Turkey Privacy & Data Protection Laws

KVKK contains no express GDPR-Article-3-style extraterritoriality clause. In practice the Turkish Data Protection Authority (KVKK Board) applies the Law to foreign data controllers that process the personal data of people in Türkiye, and requires such controllers to register in the VERBIS controller registry and appoint a Türkiye-resident representative — so the modeled established/offering/monitoring triggers reflect regulator practice rather than statutory text, and a legal reviewer should confirm the specific basis for any given business. The March 2024 amendments (in force June 1, 2024) were substantial: they replaced the near-consent-only regime for special categories of personal data with a broader set of legal bases, and rebuilt cross-border transfers around adequacy decisions, standard contractual clauses (notifiable to the Board within five business days), binding corporate rules, and narrow derogations — replacing the previous reliance on explicit consent, which was permitted only through a transition period ending September 1, 2024.

Art. 12(5) of the Law itself says only that a breach must be reported to the data subject and the Board 'in the shortest time' — no number. The operative deadline comes from Board Decision No. 2019/10, in which the Board fixed that as no later than 72 hours from becoming aware, with reasons required if that is missed. Read the two together: the citation a Turkish regulator will enforce against is the statute, but the timeline is regulator interpretation, and a reviewer should check whether later Board decisions have refined it. Foreign data controllers caught by the Board's practice of applying KVKK to processing of data about people in Turkiye owe this duty too, alongside the VERBIS registration and local-representative requirements described in the comprehensive-law entry.