Turkey

KVKK authority conducts investigations, handles complaints, and issues administrative fines.

Explicit consent as primary basis. Other lawful bases available including legitimate interest.

Rights to be informed, access, correction, deletion, objection, and compensation.

KVKK Board must approve adequate countries. Binding undertaking mechanism for other transfers.

Must notify KVKK Board without delay. Board determines whether data subjects must be notified.

Data Controller Registration (VERBIS) required. Contact person must be designated.

Sensitive data provisions apply. No specific age threshold in the law.

Administrative fines from TRY 50K to TRY 3 million. Active enforcement with published decisions.

BRSA banking rules, healthcare data regulations, e-commerce data provisions.

General consent rules apply. Electronic Communications Law addresses cookies.

Right to object to automated decisions under Article 11. National AI Strategy published.

Some sector-specific localisation for financial and health data.

VERBIS registration tiered by size but no SDF equivalent concept.

KVKK applies to government processing with limited exemptions for national security.