There is no single KVKK fine. Turkey’s Personal Data Protection Law sets administrative fines with lower and upper limits for specific violations, and these limits are updated every year by the revaluation rate, so figures quoted online quickly become outdated.
- Administrative fines cover failing to inform data subjects, failing to take data security measures, ignoring Board decisions, VERBİS registration breaches and, after recent amendments, failing to notify certain cross-border transfers.
- Criminal liability under the Turkish Penal Code applies to unlawful recording, disclosure or failure to destroy personal data, and is personal.
- Civil liability allows affected individuals to claim damages.
The Board weighs the severity of the breach, special category data, number of people affected, fault, cooperation, repetition and economic situation. Appeals now go to administrative courts. Reduce risk with a data inventory, proper notices, documented security controls, a clear VERBİS status, a breach procedure and staff training. Always confirm current amounts with your lawyer.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
