{"id":3021,"date":"2020-04-30T16:22:43","date_gmt":"2020-04-30T13:22:43","guid":{"rendered":"https:\/\/www.endpointprotector.com\/blog\/?p=3021"},"modified":"2023-07-22T06:51:15","modified_gmt":"2023-07-22T03:51:15","slug":"everything-you-need-to-know-about-turkeys-personal-data-protection-law","status":"publish","type":"post","link":"https:\/\/www.endpointprotector.com\/blog\/everything-you-need-to-know-about-turkeys-personal-data-protection-law\/","title":{"rendered":"All You Need to Know About Turkey\u2019s Personal Data Protection Law (KVKK)"},"content":{"rendered":"

Turkey\u2019s Personal Data Protection Law No. 6698 or Ki\u015fisel Verileri Koruma Kanunu<\/a> (KVKK) came into force on 7 April 2016, just weeks before the EU passed its groundbreaking General Data Protection Regulation<\/a> (GDPR). The KVKK is the first law in Turkey that regulates personal data protection and outlines the legal obligations that entities and individuals dealing with personal data must comply with. Before the enactment of the KVKK, Turkey did not have a specific law on the protection of personal data. Data security and protection outside of a few specialized sectors was regulated through a single provision in the Turkish Constitution and several provisions of the Turkish Penal Code.<\/p>\n

The Turkish Data Protection Authority (TDPA) was established as a financially and administratively independent supervisory authority in early 2017. Its role is to enforce the provisions of the KVKK and raise public awareness about personal data protection.<\/p>\n

The KVKK was meant to bring Turkish legislation in line with the EU\u2019s Directive 95\/46\/EC<\/a>, which at the time governed data protection in the European bloc. However, the Directive was repealed in favor of the GDPR shortly after the KVKK in Turkey came into force. Therefore, there are notable differences between the KVKK and GDPR, not only because the Turkish data protection law is based on the GDPR\u2019s predecessor but also because the data protection law of Turkey comes with its own set of unique requirements. Let\u2019s take a closer look!<\/p>\n

Who does the KVKK apply to?<\/h2>\n

The KVKK applies to any data controllers and data processors that collect data or process data collected from Turkey. This includes entities located within Turkey, but also any foreign natural or legal persons that are processing the personal information of Turkish data subjects.<\/p>\n

What data is protected under the KVKK?<\/h2>\n

Personal data is defined as any information relating to an identified or identifiable natural person. Turkey\u2019s data protection legislation also includes stricter provisions for special categories of personal data, such as sensitive personal data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing, membership of associations, foundations, or trade unions, health data, information related to sexual life, previous criminal convictions and security measures, and biometric and genetic data.<\/p>\n

Registration to VERBIS<\/h2>\n

The biggest difference from the GDPR is the obligation data controllers face under the KVKK to enroll onto VERBIS<\/a>, the TDPA\u2019s Data Controllers Registry Information System. VERBIS registration is free and mandatory for all data controllers before they begin processing the data of Turkish residents. Once registered, data controllers are expected to record the data processing activities they engage in.<\/p>\n

To register with VERBIS and start the processing of personal data, organizations need to first appoint a data controller representative who must be a Turkish Legal Entity or a Turkish Natural Person. During registration, they will also be required to submit a Data Processing Inventory that identifies the categories of data subjects, the types of data they process, its purpose, their legal basis, and the technical and administrative measures that an organization is taking to comply with the KVKK.<\/p>\n

Due to the complex nature of the VERBIS registration process, the deadline for it has been pushed back twice already, with the TDPA finally extending it to 30 June 2020 for all controllers, whether Turkish or Foreign. The only exception are Turkish controllers whose main business activity involves processing sensitive personal information and having less than 50 employees and an annual balance sheet of less than TL 25 million (approximately $3.5 million). For them, the deadline is 30 September 2020.<\/p>\n

There are several exemptions to VERBIS registration set out in the second paragraph of Article 28 of the KVKK. These are:<\/p>\n