Legislation and standards
A list of the regulations referred to most and what they cover. Always rely on the official source for the current text — the links point there.
This list is a convenience reference, not the legislation itself. We deliberately do not state dates, decision numbers or penalty figures here; check the official source for those.
11 regulations in total
Law on the Protection of Personal Data (No. 6698)
LawNumber: 6698
The basic framework for processing personal data in Türkiye. Definitions, legal grounds, data subject rights, the data security obligation and the application procedure are all in this law.
Official sourceConstitution art. 20 — privacy of private life
LawNumber: 2709
The right to request protection of personal data is a constitutional right. The Law rests on this article.
Official sourceTurkish Penal Code — offences relating to personal data
LawNumber: 5237
Unlawfully recording, disclosing or obtaining personal data, and failing to destroy it, also carry criminal sanctions.
Official sourceRegulation on the Data Controllers' Registry
Regulation
Sets out the scope of the VERBIS registration obligation, its exemptions and the registration procedure.
Official sourceRegulation on Deletion, Destruction or Anonymisation of Personal Data
Regulation
Governs the content of the retention and disposal policy, the periodic disposal obligation and the methods.
Official sourceCommuniqué on Procedures and Principles of Application to the Data Controller
Communiqué
Sets out how a data subject application is made, what it must contain and the response period.
Official sourceCommuniqué on Procedures and Principles for Fulfilling the Duty to Inform
Communiqué
Explains how a privacy notice is prepared and which elements it must carry.
Official sourceGDPR — EU General Data Protection Regulation (2016/679)
International regulation
Can apply from Türkiye to organisations offering goods or services to people in the EU or monitoring their behaviour.
Official sourceISO/IEC 27001 — Information security management system
Standard
The management system standard for managing information security risk. Certifiable.
Official sourceISO/IEC 27701 — Privacy information management system
Standard
An extension that adds the personal data dimension on top of ISO 27001. Built together with 27001, not alone.
Official sourceISO/IEC 42001 — AI management system
Standard
The standard covering governance, risk assessment and monitoring of AI use.
Official source
VERBIS obligation pre-check
Four questions to get an indicative read on whether a VERBIS registration obligation applies to you. Numeric thresholds (such as the balance sheet figure) are updated by Board decisions, so this tool deliberately assumes no amounts.
- Do you have more than 50 employees annually?
- Does your main activity require processing special categories of personal data?
- Are you a public institution or a professional body with public institution status?
- Are you a data controller not established in Türkiye?
This check is for information and is not legal advice. For current thresholds, exemptions and the registration timetable, kvkk.gov.tr is the authoritative source.
Board decisions
We gather the reference details of Board decisions and links to their official texts on a separate page. We do not interpret them or reproduce their text; the list is a snapshot, and the Authority's own page governs the current position.
Board decisions listOur services under these headings
Official sources
For current texts, decisions and announcements, these addresses are the ones to use.
Putting it into practice
Once you have read what the legislation says, the next question is how it gets done.
See where you stand in 20 minutes
The free initial assessment maps your current state and tells you which step should come first. You are not committed to anything afterwards.
Look at it yourself first
A twenty-five question KVKK compliance test with per-area scores and a priority recommendation. No sign-up.
Start the compliance testLet's look together
We discuss your current state and work out which step comes first and how long it takes.
Request a conversation