Personal data protection and KVKK
We help individuals whose data has been misused to apply and complain, and help businesses that process personal data build KVKK compliance step by step.
Turkey's Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK) places obligations on everyone who processes personal data and gives rights to everyone whose data is processed. For a business, non-compliance can mean administrative fines and reputational harm; for an individual, it can mean losing control over their own information.
On the business side, we advise on data inventories, privacy notices (aydınlatma metni) and explicit consent forms (açık rıza), registration with the Data Controllers' Registry (VERBİS), employee and customer data processes, cross-border transfers and breach notifications. The 2024 amendments introduced by Law No. 7499, covering special categories of data, transfers abroad and the notification of standard contracts, are part of every compliance review.
On the individual side, we prepare applications to the data controller and complaints to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) for people whose data has been shared without permission, not deleted on request, or whose application went unanswered. Where appropriate, we also look at a compensation claim and a criminal complaint.
Time limits under KVKK are short. You cannot complain to the Board before applying to the data controller, and the complaint itself must be filed within statutory deadlines, so taking the first step in the right order keeps later options open.
When you may need this
- A company, bank or employer has shared my personal data with third parties without my consent.
- I asked for my data to be deleted, but the data controller did not reply within 30 days or refused.
- My photo, phone number or health information has been circulated without my permission.
- An old news story or record still appears when my name is searched, and I want to use my right to be forgotten.
- We need to know whether our company must register with VERBİS and which documents we should prepare.
- We have had a data breach and do not know how to notify the Board and the people affected.
- We have received an information request or an administrative fine from the Board.
- We transfer data to a service provider abroad (cloud, software, group company) and want a lawful basis for it.
How the process works
- 01
Initial review
We look at what data was processed, by whom, for what purpose and when, together with your documents. For individual cases, we check at the first meeting whether any deadline is already running.
- 02
Application to the data controller
Requests under Article 11 of KVKK (access, correction, deletion, compensation) are sent to the data controller in writing or by another method accepted by the Board. The controller must reply within 30 days at the latest.
- 03
Complaint to the Board
If the application is refused, the answer is inadequate or no answer arrives in time, a complaint can be filed with the Board within 30 days of learning of the reply, and in any case within 60 days of the application. We prepare the complaint with its evidence and follow the procedure.
- 04
Compensation and criminal routes
Where personal rights have been violated, a compensation claim can be brought under general law; unlawfully recording, disclosing or obtaining personal data is also a criminal offence under the Turkish Criminal Code. We decide together which route fits the facts.
- 05
Compliance programme for businesses
We prepare the data inventory, privacy notices and consent forms, retention and destruction policy, VERBİS registration, transfer agreements and a breach response plan. We also handle Board investigations and court actions against administrative fines.
Services in this area
- KVKK compliance analysis and roadmap01
- Data inventory, retention and destruction policy02
- Privacy notices, consent forms and confidentiality texts03
- Assessment of the VERBİS registration obligation and registration04
- Cross-border data transfers and standard contract notification05
- Data breach response and notification to the Board06
- Data subject applications and complaints to the Board07
- Board investigations and actions against administrative fines08
- Compensation claims and criminal complaints for data breaches09
Documents worth bringing
- Screenshots, messages, emails or call records showing the misuse of your data
- A copy of your application to the data controller and proof of the date it was sent (registered email KEP, registered post, email)
- The data controller's reply, or records showing that no reply came
- The contract, membership form, privacy notice or consent form between you and the controller
- If you claim damages, documents showing the harm (medical reports, loss of earnings, expenses)
- For businesses: a list of processing activities, existing KVKK documents, service provider agreements and any VERBİS record
- Any letter, information request or decision received from the Board
How fees and costs are determined
Legal fees are agreed in a written fee agreement between lawyer and client. Under Turkish law the fee cannot be lower than the Minimum Attorney Fee Tariff (Avukatlık Asgari Ücret Tarifesi, AAÜT) published each year by the Union of Turkish Bar Associations, and it is subject to the limits in Article 164 of the Attorneys' Act No. 1136. For compliance projects the fee depends on the scope (number of processes, documents, training); for applications and complaints it depends on the work involved, and we discuss it at the outset.
Applying to the data controller is generally free of charge; if the request involves an additional cost, a fee may be charged according to the Board's tariff. No court fee is payable for a complaint to the Board. A compensation lawsuit involves court fees, service costs and expert fees; the losing party bears these costs and pays the other side's statutory attorney fee set under the AAÜT. An action against an administrative fine before the administrative court also involves fees and costs, which are updated every year.
Frequently asked questions
How and where do I file a KVKK complaint?
You must first apply in writing to the organisation processing your data (the data controller); if you skip this step, the Board will not examine the complaint. If the application is refused, the answer is inadequate or nothing arrives within 30 days, you can complain to the Personal Data Protection Board by petition or through the Authority's online complaint system.
What is the deadline for a KVKK complaint?
The complaint must be filed within 30 days of learning of the controller's reply, and in any case within 60 days of your application (Article 14 KVKK). Missing this deadline can close the Board route, although compensation and criminal options are assessed separately.
How long does the Board take to decide a complaint?
Under the law, if the Board does not respond within 60 days of the complaint, the request is deemed rejected. In practice the examination can take longer; a deemed rejection opens the way to the administrative courts. If the Board finds a violation, it orders the controller to remedy it within 30 days at the latest.
How much is the fine for a KVKK violation?
Article 18 of KVKK sets administrative fines with minimum and maximum amounts for breaches of the duty to inform, data security, Board decisions, VERBİS registration and standard contract notification. These amounts are revalued every year, so the current figures should be checked on the Authority's website. Fines are imposed on the data controller; they are not paid to the individual as compensation.
Within how many hours must a data breach be reported?
The law requires the data controller to notify the people affected and the Board as soon as possible when personal data is obtained by others unlawfully. The Board has decided that this means within 72 hours of becoming aware of the breach. The notification is made using the Board's breach notification form.
Is a personal data breach a crime in Turkey?
Unlawfully recording, disclosing or obtaining personal data, and failing to destroy data when required, are offences under Articles 135–138 of the Turkish Criminal Code, and they are prosecuted without the need for a victim's complaint. Some related offences, such as violating the privacy of private life or of communications, do require a complaint. A complaint to the Board and a criminal complaint to the prosecutor can run in parallel.
Do I need a lawyer for a KVKK application or complaint?
No, you can apply and complain yourself. However, calculating the deadlines, framing the request correctly and considering compensation or criminal routes at the same time all affect the outcome. For businesses in particular, legal support during a Board investigation or a fine reduces risk.
This page is for general information only and does not constitute legal advice. Every legal matter has its own circumstances; please request a meeting for your specific situation.
Share your legal matter.
Send your appointment request and we will get back to you shortly. For urgent matters, please call.