PrivacyTerrainStructured privacy law intelligence

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Needs a closer pass on transfer derogations, recent amendments, and regulator-driven operational nuance.

Breach

Breach deadline (hours)
0
Breach notification required
Yes

Marketing

Cookie consent rule
Consent-driven cookie practice is shaped by KVKK guidance and related electronic communications rules.

Transfers

Cross-border transfer restricted
Yes
Data localization required
No

Governance

DPO required
No
Impact assessment required
No
Records of processing required
Yes

Identity

Effective date
2016-04-07
Effective status
in-force
Last amended
2024-03-12
Law status
active

Scope

Extraterritorial application
Yes
Private sector coverage
Applies broadly to private-sector controllers processing personal data in or relating to Turkey.
Public sector coverage
Public authorities are covered unless a statutory exemption applies.
Territorial scope
Applies to controllers and processors established in Turkey and foreign actors processing personal data of individuals in Turkey in relevant circumstances.

Legal Basis

Legal bases
consent, statutory exception, contract necessity, legal obligation
Requires legal basis
Yes

Enforcement

Maximum fine
Administrative fines vary by violation category and have increased substantially through revaluation.
Private right of action
Yes

Definitions

Personal data definition
Personal data means any information relating to an identified or identifiable natural person.
Sensitive data recognized
Yes

Rights

Right of access
Yes
Right to appeal
Yes
Right to deletion
Yes
Right to object
Yes
Right to portability
No

Official sources

Recent change workflow