Processes personal data, in Turkey

Law No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Turkey must establish one of KVKK Art. 5's lawful bases, most commonly explicit consent, before processing, and must confine use to the stated purpose of collection.

Law No. 6698, Art. 12(5) · Read the law's page

• An app that suffers unlawful acquisition of personal data belonging to a person in Turkey must notify the affected data subject and the Board within the shortest time; Board Decision 2019/10 of 24 January 2019 reads that as notice to the Board without delay and at the latest within 72 hours of learning of the breach, and notice to each affected data subject within the shortest reasonable time after the data subject is identified.

Law No. 6698, Art. 11(1)(a)-(f) and (ğ) · Read the law's page

• An app must give a person in Turkey a way to learn whether their personal data is processed, access information about that processing, and request correction or erasure.

Law No. 6698, Arts. 11(1)(ğ), 18 · Read the law's page

• An app processing the personal data of a person in Turkey must be prepared to answer to the KVKK Board for its lawful basis and safeguards, facing tiered administrative fines for a violation, and an individual harmed by unlawful processing may claim compensation in court, but only on proof of the damage suffered.

Regulation on Erasure, Destruction or Anonymization of Personal Data (Resmî Gazete 28 October 2017, No. 30224), Arts. 5, 7, 11 and 12 · Read the law's page

• An app that processes personal data of a person in Turkey must erase, destroy or anonymize the data, on its own initiative or at the person's request, once all the conditions for processing under Articles 5 and 6 of Law No. 6698 have ceased.

Regulation on the Data Controllers Registry (Resmî Gazete 30 December 2017, No. 30286), Arts. 5, 16 and 17 · Read the law's page

• An app that is a data controller must register in Turkey's Data Controllers Registry before it starts processing personal data.

Communiqué on the Procedures and Principles of Applying to the Data Controller (Resmî Gazete 10 March 2018, No. 30356), Arts. 4 to 7 · Read the law's page

• An app that is a data controller must conclude a person's request under Article 11 of Law No. 6698 as soon as possible and within thirty days at the latest, free of charge as the rule.

Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation (Resmî Gazete 10 March 2018, No. 30356), Arts. 4 to 6 · Read the law's page

• An app that collects personal data of a person in Turkey must tell the person, when it collects the data, who the controller is (and its representative, if any), why the data is processed, to whom and why it may be transferred, how and on what legal basis it is collected, and the person's other rights under Article 11 of Law No. 6698.

Regulation on Personal Health Data (Resmî Gazete 21 June 2019, No. 30808), Arts. 2, 5, 6 and 11 · Read the law's page

• A health service provider must let its staff reach a person's health data only as far as the health service to be given requires.

Law No. 6698, Art. 9, as amended by Law No. 7499 (2 March 2024), Provisional Art. 3 · Read the law's page

• An app transferring the personal data of a person in Turkey to a recipient outside Turkey must rely on a Board adequacy decision for the destination, or, absent one, on Board-approved binding corporate rules, a Board-published standard contract notified to the Authority within 5 business days of signature, a Board-approved written commitment, or an applicable international convention.

Regulation on the Procedures and Principles of Transferring Personal Data Abroad (Resmî Gazete 10 July 2024, No. 32598), Arts. 5, 6, 12 and 14 · Read the law's page

• An app that relies on the Board's standard contract to transfer personal data of a person in Turkey abroad must notify the signed contract to the Authority within five business days after all signatures are complete.

Law No. 7545 (12 March 2025), Art. 7 · Read the law's page

• This binds any entity that uses information systems to provide services, collect data, or process data within the Cybersecurity Law's own broad scope, with no revenue or user threshold gating this particular duty; a separate, narrower certification and export-approval duty binds only cybersecurity product and service vendors and is not raised here.
• Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.
• Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.
• Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.