# Regulatory Standards — Turkey KVKK

## Primary Legislation

### Kisisel Verilerin Korunmasi Kanunu (KVKK), Law No. 6698
- Published in the Official Gazette No. 29677, 7 April 2016
- **Article 3**: Definitions — personal data, special category data, data controller, data processor, relevant person
- **Article 4**: General principles — lawfulness, accuracy, purpose limitation, data minimisation, storage limitation
- **Article 5**: Conditions for processing personal data — explicit consent plus seven alternative bases
- **Article 6**: Conditions for processing special category personal data — explicit consent or express legal authorisation
- **Article 7**: Erasure, destruction, or anonymisation of personal data
- **Article 8**: Transfer of personal data within Turkey — requires legal basis under Articles 5 or 6
- **Article 9**: Transfer of personal data abroad — adequate protection or Board-approved safeguards
- **Article 10**: Obligation to inform the data subject at the time of collection
- **Article 11**: Data subject rights — access, rectification, erasure, objection to automated decisions, compensation
- **Article 12**: Data security obligations — technical and organisational measures, breach notification
- **Article 15**: Board complaint procedure — data subject may apply to the Board after exhausting controller process
- **Article 16**: VERBIS — Data Controllers Registry registration obligation
- **Articles 17-18**: Criminal penalties and administrative fines

### KVKK Amendment Law No. 7499 (March 2024)
- Amended Article 9 to introduce new cross-border transfer mechanisms
- Introduced standard contractual clauses as a transfer mechanism
- Authorised the Board to issue adequacy decisions for specific countries
- Established binding corporate rules framework aligned with GDPR
- Transitional period until 1 September 2024 for existing transfers

## Turkish Constitution

- **Article 20** (as amended in 2010): "Everyone has the right to request the protection of his/her personal data. This right includes being informed of, having access to and requesting the correction and deletion of his/her personal data and to be informed whether these are used in consistency with envisaged objectives. Personal data can only be processed in cases envisaged by law or by the person's explicit consent."

## Personal Data Protection Board Decisions and Guidelines

### Board Decision 2019/78 — Explicit Consent Guidelines
- Explicit consent must be freely given, informed, specific to the particular processing, and expressed through a clear affirmative act
- Blanket consent is not valid; consent must be granular per purpose
- Consent must not be a precondition for service provision (freely given requirement)
- Silence or pre-ticked boxes do not constitute explicit consent

### Board Decision 2019/10 — Data Controller and Processor Distinction
- Clarified that the data controller determines the purpose and means of processing
- Data processors must act under the instructions of the data controller
- Written contract between controller and processor is required under Article 12

### Board Decision 2020/915 — Cookie Consent
- Non-essential cookies require prior explicit consent
- Cookie walls (blocking access unless cookies accepted) are not compliant
- Consent must be obtained before cookies are placed on the user's device

### Board Communique on Data Security (2018)
- Specifies minimum technical measures: access control, encryption, logging, vulnerability management
- Specifies minimum organisational measures: policies, training, confidentiality agreements, incident response
- Requires annual security audits and risk assessments

### Board Communique on Breach Notification (2019)
- Data controllers must notify the Board "as soon as possible" and at latest within 72 hours of becoming aware
- Notification must include: nature of breach, categories and number of data subjects, likely consequences, measures taken
- Data subjects must be notified where the breach is likely to result in high risk

## International Framework References

### EU-Turkey Data Protection Relationship
- Turkey does not have an EU adequacy decision under GDPR Article 45
- EU-Turkey data flows require GDPR Chapter V safeguards (SCCs, BCRs, or derogations)
- The 2024 KVKK amendments aim to facilitate future adequacy assessment

### Council of Europe Convention 108+
- Turkey ratified Convention 108 (Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data)
- Turkey signed the modernised Convention 108+ on 10 October 2018
- Convention 108+ alignment supports KVKK interpretation and cross-border cooperation

### ISO/IEC 27001 — Information Security Management
- Board Communique on Data Security references ISO 27001 as a recognised security framework
- ISO 27001 certification is accepted as evidence of adequate technical measures under Article 12