トルコKVKK

The Turkish Data Protection Law (KVKK), officially Law No. 6698 on the Protection of Personal Data, came into force in 2016 to align Turkey’s data protection framework with international standards, particularly the EU’s GDPR. Its primary aim is to safeguard the fundamental rights and freedoms of individuals, especially the right to privacy, by regulating the processing of personal data.

A key obligation under KVKK is the requirement to register with the Data Controllers Registry Information System, known as VERBIS. Most data controllers operating in Turkey—or processing personal data of individuals in Turkey—must register before they begin processing. VERBIS registration includes providing detailed information on data processing activities, including categories of data, legal basis, data transfers, and retention periods. Non-compliance with this requirement may result in administrative fines.

Another core obligation is the appointment of a representative for foreign data controllers without a legal entity in Turkey. This representative acts as the local point of contact for both the Turkish Data Protection Authority and data subjects. The representative must be registered in VERBIS and is responsible for fulfilling certain compliance duties on behalf of the foreign controller.

The KVKK also emphasizes data subject rights, including the right to be informed, to access, to request correction or deletion of personal data, and to object to data processing in certain situations. In the case of data breaches, data controllers must promptly notify the Turkish Data Protection Authority and, if necessary, affected individuals. Failure to report breaches can result in penalties and reputational harm.

Overall, KVKK requires organizations to adopt a proactive, transparent, and accountable approach to data protection.