CevroTurkey: Personal Data Protection Law 6698 (KVKK) and what it requires
Personal Data Protection Law 6698 (KVKK): an established law with an active enforcement record. Overseen by Personal Data Protection Board (KVKK).
Key requirements at a glance
| Registration with the regulator | Depends on thresholds or circumstances |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Administrative fines under the Law.
What to know in practice
GDPR-influenced and actively enforced since 2016; registration (VERBIS) applies to certain controllers.
How Cevro helps
- Maps Personal Data Protection Law 6698 (KVKK) to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Turkey?
Personal Data Protection Board (KVKK) oversees Personal Data Protection Law 6698 (KVKK).
Is breach notification mandatory under Personal Data Protection Law 6698 (KVKK)?
Our reference does not record a fixed hourly deadline for Personal Data Protection Law 6698 (KVKK). Check the statute and Personal Data Protection Board (KVKK) guidance for the notification timing that applies to you.
Does Turkey restrict cross-border data transfers?
Yes. Moving personal data out of Turkey is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Personal Data Protection Law 6698 (KVKK)?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Turkey?
Administrative fines under the Law.