KVKK is Turkey’s Personal Data Protection Law No. 6698, in force since 2016. It governs how information that identifies or can identify a natural person (name, phone, e-mail, IP address, CCTV footage) may be collected, processed, stored and deleted. It is supervised by the Personal Data Protection Authority and its Board.
- Key concepts: personal data, special categories of personal data, data subject, data controller, data processor and explicit consent.
- Processing conditions: explicit consent is only one legal basis; others include legal obligation, contract performance and legitimate interest.
- Obligations: information notices, technical and administrative security measures, answering data subject requests, deletion and anonymisation, registration in VERBİS where required, and breach notification.
KVKK shares many concepts with the GDPR but is not identical; companies serving EU customers may be subject to both. This is general information; confirm current rules with your lawyer. Racurity supports the technical side of compliance such as data inventory, access control, encryption and DLP.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
