Duty LXD-1405
Processes biometric data, in Turkey
Personal Data Protection Law (KVKK), special categories and biometric datasince 1 line
Law No. 6698, Art. 6, as amended by Law No. 7499 () · Read the law's page
- An app that captures or processes biometric data, including a voiceprint or faceprint, from a person in Turkey must treat it as special-category data under KVKK Art. 6 and obtain explicit consent or rely on one of Art. 6(3)'s other statutory grounds before processing, even though the Act does not itself define what counts as biometric data.
Cybersecurity Law, Reporting and Cooperation Dutiessince 4 lines
Law No. 7545 (), Art. 7 · Read the law's page
- This binds any entity that uses information systems to provide services, collect data, or process data within the Cybersecurity Law's own broad scope, with no revenue or user threshold gating this particular duty; a separate, narrower certification and export-approval duty binds only cybersecurity product and service vendors and is not raised here.
- Report a detected vulnerability or cyber incident in the area of service provided to the Cybersecurity Directorate without delay; the Law's own text sets no numeric reporting clock.
- Provide the Cybersecurity Directorate promptly with any data, information, document, hardware, software, or other contribution it requests in connection with its duties.
- Where cybersecurity products, systems, or services are procured for use in a public institution or in critical infrastructure, source them only from a provider the Directorate has certified or authorized.