Compliance obligations and practical steps for companies under the Personal Data Protection Law.
The Personal Data Protection Law (KVKK) imposes comprehensive compliance obligations on all data processing organizations in Turkey.
Companies acting as data controllers need to carry out comprehensive work on data inventory preparation, notification obligations, explicit consent mechanisms, and data security measures.
A systematic approach and professional legal support is recommended for effectively managing the KVKK compliance process.
Our expert team is here to help with your legal questions.
Contact UsPersonal data may be processed only where explicit consent or a ground for lawfulness prescribed by law exists. Under Article 5/2-d of the Personal Data Protection Law No. 6698 (KVKK), publicly available data does not give the data controller an unlimited scope of use; the purpose of making the data public and the principle of proportionality are decisive.
Data ProtectionThe Personal Data Protection Board’s (KVK Kurulu) Principle Decision No. 2026/921, published in the Official Gazette dated 02.06.2026, clearly establishes that biometric data should not be used for employee time tracking. For employers, this decision requires a reassessment of KVKK compliance processes concerning attendance monitoring through fingerprint, facial recognition, and similar systems.
Data ProtectionThe Personal Data Protection Board (KVK Kurulu) has turned its individual decisions on violations arising from data controllers preparing privacy notices together with explicit consent texts into a principle decision. This decision shows that the obligation to inform and explicit consent must not be merged into the same text, and that data controllers need to review their compliance processes.