KVKK 2026: A Complete Compliance Guide for Your Business

For informational purposes only; this is not legal advice. For specific situations, consult a KVKK specialist or attorney.

TL;DR

• As of 2026, KVKK fines (Turkey's data protection law) for data security violations and failure to comply with Board decisions reach up to 17,092,242 TL; violations of the notification (disclosure) obligation start at 85,437 TL. Precedents such as Yemeksepeti (1.9 million TL) and Amazon (1.2 million TL) show that e-commerce and technology are among the Board's priority areas for enforcement.
• The top 3 steps for every business: (1) build a data inventory and, if required, register with VERBİS (more than 50 employees OR a balance sheet above 100 million TL), (2) place your privacy notice, explicit consent, cookie and privacy policy texts, and the data subject request form correctly on your site, (3) set up an opt-in cookie banner where the "Reject" button is equal to "Accept."
• The 2024 reform changed the game: for cross-border data transfers, explicit consent is now the exception, and standard contracts/adequacy decisions are the rule; standard contracts must be notified to the Authority within 5 business days of signing; and appeals against administrative fines now go to administrative courts rather than criminal judgeships of peace (within 30 days).

Key Findings

2026 Fine Amounts (Current Overview)

The 2026 fine amounts are based on the 25.49% revalorization rate set by General Communiqué No. 585 on the Tax Procedure Law, published in Official Gazette No. 33090 dated November 27, 2025. Under Article 17/7 of the Misdemeanors Law, the increase took effect automatically on January 1, 2026 (no separate Board decision is required).

In addition to these administrative fines, prison sentences under Articles 135-140 of the Turkish Penal Code may also apply to the same act (see the separate section below).

Precedent Board Decisions and Actual Fines

• Yemeksepeti — Decision No. 2021/1324 dated 12/23/2021 (1,900,000 TL): The data of 21,504,083 users (username, address, phone, email, password, IP) was leaked. The Board's decision summary found that the breach "went unnoticed by the data controller for 8 days" and that penetration tests were not performed effectively, and a fine was imposed for violating KVKK Art. 12 (data security).
• Amazon Türkiye — Decision No. 2020/173 dated 02/27/2020 (total 1,200,000 TL): The fine has two components: 1,100,000 TL for violating Art. 12 (data security/cross-border transfer) + 100,000 TL for violating Art. 10 (notification obligation). The decision was based on the transfer of data to the EU and the US and on making explicit consent a condition of service.
• E-commerce platform (seller portal) — Decision No. 2024/1385 dated 08/08/2024 (3,250,000 TL): Cyber attackers gained access to the accounts of 673 sellers by trying email/password combinations obtained from other platforms; the platform's bot traffic prevention measures were inadequate, resulting in an Art. 12 violation. This is one of the most recent high-value e-commerce fines published directly on kvkk.gov.tr.
• Other precedents: A bank (01/12/2023, 2023/67 — 450,000 TL, account information sent to the wrong email address), a retail/store chain (10/07/2021, 2021/1021 — 450,000 TL, leak of 4,792 individuals' data from a data processor), an insurance company (~90,000 TL, employee-caused leak).
• Context (official statistics): According to the KVKK 2024 Activity Information Note, "an administrative fine of 552 million 668 thousand Turkish lira was imposed." For data controllers who failed to meet the VERBİS registration and notification obligation, the Authority's Public Announcement dated 08/01/2024 states that, as of that date, fines totaling 503,935,000 TL had been imposed on approximately 16,350 data controllers.

The 2024 Reform (Law No. 7499)

With the Official Gazette No. 32487 dated March 12, 2024, Articles 6, 9, and 18 of KVKK were amended; the provisions took effect on June 1, 2024 (the previous version of the cross-border transfer rules temporarily remained in effect until September 1, 2024). The reform aims to bring KVKK closer to the EU GDPR. Three main points:

1. Special categories of data (Art. 6): The distinction between health/sex life data and other sensitive data was removed; the grounds for processing without explicit consent were expanded.
2. Cross-border transfers (Art. 9): Explicit consent became the exception; the primary mechanisms are adequacy decisions and appropriate safeguards (standard contracts, binding corporate rules, agreements that are not international treaties, and undertakings). After a standard contract is signed, it must be notified to the Authority within 5 business days.
3. Judicial recourse (Art. 18): Appeals against administrative fines now go to administrative courts instead of criminal judgeships of peace (within 30 days).

