Personal Data Protection Law (KVKK), enforcement and compensation

Criminal exposureYes

Private right of actionYes

Criminal exposure note

KVKK Art. 17(1) cross-references Turkish Penal Code (Law No. 5237) Arts. 135 to 140 for crimes involving personal data. Unlawfully recording personal data (Art. 135) carries imprisonment from one to three years, increased by half, up to four and a half years, where the data concerns political, philosophical or religious opinion, racial origin, or, unlawfully, moral tendency, sexual life, health, or trade-union affiliation. Unlawfully giving, disseminating, or obtaining personal data (Art. 136) carries imprisonment from two to four years, the highest base tier of the group. A public official who abuses the authority of office, or a person who exploits a professional facility, in committing one of these offenses faces a further one-half increase (Art. 137). Failing to destroy data after the statutory retention period has expired, contrary to KVKK Art. 7, is separately punished under Art. 138 with imprisonment from one to two years (KVKK Art. 17(2)). Prosecution of the Art. 135, 136, and 138 offenses proceeds without a victim complaint (Art. 139), and a legal person faces security measures for these offenses under Turkish law (Art. 140).

Penalty structure

Art. 18(1) sets five fixed-range administrative-fine tiers: (a) 5,000 to 100,000 TL for failing the Art. 10 notice obligation; (b) 15,000 to 1,000,000 TL for failing the Art. 12 data-security obligations; (c) 25,000 to 1,000,000 TL for noncompliance with a Board decision issued under Art. 15; (ç) 20,000 to 1,000,000 TL for violating the Data Controllers' Registry registration and notification obligations under Art. 16; and (d), added by Law No. 7499 (2 March 2024), 50,000 to 1,000,000 TL for failing the Art. 9(5) cross-border transfer-notification obligation. The 1,000,000 TL ceiling is shared by tiers (b), (c), (ç) and (d). These are the amounts stated in the Act's own text. Kabahatler Kanunu (Misdemeanors Law No. 5326) Art. 17(7) requires fixed-range administrative fines generally to be increased each calendar year by the revaluation rate announced under Tax Procedure Law No. 213's repeated Art. 298, so the amount actually collectible in a given year runs above these statutory base figures; no KVKK announcement stating the currently applicable revalued amounts was reachable through the primary-source channel used for this research, so the figures given are the statutory base figures.

Rule

Fixed only

As of

2 September 2026

Currency

TRY

Fixed cap

1,000,000

Enforcement body

Kisisel Verileri Koruma Kurulu (Personal Data Protection Board)

Enforcement record

KVKK 2025 Yılı Faaliyet Raporu (2025 Annual Activity Report), Table 18: in 2025 the Board imposed Art. 18 administrative fines on 876 data controllers in total (140 for complaint/report matters, 142 for data breach notifications, 594 for Data Controllers' Registry and notification-obligation violations), totalling 352,510,494 TL. The prior year's total was 551,139,817 TL (2024), so the latest year-over-year figure fell, though the five-year series (2021: 31,746,000 TL; 2022: 85,483,000 TL; 2023: 240,912,000 TL) still shows a longer-run rise. Counts KVKK Board-imposed administrative fines only; the report does not separately track private civil compensation claims filed under Art. 11(1).

As of

2 September 2026

Trend

Falling

Currency

TRY

Source link

https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5ZjMxYTVlZGY0Y2Y.pdf

Fines per year

352,510,494

Actions per year

876

Settledness

The Constitutional Court's record of this individual application lists Articles 1, 5, 12, 15 and 18 of Law No. 6698 as the law concerned and records a violation of the principle of legality in crimes and punishments (suçta ve cezada kanunilik) with retrial as the remedy.

As of

20 October 2026

Case link

https://kararlarbilgibankasi.anayasa.gov.tr/BB/2020/32193

Case citation

Viennalife Emeklilik ve Hayat A.Ş. [GK], B. No: 2020/32193, judgment of the Constitutional Court (General Assembly) of 27 January 2026, Official Gazette of 16 June 2026, No. 33282

Open questions

Which tier of Article 18(1) applies to processing without a lawful basis under Article 5 or Article 6, when the tiers name only the notice duty of Article 10, the data-security duties of Article 12, the Board decisions under Article 15, the registry duties of Article 16 and the transfer-notification duty of Article 9(5)?

Logging duty

Article 11(1)(ğ) gives the data subject a right to compensation for unlawful processing, and Article 18 sets administrative fines for breaches of the duty to inform (Article 10), data security (Article 12), the Board's decisions (Article 15), registration and notification under Article 16 and the Article 9(5) notice. The Data Controllers' Registry is kept by the Authority's Presidency on the controller's notification (Article 16(1)), not by the controller, and none of these provisions names a record or log the controller must itself keep, a retention period or an inspector.

Kind

None

As of

28 October 2026