Personal Data Protection Law (KVKK), enforcement and compensation

Criminal exposureYes

Private right of actionYes

Criminal exposure note

KVKK Art. 17(1) cross-references Turkish Penal Code (Law No. 5237) Arts. 135 to 140 for crimes involving personal data. Unlawfully recording personal data (Art. 135) carries imprisonment from one to three years, increased by half, up to four and a half years, where the data concerns political, philosophical or religious opinion, racial origin, or, unlawfully, moral tendency, sexual life, health, or trade-union affiliation. Unlawfully giving, disseminating, or obtaining personal data (Art. 136) carries imprisonment from two to four years, the highest base tier of the group. A public official who abuses the authority of office, or a person who exploits a professional facility, in committing one of these offenses faces a further one-half increase (Art. 137). Failing to destroy data after the statutory retention period has expired, contrary to KVKK Art. 7, is separately punished under Art. 138 with imprisonment from one to two years (KVKK Art. 17(2)). Prosecution of the Art. 135, 136, and 138 offenses proceeds without a victim complaint (Art. 139), and a legal person faces security measures for these offenses under Turkish law (Art. 140).

Penalty structure

Art. 18(1) sets five fixed-range administrative-fine tiers: (a) 5,000 to 100,000 TL for failing the Art. 10 notice obligation; (b) 15,000 to 1,000,000 TL for failing the Art. 12 data-security obligations; (c) 25,000 to 1,000,000 TL for noncompliance with a Board decision issued under Art. 15; (ç) 20,000 to 1,000,000 TL for violating the Data Controllers' Registry registration and notification obligations under Art. 16; and (d), added by Law No. 7499 (2 March 2024), 50,000 to 1,000,000 TL for failing the Art. 9(5) cross-border transfer-notification obligation. fixed_cap records the ceiling shared by tiers (b), (c), (ç) and (d). These are the amounts stated in the Act's own text. Kabahatler Kanunu (Misdemeanors Law No. 5326) Art. 17(7) requires fixed-range administrative fines generally to be increased each calendar year by the revaluation rate announced under Tax Procedure Law No. 213's repeated Art. 298, so the amount actually collectible in a given year runs above these statutory base figures; no KVKK announcement stating the currently applicable revalued amounts was reachable through the primary-source channel used for this research, so the statutory base figures are recorded here.

Rule

Fixed only

As of

2 September 2026

Currency

TRY

Fixed cap

1,000,000

Enforcement body

Kisisel Verileri Koruma Kurulu (Personal Data Protection Board)

Enforcement record

KVKK 2025 Yılı Faaliyet Raporu (2025 Annual Activity Report), Table 18: in 2025 the Board imposed Art. 18 administrative fines on 876 data controllers in total (140 for complaint/report matters, 142 for data breach notifications, 594 for Data Controllers' Registry and notification-obligation violations), totalling 352,510,494 TL. The prior year's total was 551,139,817 TL (2024), so the latest year-over-year figure fell, though the five-year series (2021: 31,746,000 TL; 2022: 85,483,000 TL; 2023: 240,912,000 TL) still shows a longer-run rise. Counts KVKK Board-imposed administrative fines only; the report does not separately track private civil compensation claims filed under Art. 11(1).

As of

2 September 2026

Trend

Falling

Currency

TRY

Source link

https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTY5ZjMxYTVlZGY0Y2Y.pdf

Fines per year

352,510,494

Actions per year

876

Obligation class

Governance