KVKK Basics

Key concepts:

• Personal data: Any information relating to an identified or identifiable natural person (name, phone number, email, Turkish national ID number (TCKN), IP address, location, purchase history).
• Data controller: The person who determines the purposes and means of data processing and is responsible for establishing and managing the data filing system (the business itself).
• Data processor: The party that processes data on behalf of the data controller, based on the authority the controller has granted (cloud provider, shipping company, call center, email marketing tool).
• Data subject: The natural person whose data is processed (customer, member, employee, visitor).
• Explicit consent: Approval that relates to a specific matter, is based on being informed, and is given freely. It can be withdrawn and cannot be made a condition of receiving a service.
• Obligation to inform (Art. 10): Before data is collected, or at the latest at the time it is collected, you must inform the data subject of the controller's identity, the purposes of processing, who the data is transferred to, the collection method and legal basis, and the data subject's rights. This is mandatory in every case, regardless of the legal basis.
• Special categories of (sensitive) personal data (Art. 6): Race, ethnic origin, political opinion, philosophical/religious belief, sect, clothing and attire, membership in associations/foundations/unions, health, sexual life, criminal convictions/security measures, and biometric and genetic data.

Core principles (Art. 4): Lawfulness and fairness; accuracy and, where necessary, being kept up to date; processing for specified, explicit, and legitimate purposes; being relevant, limited, and proportionate to those purposes; and retention only for the period required by the relevant legislation or necessary for the purpose for which the data is processed. These principles apply to all data processing activities, whichever legal basis is relied on.

Conditions for processing (Art. 5): The rule is explicit consent. Cases that do not require explicit consent: expressly provided for by law, actual impossibility, the establishment or performance of a contract, the data controller's legal obligation, the data having been made public by the data subject, the establishment, exercise, or protection of a right, and legitimate interest (provided it does not harm fundamental rights and freedoms — a balancing test must be conducted and documented).

VERBİS (Data Controllers' Registry)

Who must register (2026 thresholds):

• Data controllers with more than 50 employees per year, OR
• Data controllers with an annual balance sheet total of more than TL 100 million.
• Those whose main business activity is processing special categories of data — registration is mandatory regardless of size.
• All data controllers based abroad that process the data of individuals in Turkey (including international SaaS providers, e-commerce platforms, and ad networks).
• Public institutions and certain professional groups for which no threshold applies (e.g., lawyers).

The exemption is critical, but it is not a full exemption: Businesses with fewer than 50 employees AND a balance sheet under TL 100 million, whose main activity does not involve special categories of data, are exempt from VERBİS registration — but they must still comply with all other KVKK obligations (informing data subjects, data security, responding to data subject requests within 30 days). The criteria are cumulative: if your balance sheet exceeds TL 100 million, registration is mandatory even if you have only 10 employees.

Consequence of failing to register: In 2026, an administrative fine of TL 341,809 – TL 17,092,242.

Registration process (step by step):

1. Prepare a Personal Data Processing Inventory (data categories, processing purposes, legal bases, retention periods, transfer recipients). This inventory is the foundation of the entire process.
2. Submit the organizational application and appoint a contact person.
3. Enter the categorical notification (data categories, recipient groups, cross-border transfer status, retention periods, technical/administrative measures taken) in VERBİS.
4. Registration is completed; any changes must be updated within 30 days.

Explicit Consent Map for E-Commerce Sites

The two most common mistakes in e-commerce: asking for explicit consent for everything, or never asking for it at all. The right approach is to identify the correct legal basis for each process. Explicit consent should come into play only when none of the other legal bases can be relied upon.

