🇹🇷
Turkey
Law on Protection of Personal Data (KVKK)
Europe🟢 Comprehensive
Compliance Score
79%
11 Addressed
3 Partial
0 None
Authority
Personal Data Protection Authority (KVKK)
Overview
Turkey's KVKK, effective 2016, is modeled on GDPR but has its own specificities. The law applies to both public and private sectors and established the KVKK authority which actively enforces compliance.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
AddressedDPO Requirements
AddressedChildren's Data
AddressedPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
AddressedAI & Automated Decisions
PartialData Localisation
AddressedSignificant Data Fiduciary
PartialGovernment Data
Addressed? Frequently Asked Questions
What is the primary data protection law in Turkey?+
Turkey is governed by the Law on Protection of Personal Data (KVKK). The law is enforced by the Personal Data Protection Authority (KVKK). According to our analysis, the country has a Comprehensive level of data protection framework.
Does Turkey require a Data Protection Officer (DPO)?+
Yes, under the Law on Protection of Personal Data (KVKK), organizations are generally required to appoint a Data Protection Officer (DPO) or a similar privacy officer to ensure compliance.
What are the data localisation rules in Turkey?+
Yes, Turkey has strict data localisation requirements. The Law on Protection of Personal Data (KVKK) may require certain types of personal data to be stored within the country's borders.
What are the breach notification requirements in Turkey?+
Under the Law on Protection of Personal Data (KVKK), organizations must notify the Personal Data Protection Authority (KVKK) and affected individuals without undue delay in the event of a personal data breach.