KVKK Compliance for Foreign Companies in Türkiye: A Practical Guide

If your company processes the personal data of people located in Türkiye, Türkiye's data protection law can apply to you even if you have no office, server, or staff in the country. That law is the Personal Data Protection Law No. 6698, known by its Turkish initials KVKKKVKKPersonal Data Protection Law No. 6698Türkiye's data protection statute — the rules on collecting, storing and transferring personal data, and the authority that enforces them.Glossary → (Kişisel Verilerin Korunması Kanunu). This guide explains, in plain terms, what KVKK is, how it compares to the EU's GDPR, who it covers, and the headline duties a foreign business needs to plan for, including the important changes made by amending Law No. 7499 in 2024.

What is KVKK, and what does it regulate?

KVKK is the short name for Türkiye's Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu), in force since 2016. It is the country's central law on how personal data may be collected, stored, used, shared, and deleted.

"Personal data" means any information relating to an identified or identifiable real person, for example a name, an ID number, an email address, location data, or an online identifier. "Processing" is read broadly: collecting, recording, storing, changing, sharing, transferring, or deleting data all count.

The law sets out core principles that any processing must respect, such as lawfulness and fairness, accuracy, purpose limitation, data minimisation, and storage only for as long as needed. It also lists the legal bases that make processing lawful, ranging from the explicit consent (açık rıza) of the person to several grounds that do not require consent, such as performance of a contract or compliance with a legal obligation.

How does KVKK compare to the GDPR?

If you already know the EU's General Data Protection Regulation (GDPR), KVKK will feel familiar. It was built on the same European model and shares much of the same logic: a controller/processor split, lawful bases for processing, data subject rights, and an independent regulator. But it is a separate Turkish law, and the details differ.

Some practical differences that foreign teams notice:

• Consent culture. KVKK has historically leaned heavily on explicit consent (açık rıza) as a processing basis, and Turkish practice treats consent strictly. You should not assume a GDPR-style "legitimate interests" analysis maps one-to-one onto KVKK.
• A registry. KVKK operates a public controllers' registry, VERBİS, with which many controllers must register. The GDPR has no equivalent central registry.
• Its own regulator and case law. KVKK is interpreted and enforced by Türkiye's own Authority and Board, whose decisions guide compliance in Türkiye.
• Cross-border transfers. The rules for sending data outside Türkiye are KVKK's own, and they were reformed in 2024 (see below).

Who must comply: data controllers and data processors

KVKK assigns duties based on your role in the data processing. The two key roles are the same concepts you may know from the GDPR.

Data controller (veri sorumlusu)

The data controller is the person or organisation that decides why and how personal data is processed. The controller carries the main legal responsibilities under KVKK, such as informing individuals, securing the data, responding to requests, and, where required, registering with VERBİS.

Data processor (veri işleyen)

The data processor is the person or organisation that processes data on the controller's behalf and on its instructions, for example a cloud host, a payroll provider, or an analytics vendor. Processors have their own security and confidentiality obligations and are typically bound to the controller through a written arrangement.

Getting this classification right matters, because it determines which duties fall on you. Many disputes start with a disagreement over who was really the controller.

Does KVKK reach foreign companies?

Yes, it can. KVKK is not limited to companies that are established in Türkiye. In practice, the Authority and the Board have taken the position that the law can apply where a foreign company processes the personal data of people who are in Türkiye, for example by offering goods or services to them or by monitoring their behaviour.

That means an e-commerce business selling into Türkiye, a SaaS platform with Turkish users, or a foreign employer with staff or contractors in Türkiye may all fall within KVKK's reach without having a registered Turkish entity.

A foreign controller that is within scope may also need to act through a representative in Türkiye and to meet local-facing obligations. Because the way these obligations attach to non-resident companies turns on the specific facts, this is one of the first points to confirm with Turkish counsel.

The regulator and the VERBİS registry

KVKK is supervised by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, the "Kurum"). Inside the Authority, the decision-making body is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, the "Kurul").

