Company Obligations under KVKK: 2025 Update
December 5, 2024
We review companies’ current duties under the Personal Data Protection Law, recent Board decisions and the compliance process.
The Personal Data Protection Law (KVKK) imposes comprehensive duties on every natural and legal person that processes personal data in Turkish law. Recent Board decisions have made those requirements concrete both in substance and in timing.
Core obligations
The main duties companies must meet include preparing a processing inventory and registering with the Data Controllers’ Registry (VERBİS); putting explicit-consent mechanisms into operation; updating privacy notices; and taking technical and organisational security measures.
Recent Board decisions
In 2024 the Board imposed dozens of administrative fines. A substantial share related to inadequate security measures, unlawful transfers of data, and failure to fulfil the information obligation properly.
Compliance steps
Companies should promptly prepare a data inventory, update privacy policies, run staff training and carry out regular compliance audits. A proactive stance both reduces the risk of fines and strengthens customer trust.