What is personal data protection (KVKK) and what are your rights?
Short answer
KVKK is Türkiye's Law No. 6698, which regulates the lawful processing of personal data. You can apply to the organization holding your data to get information, correction or deletion.
Checklist
- Read the privacy noticeLearn why and how your data is processed.
- Avoid unnecessary consentCheck the scope of the permissions you give.
- Apply in writingState your request and verify your identity clearly.
- Track the deadlinesNote the thirty-day response and complaint periods.
KVKK is the common abbreviation for Law No. 6698 on the Protection of Personal Data in Türkiye. It entered into force in 2016. Its purpose is to protect fundamental rights and freedoms, especially the privacy of private life, when personal data is processed.
What is personal data?
It is any information relating to an identified or identifiable natural person. Examples include name, national ID number, phone, email, address, photo and IP address. Stricter rules apply to "special categories" of data such as health, religion, biometric and genetic data.
Key concepts
- Data subject: The individual whose data is processed, i.e. you.
- Data controller: The person or organization that determines the purposes and means of processing (a company, bank, school, public body, etc.).
- Data processor: A separate natural or legal person that processes data on behalf of the controller.
- Personal Data Protection Authority and Board: The bodies that supervise the Law and decide on complaints.
Principles of data processing
Data must be processed lawfully and fairly, be accurate and up to date where necessary, be collected for specified and legitimate purposes, and be relevant, limited and proportionate to those purposes. It may be kept only as long as needed. Explicit consent is the general rule, but the Law lists cases (such as a legal obligation or performance of a contract) where processing is possible without it.
Your rights (Article 11)
- Learn whether your data is processed and request information
- Learn the purpose of processing and whether it is used accordingly
- Know the third parties to whom it is transferred, in Türkiye or abroad
- Request correction if data is incomplete or inaccurate
- Request deletion or destruction within the conditions set by law
- Request that correction and deletion be notified to third parties who received the data
- Object to an adverse result arising solely from automated analysis
- Claim compensation if you suffered damage due to unlawful processing
How to exercise your rights
- Identify the data controllerFind their contact details in the privacy notice or on their website.
- Submit a written applicationSend it in writing or by registered electronic mail (KEP), secure electronic signature, or another method set by the controller. State your request clearly and verify your identity.
- Wait for the responseThe controller must conclude the request, depending on its nature, within thirty days at the latest.
- Complain to the Board if neededIf the reply is inadequate, no reply is given in time, or the request is rejected, you may complain to the Board within thirty days of learning the reply and in any case within sixty days of your application.
Frequently asked questions
Is explicit consent required for every processing activity?
No. In cases listed in the Law, such as a legal obligation or performance of a contract, data can be processed without consent.
Is there a fee for applying?
As a rule, applications are free; however, if the process requires additional cost, a fee under the Board's tariff may be charged. Check the current position with official sources.
Must I apply to the controller before complaining to the Board?
Yes, as a rule you must first apply to the data controller.
Have a question or spotted a mistake?
Write your question or the error you noticed; our editors will review it. Messages are not published.