Law on the Protection of Personal Data No. 6698 (Kisisel Verilerin Korunmasi Kanunu)

KVKK contains no express GDPR-Article-3-style extraterritoriality clause. In practice the Turkish Data Protection Authority (KVKK Board) applies the Law to foreign data controllers that process the personal data of people in Türkiye, and requires such controllers to register in the VERBIS controller registry and appoint a Türkiye-resident representative — so the modeled established/offering/monitoring triggers reflect regulator practice rather than statutory text, and a legal reviewer should confirm the specific basis for any given business. The March 2024 amendments (in force June 1, 2024) were substantial: they replaced the near-consent-only regime for special categories of personal data with a broader set of legal bases, and rebuilt cross-border transfers around adequacy decisions, standard contractual clauses (notifiable to the Board within five business days), binding corporate rules, and narrow derogations — replacing the previous reliance on explicit consent, which was permitted only through a transition period ending September 1, 2024.