Skip to content

Turkey KVKK

Amended Turkey · In force Apr 7, 2016 · no upcoming deadlines

Deadlines

DateWhat happens
Jun 1, 2024Law 7499 amendments take effect2.3 years ago
Sep 1, 2024Old transfer regime ends2.1 years ago

Summaries for reference, not legal advice. Check the official text.

What it does

Turkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).

Who it applies to
All natural and legal persons processing personal data in Turkey; data controllers meeting VERBIS thresholds must register.
Penalties
Administrative fines set in Article 18 and revalued annually (amounts not verified here); under Law 7499, failure to notify standard contracts carries a separate administrative fine.
Enforced by
Personal Data Protection Authority (KVKK) / Personal Data Protection Board
Official name
Law No. 6698 on the Protection of Personal Data (KVKK), as amended by Law No. 7499
Citation
Law No. 6698 (OG 7 April 2016); amended by Law No. 7499 (OG 12 March 2024)
Topics
privacy, data-residency
Verified 2026-09-22 kvkk.gov.tr
Research notes

Dates from recollection cross-checked only against the Official Gazette issue reference; fine amounts omitted because they are revalued each year.

Related

Questions about Turkey KVKK
What are the Turkey KVKK compliance deadlines?
Jun 1, 2024: Law 7499 amendments take effect. Sep 1, 2024: Old transfer regime ends.
When does Turkey KVKK take effect?
Turkey KVKK took effect on Apr 7, 2016.
Who does Turkey KVKK apply to?
All natural and legal persons processing personal data in Turkey; data controllers meeting VERBIS thresholds must register.
What are the penalties under Turkey KVKK?
Administrative fines set in Article 18 and revalued annually (amounts not verified here); under Law 7499, failure to notify standard contracts carries a separate administrative fine.

When the rules change: new data, privacy and AI laws and deadlines, the next morning.