The Board is the part you are most likely to encounter. It:

• investigates complaints and acts on its own initiative;
• issues binding decisions and general guidance that shape how the law is applied;
• can order processing to stop or data to be deleted; and
• can impose administrative fines for breaches.

The Board publishes summaries of many of its decisions, which show how abstract principles are applied to real situations, including those involving foreign companies and cross-border data flows.

VERBİS, the controllers' registry

VERBİS (Veri Sorumluları Sicil Bilgi Sistemi) is the Authority's online registry of data controllers. Many controllers must register before they begin processing and must keep their entry up to date, declaring information such as the categories of data they process, their purposes, the recipients, retention periods, and security measures. Not every controller has to register: KVKK and the Board set out exemptions and thresholds, for example based on the number of employees or the nature and scale of the processing, with specific rules for controllers without an establishment in Türkiye.

The headline compliance duties

If KVKK applies to your processing, the core duties of a controller typically include the following. Treat this as an orientation map, not a complete checklist.

• Have a lawful basis. Every processing activity needs a valid legal basis under KVKK, whether explicit consent or one of the consent-free grounds.
• Inform individuals. You must tell people, at the time of collection, who you are, what data you take, why, on what basis, and to whom it may be disclosed (the duty to inform, aydınlatma yükümlülüğü).
• Respect data subject rights. Individuals can ask whether you hold their data, request access and correction, and seek deletion in defined circumstances. You must have a process to receive and answer these requests within the time limit set by the law.
• Keep data secure. You must take appropriate technical and organisational measures to protect data, and the Board has issued guidance on what "appropriate" means in practice.
• Handle breaches. If a data breach occurs, KVKK requires notification to the Authority, and to affected individuals, within the timeframe set by the rules.
• Register with VERBİS where required, and document your processing through inventories and retention/destruction policies.

The 2024 amendment (Law No. 7499) and cross-border transfers

In 2024, KVKK was significantly amended by Law No. 7499. The amendment is important for foreign companies because it touched two of the most sensitive areas of the law.

Special categories of data

KVKK gives extra protection to "special categories" of personal data (özel nitelikli kişisel veriler), such as data on health, religion, ethnicity, biometrics, or trade-union membership. The 2024 amendment revised the conditions under which such data may be processed, broadening the situations beyond reliance on explicit consent alone. If your operations touch sensitive data, the old analysis may no longer be correct.

Transfers outside Türkiye

The amendment also reshaped the rules for sending personal data abroad (yurt dışına aktarım). The reformed regime is built around a layered approach that will look familiar from the GDPR: transfers on the basis of an adequacy decision; in the absence of one, transfers supported by appropriate safeguards (which can include standard contractual clauses, in Turkish standart sözleşme, as well as binding corporate rules and similar instruments); and, in limited situations, specific derogations.

Because these are exactly the areas a typical foreign company depends on, moving data to head office, to a global cloud, or to a parent company, the safest course is to map your data flows and have them assessed under the post-2024 rules.

Practical next steps for a foreign company

If you suspect KVKK may apply to you, a sensible starting sequence is:

• Map your data. Identify what personal data of people in Türkiye you process, why, and where it goes.
• Settle your role. Decide for each activity whether you are a controller or a processor.
• Confirm scope and representation. Get a view on whether KVKK applies and whether you need a representative in Türkiye.
• Check VERBİS. Assess whether you must register, against the current thresholds.
• Re-check transfers and sensitive data under the 2024 regime.
• Build the basics: lawful bases, privacy notices, a request-handling process, security measures, and a breach plan.

KVKK rewards companies that plan early. The rules are detailed, they overlap only partly with the GDPR, and several key points were changed in 2024, so a short, focused review now is usually far cheaper than fixing a problem after a complaint or an audit. Our team can help you assess whether KVKK applies to your operations and what your obligations are under the current law.

Frequently asked questions