Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Turkey KVKK

Amended Turkey · In force Apr 7, 2016 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Transition endsSep 1, 2024 · 2.2 years ago · Source
Old transfer regime endsTransitional period ends in which the former Article 9 explicit-consent transfer basis could still be relied on.
Takes effectJun 1, 2024 · 2.4 years ago · Source
Law 7499 amendments take effectNew sensitive data and cross-border transfer rules (Arts. 6 and 9) apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Turkey's general data protection law. The 2024 amendments reworked sensitive-data processing and replaced the consent-first cross-border transfer rule with a GDPR-style tiered regime (adequacy, appropriate safeguards such as standard contracts that must be notified to the Authority within 5 business days, then limited derogations).

Who it applies to
All natural and legal persons processing personal data in Turkey; data controllers meeting VERBIS thresholds must register.
Penalties
Administrative fines set in Article 18 and revalued annually (amounts not verified here); under Law 7499, failure to notify standard contracts carries a separate administrative fine.
Enforced by
Personal Data Protection Authority (KVKK) / Personal Data Protection Board
Official name
Law No. 6698 on the Protection of Personal Data (KVKK), as amended by Law No. 7499
Citation
Law No. 6698 (OG 7 April 2016); amended by Law No. 7499 (OG 12 March 2024)
Topics
Privacy, Data residency
Verified 2026-09-22 kvkk.gov.tr
Research notes

Dates from recollection cross-checked only against the Official Gazette issue reference; fine amounts omitted because they are revalued each year.

Related

In forceUnited Kingdom
Data (Use and Access) ActAmends the UK GDPR, DPA 2018 and PECR (recognised legitimate interests, relaxed automated decision-making rules, reasonable-and-proportionate DSAR searches, new transfer test, cookie exemptions, PECR fines raised to UK GDPR levels), creates Smart Data schemes and digital verification services, and replaces the ICO with an Information Commission. Commenced in stages from August 2025 to 2026.In effect since Aug 20, 2025
In forceSwitzerland
Swiss revised FADP (nFADP)Switzerland's modernised data protection law, closely aligned to GDPR: privacy by design/default, records of processing, DPIAs, breach notification to the FDPIC as soon as possible, and cross-border transfer rules. Protects only natural persons' data.In effect since Sep 1, 2023
AmendedUnited Kingdom
UK Data Protection Act 2018Core UK data protection statute that sits alongside the UK GDPR. It sets exemptions and conditions for special category and criminal offence data, the law enforcement and intelligence services regimes, and the regulator's powers and fines. It has been substantially amended by the Data (Use and Access) Act 2025.In effect since May 25, 2018
AmendedUnited Kingdom
UK GDPRThe UK's core data protection regime: lawful bases, transparency, data subject rights, security, breach notification within 72 hours, and international transfer rules. Retained EU GDPR became the UK GDPR from 1 January 2021 and was materially amended by the Data (Use and Access) Act 2025 from 5 February 2026.In effect since May 25, 2018
EnactedUnited Kingdom
UK Investigatory Powers (Amendment) Act 2024Amends the Investigatory Powers Act 2016. It creates a lighter regime for intelligence agencies to hold bulk personal datasets with low or no expectation of privacy, widens communications data rules, and bars telecoms operators from making relevant changes to their services that would weaken lawful access capabilities while a retention notice is under review.No date set
Questions about Turkey KVKK
What are the Turkey KVKK compliance deadlines?
Jun 1, 2024: Law 7499 amendments take effect. Sep 1, 2024: Old transfer regime ends.
When does Turkey KVKK take effect?
Turkey KVKK took effect on Apr 7, 2016.
Who does Turkey KVKK apply to?
All natural and legal persons processing personal data in Turkey; data controllers meeting VERBIS thresholds must register.
What are the penalties under Turkey KVKK?
Administrative fines set in Article 18 and revalued annually (amounts not verified here); under Law 7499, failure to notify standard contracts carries a separate administrative fine.