KVKK explicit consent vs. ETK/İYS approval: These are two separate obligations. Turkey's data protection law (KVKK) protects personal data; the ETK (Law No. 6563 on the Regulation of Electronic Commerce) governs permission for commercial communications. For commercial SMS/email, you need both KVKK explicit consent AND an APPROVAL recorded in the Message Management System (İYS). Informational messages (order status, OTP codes, appointments) are not considered commercial messages and do not require separate İYS approval.

Sharing data with shipping carriers: The shipping carrier is a data processor; sharing name/address/phone to deliver an order falls under "performance of a contract" and does not require explicit consent. However, you should have a confidentiality/data processing agreement with the carrier, and the transfer should be stated in your privacy notice.

Marketplaces (Trendyol, Hepsiburada): Control of marketplace customer data rests with the platform; the seller is shown only as much customer information (name, address, phone) as is needed to fulfill the order. Using this data to advertise your own site or send spam SMS is both a KVKK violation and a breach of platform rules, and grounds for penalties.

Cookie Management

According to the KVKK Guide on Cookie Practices, explicit consent is not required if a cookie meets at least one of two exemption criteria:

• Criterion A: The cookie's sole purpose is to carry out the transmission of a communication over an electronic communications network.
• Criterion B: The cookie is "strictly necessary" to provide a service the user has explicitly requested (viewing the cart, session, login).

If a cookie meets neither criterion, prior explicit consent is mandatory. Important note: Under the Guide, analytics tools such as standard Google Analytics are not considered "strictly necessary" and cannot benefit from the exemption.

What a compliant banner looks like:

• Consent must be given through an active action — simply visiting the site or closing the banner does not count as consent.
• "Accept," "Reject," and "Preferences" options must be presented equally.
• Pre-ticked boxes are prohibited.
• Cookie walls are prohibited — blocking site access until consent is given means consent is no longer freely given.
• Advertising/analytics cookies must not load before consent is given.
• Withdrawing consent must be as easy as giving it; consent records should be kept for an appropriate period.

The cross-border transfer dimension (Art. 9): Google Analytics, Meta Pixel, and Google Ads cookies transfer data to servers abroad — this requires both cookie explicit consent and a legal basis for cross-border transfer. Practical solutions: use a consent management platform (CMP) (sites built with ComSuite come with a Google Consent Mode v2-compatible cookie consent banner out of the box), clearly disclose cross-border transfers in your cookie policy, and where possible consider IP anonymization and server-side solutions.

Required Legal Texts for Websites

• Privacy notice (aydınlatma metni): A mandatory disclosure under Article 10 of KVKK (Turkey's data protection law). It must be shown before any data is collected (below the form) and be accessible in the footer. It must be specific to the context — a generic privacy policy cannot replace it.
• Explicit consent text: Kept SEPARATE from the privacy notice, with its own checkbox, and only for processes that truly require consent (marketing, profiling, transfers abroad without safeguards). It cannot be pre-checked, and consent obtained without a prior privacy notice is invalid.
• Cookie policy: Lists every cookie in use, its duration, whether it is first-party or third-party, and its purpose.
• Privacy policy: A broad framework document describing your overall approach to data protection, security measures, and relationships with third parties.
• KVKK application form: Lets data subjects exercise their Article 11 rights (information requests, correction, deletion, objection, objection to automated decisions). It must be accessible in the footer. Applications are answered free of charge within 30 days.

Common mistakes: Posting a single "Privacy Policy" and assuming every obligation is met; burying the privacy notice inside the membership agreement; merging the privacy notice and explicit consent into one text; using a generic text copied from the internet without adapting it to your actual data processes.

Data Security Measures

The Authority's Personal Data Security Guide groups the expected measures under two headings:

• Technical measures: authorization matrix and access control, encryption, up-to-date antivirus/firewall, log records, regular backups, penetration testing, data loss/leak prevention (DLP), network and infrastructure security, physical environment security.
• Administrative measures: identifying risks and threats, employee training and awareness, confidentiality/data processing agreements with data processors, a personal data processing inventory, periodic internal audits, a retention and destruction policy.

The 72-hour data breach rule: Under KVKK Article 12/5 and the Board's decision no. 2019/10 dated 01/24/2019, the Board must be notified within 72 hours at the latest after the breach is discovered, using the "Data Breach Notification Form" on kvkk.gov.tr. If the breach poses a high risk, the affected individuals must also be notified within a reasonable time. The notification covers the nature of the breach, how it was discovered, the number of people affected and the data categories involved, and the measures taken.

AI and KVKK

The Authority has set out its approach in its "Recommendations on the Protection of Personal Data in the Field of Artificial Intelligence" and its "Guide on Generative AI and the Protection of Personal Data." Key principles include:

• Human-centered approach and meaningful human intervention: Under KVKK Article 11, individuals can object to an outcome that works against them when it results solely from automated analysis of their data. Decisions with legal or significant effects, such as loan rejections or recruitment screening, cannot be fully automated.
• Data minimization, anonymization, and data protection by design: First assess whether the same result can be achieved without processing personal data.
• Chatbots and customer data: The distinction between "the bot answers" and "the bot makes binding decisions" is decisive; systems that produce binding outcomes must provide an objection mechanism and human review.

Prison Sentences Under the Turkish Penal Code (TCK)

Independently of administrative fines, the same act may constitute a crime under the TCK:

• TCK 135 (recording of personal data): 1–3 years in prison; if the data is of a special category, the sentence is increased by half (1.5–4.5 years).
• TCK 136 (unlawfully giving, disseminating, or obtaining data): 2–4 years in prison; increased in certain cases. It does not require a complaint to be prosecuted.
• Example: An employee who copies a customer list (Art. 135) and sells it to a competitor (Art. 136) commits a continuing chain of offenses.

Phased Compliance Roadmap (Checklist)

Phase 1 — Assessment (Weeks 1–2):

1. Build a personal data processing inventory: which data, for what purpose, on what legal basis, how long it is retained, and who it is shared with.
2. Check the VERBİS threshold (more than 50 employees / balance sheet over 100 Million TL). If you are in scope, open your registration and appoint a contact person.
3. List the tools that transfer data abroad (Google, Meta, cloud, email marketing, payments).

Phase 2 — Texts and Website (Weeks 3–4): 4. Add these links to the footer: Privacy Policy, KVKK Privacy Notice, Cookie Policy, KVKK Application Form. 5. Place a link to the privacy notice below the membership/order form; add a separate, unchecked-by-default explicit consent box for marketing only. 6. Register commercial message permissions in İYS; keep KVKK and İYS consents separate.

Phase 3 — Cookies and Security (Weeks 5–6): 7. Set up an opt-in-based CMP (consent management platform) with equal "Accept"/"Reject"/"Preferences" buttons. Block advertising/analytics cookies before consent. ComSuite sites come with this banner and consent logging ready to go; you can turn it on and off from the dashboard. 8. Implement technical measures: authorization matrix, encryption, backups, logs, penetration testing. 9. Prepare a data breach response plan and a 72-hour notification procedure; create a written retention and destruction policy.

The 12 Most Common Mistakes and How to Fix Them

1. Pre-checked consent box → leave it blank and require active opt-in.
2. Burying the privacy notice in the membership agreement → use a separate, accessible text.
3. Collecting explicit consent for everything → build the correct legal basis map.
4. Cookie wall / single "Accept" button → add an equal "Reject" option.
5. Loading cookies before consent → block them with a CMP.
6. Using a general privacy policy instead of a privacy notice → write a context-specific notice.
7. Skipping VERBİS because you "assume you're exempt" → always check the balance sheet threshold.
8. Sending unsolicited SMS to marketplace customers → use the data only for the order.
9. Confusing KVKK explicit consent with İYS approval → collect and record the two separately.
10. Ignoring transfers abroad → put safeguards in place + file the notification within 5 business days.
11. Reporting a data breach late → keep the 72-hour procedure ready.
12. Not having an application form / missing the 30-day deadline → add the form to the footer and track the process.