Title: The Law on the Protection of Personal Data (KVKK) Author: Kriko Published: Mar 4, 2021 Last modified: Jul 13, 2026 --- 1. [Home](https://kriko.io/) / 2. [Glossary](https://kriko.io/glossary) / 3. T Letter # The Law on the Protection of Personal Data **(KVKK)** **The Law on the Protection of Personal [Data](https://kriko.io/services/data-analysis-insight)**, commonly referred to in Turkey as KVKK and regulated under Law No. 6698, is the main legal framework governing the processing of personal [data](https://kriko.io/services/data-analysis-insight) in Turkey. The law was adopted by the Turkish Grand National Assembly on March 24, 2016, and entered into force after being published in the Official Gazette on April 7, 2016. The main purpose of KVKK is to protect the fundamental rights and freedoms of individuals, especially the right to privacy, and to regulate the obligations, procedures and principles that real and legal persons processing personal [data](https://kriko.io/services/data-analysis-insight) must follow. KVKK aims to prevent personal [data](https://kriko.io/services/data-analysis-insight) from being processed in an unlimited, arbitrary or unclear manner. Individuals may share different types of personal [data](https://kriko.io/services/data-analysis-insight) when using social media, opening a bank account, shopping on an e-commerce website, visiting a healthcare institution or using a mobile application. To prevent this [data](https://kriko.io/services/data-analysis-insight) from being used unlawfully, maliciously or outside its intended purpose, [data](https://kriko.io/services/data-analysis-insight) processing activities must be subject to clear rules. KVKK regulates both the rights of individuals and the responsibilities of parties that process personal data. Personal [data](https://kriko.io/services/data-analysis-insight) means any information relating to an identified or identifiable natural person. Name, surname, phone number, email address, address, Turkish identity number, customer number, IP address, location [data](https://kriko.io/services/data-analysis-insight), financial information, transaction history, image records and similar information may be considered personal data. The key point is whether the [data](https://kriko.io/services/data-analysis-insight) can be directly or indirectly linked to a real person. Data belonging to legal entities is not generally considered personal data under KVKK; however, if such data makes a real person identifiable, it may fall within the scope of protection. Some data types are separately protected under KVKK as **special categories of personal data**. These include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. These data types are subject to stricter protection rules because they may create risks of discrimination or rights violations. Therefore, the processing of special categories of personal data requires careful compliance with the conditions and additional security measures set out in the law. The processing of personal data is not based only on explicit consent. Explicit consent is one of the legal grounds under KVKK, but it is not the only one. Other legal grounds may include processing being clearly provided for by law, being necessary for the establishment or performance of a contract, being required to fulfil a legal obligation, data being made public by the data subject, processing being necessary for the establishment, exercise or protection of a right, or processing being necessary for legitimate interests. Therefore, data controllers should first determine the correct legal basis for each processing activity and rely on explicit consent only where necessary. Under KVKK, the **data controller** is the real or legal person that determines the purposes and methods of processing personal data. Data controllers are responsible for ensuring that personal data is processed lawfully, informing data subjects, taking the necessary technical and administrative measures for data security, preparing data processing inventories where required and fulfilling VERBIS obligations in cases specified by the legislation. Responding to data subject requests within the legal period and deleting, destroying or anonymising personal data at the end of the retention period are also among the key obligations. The transfer of personal data is another important area under KVKK. Personal data transfers within Turkey or abroad must comply with the conditions set out in the law. In particular, the 2024 amendments created a clearer framework for international data transfers, including adequacy decisions, appropriate safeguards, standard contractual clauses, binding corporate rules and exceptional transfer cases. Therefore, international data transfers should not be evaluated only through an explicit consent approach, but together with the current legal transfer mechanisms. Data subjects, meaning real persons whose personal data is processed, have various rights under KVKK. These include the right to learn whether their personal data is being processed, request information if it has been processed, learn the purpose of processing and whether the data is being used in accordance with that purpose, request correction of incomplete or inaccurate data, request deletion or destruction under certain conditions and claim compensation if they suffer damage due to unlawful processing. These rights aim to strengthen individuals' control over their own data. In summary, **KVKK** is the fundamental data protection law in Turkey that aims to ensure personal data is processed lawfully, transparently, securely and proportionately. For brands, institutions and all parties that process data, KVKK is not only a legal obligation but also a critical issue for trust management. Proper KVKK compliance cannot be achieved only by preparing explicit consent texts; data inventory, information notices, data security, retention and destruction processes, transfer mechanisms and data subject requests should be managed as a whole. ## Discover it in the dictionary ### Subdomain A subdomain is a web address structure created under a main domain by adding a section before the root domain name. In a domain… ### Ad Blocker An ad blocker is a browser extension or software tool used to block advertisements, pop-ups, tracking scripts or certain distracting visual elements on websites.… ### Algorithm An algorithm is a finite and organised sequence of steps used to solve a defined problem or complete a particular task. Algorithms are widely… ### Influencer Marketing Influencer marketing refers to marketing activities carried out with people who can reach a specific audience on social media, have built trust with their… ### ETL ETL is a data processing method used to collect, organise and transfer data in a structured and systematic manner. In this process, data is… ### Key Performance Indicator A Key Performance Indicator, commonly abbreviated as KPI, is a measurable performance indicator that shows how effectively a business, department, team, project or individual… ### Programmatic Advertising Programmatic advertising is a digital advertising model that enables ad inventory to be purchased through software, data and automation technologies. In traditional media buying,… ### Financial Analytics Financial analytics is an analytical discipline used to evaluate the overall economic and financial performance of an organisation or brand. It involves assessing a… ### Turkish Electronic Commerce Law The Electronic Commerce Law, officially known as Law No. 6563 on the Regulation of Electronic Commerce, is the main law that regulates the fundamental… ## Track the digital heartbeat with Kriko Subscribe to receive curated insights, news, and ideas shaping the digital landscape. By checking this box, you acknowledge and accept our [privacy policy](https://kriko.io/privacy-policy).