TurkeyPersonal Data Protection Law (KVKK), comprehensive regime and lawful basis
Law No. 6698 (), as amended by Law No. 7499 (), Arts. 1, 3, 5, 7-8, 10
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Turkey must establish one of KVKK Art. 5's lawful bases, most commonly explicit consent, before processing, and must confine use to the stated purpose of collection.
These lines are LexLint's reading of the law's text. Also read by: Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.kvkk.gov.tr/Icerik/2037/Acik-Riza-Alirken-Dikkat-Edilecek-Hususlar
- Guidance body
- Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye)
- Open questions
- Does Article 5(2)(d), which permits processing where personal data have been made public by the data subject himself/herself, limit the controller to the purpose for which the data subject made them public?
What it makes you log
Logging duty
Articles 1, 3, 5, 7, 8 and 10 set the purpose and definitions, the consent and other conditions for processing, erasure, destruction or anonymization when the reason for processing ends (Article 7), the conditions for transfer, and the controller's duty to inform data subjects when data is obtained (Article 10). None names a record, log or register the controller must keep, a retention period for one, or an inspector; the registry (Article 16) and the controller's audit duty (Article 12(3)) sit in articles this row does not cite.
- Kind
- None
- As of
What this law does
KVKK is Turkey's single omnibus personal-data statute, broadly General Data Protection Regulation (GDPR)-modeled, covering both public institutions and private-sector data controllers. Art. 5 sets the lawful bases: explicit consent by default, or one of six alternative grounds (a legal provision, vital-interest necessity, contract necessity, a legal obligation, the data subject's own publication of the data, the controller's legitimate interest, or establishment or exercise of a right).
Controller and processor are defined at Art. 3(g)/(i). Law No. 7499 () amended the special-categories and cross-border transfer articles without changing this general lawful-basis structure.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .