Personal Data Protection Law (KVKK), comprehensive regime and lawful basis

Law No. 6698 (7 April 2016), as amended by Law No. 7499 (2 March 2024), Arts. 1, 3, 5, 7-8, 10

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 7 April 2016.

A comprehensive regime rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that collects, uses, or discloses the personal data of an individual in Turkey must establish one of KVKK Art. 5's lawful bases, most commonly explicit consent, before processing, and must confine use to the stated purpose of collection.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

KVKK is Turkey's single omnibus personal-data statute, broadly General Data Protection Regulation (GDPR)-modeled, covering both public institutions and private-sector data controllers. Art. 5 sets the lawful bases: explicit consent by default, or one of six alternative grounds (a legal provision, vital-interest necessity, contract necessity, a legal obligation, the data subject's own publication of the data, the controller's legitimate interest, or establishment or exercise of a right).

Controller and processor are defined at Art. 3(g)/(i). Law No. 7499 (2 March 2024) amended the special-categories and cross-border transfer articles without changing this general lawful-basis structure.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

official statute text, KVKK Kurumu (Personal Data Protection Authority) consolidated English translation with inline amendment markers

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app