Turkish Personal Data Protection Law
KVKK · Law No. 6698, which governs the processing of personal data in Turkey and places notification and data security obligations on organisations that process it.
- 01
Why it matters
Almost every organisation in Turkey that handles customer, employee or visitor data is subject to KVKK. The law requires you to explain in a privacy notice why and for how long you process data, to take appropriate security measures and to report a breach to the Personal Data Protection Board. Compliance is not just paperwork; it is how data is really handled.
- 02
Example
A clinic collects health information through its appointment form. A privacy notice is shown next to the form, explicit consent is obtained for health data, only the relevant staff can access the data and records are deleted after the set period.
- 03
Common mistake
Copying a ready-made privacy notice from the internet and moving on. If the text does not describe the data you really collect, the purpose and the retention period, it does not make you compliant and will not help after a breach.
- 04
Related terms
Related services and guides
Let's talk about your project.
Tell us what you need; we will define the scope together.