracy, purpose limitation, relevance, proportionality, and storage limitation. These principles are not decorative. They control how a business designs forms, CRM fields, HR files, customer onboarding, vendor access, analytics, and deletion procedures.

1. Lawfulness and fairness – processing must comply with law and must not surprise or mislead individuals.
2. Accuracy – data should be accurate and up to date where necessary.
3. Specific, explicit, legitimate purposes – purposes must be defined before processing.
4. Relevance and proportionality – data must be connected to the purpose and not excessive.
5. Limited retention – data should not be kept longer than required by purpose or law.

Which legal bases allow processing under KVKK?

KVKK permits personal data processing based on explicit consent or specific statutory exceptions. Companies often overuse consent because it feels simple, but this can be a mistake. If processing is required for a contract, legal obligation, establishment of a right, or legitimate interest, relying on explicit consent may create unnecessary withdrawal risk and poor documentation.

What must a KVKK privacy notice include?

KVKK requires controllers to inform data subjects about key processing details before or during data collection. The notice should identify the controller, purposes of processing, recipients or recipient categories, collection method, legal basis, and data subject rights.

A strong notice is specific to the context. Employee notices, candidate notices, customer notices, website notices, supplier notices, and CCTV notices should not all be identical. Each should reflect the data collected in that channel. The notice should be written in clear Turkish for Turkish data subjects, even if the company also maintains an English version for group compliance.

How do cross-border transfers work under KVKK?

Cross-border transfers are one of the most sensitive parts of KVKK compliance. A transfer may occur when personal data is sent abroad, hosted abroad, accessed abroad, backed up abroad, or made available to a foreign group company, support provider, analytics vendor, CRM system, cloud platform, or HR system.

Companies should map all international access points before drafting transfer documentation. The question is not only where the main database sits. It is also who can view, troubleshoot, export, analyze, or support the data. Many Turkish businesses discover transfer risk through routine tools: cloud email, global payroll, CRM, marketing automation, help desk software, and parent-company reporting.

What is VERBIS registration?

VERBIS is the Turkish Data Controllers Registry Information System, and certain data controllers must register before processing personal data. Registration requires structured disclosure of processing categories, purposes, recipient groups, data subject groups, retention periods, transfer destinations, and security measures.

Not every controller is required to register. Exemptions and thresholds may apply. But even where registration is not required, the discipline of building a VERBIS-style inventory is useful because it forces the company to identify data flows and retention logic. The worst outcome is not simply missing registration; it is being unable to explain processing when the authority, a customer, or a court asks.

How should companies handle data subject requests?

KVKK gives individuals rights to learn whether their data is processed, request information, learn purposes and recipients, request correction, request deletion or destruction where conditions apply, object to certain results, and seek compensation for unlawful processing. Businesses need a repeatable request workflow.

The workflow should define intake channels, identity verification, responsible team, deadline tracking, system searches, legal review, response templates, and evidence logs. A company should not improvise each request. Inconsistent responses create regulatory risk and weaken the company’s position if the data subject complains to the authority.

KVKK compliance checklist

1. Create a personal data processing inventory.
2. Separate ordinary data and special category data.
3. Assign legal basis for each processing activity.
4. Prepare Turkish privacy notices for each collection channel.
5. Use explicit consent only where legally and practically appropriate.
6. Review VERBIS registration status and exemptions.
7. Map cross-border transfers and foreign access.
8. Review processor and vendor contracts.
9. Define retention, deletion, destruction, and anonymization practices.
10. Prepare data subject request and breach response workflows.

How should KVKK compliance be governed internally?

KVKK compliance should have a clear internal owner, but it cannot live only in the legal department. HR controls employee files, marketing controls consent capture and campaign lists, IT controls access and logs, procurement controls vendors, finance controls invoice and tax records, and operations teams often control customer support data. If those teams do not understand their role, the privacy policy will not match reality.

A practical governance model assigns one privacy lead, one data owner per business function, and one escalation route for new processing. Before a new form, vendor, campaign, HR system, mobile app, or analytics tool goes live, the owner should answer four questions: what data is collected, why it is needed, which legal basis supports it, and whether the data leaves Turkey or reaches a new recipient. This lightweight review catches most KVKK issues before they become remediation projects.

The same review should be repeated when systems or vendors change materially.

Frequently Asked Questions