Law No. 6698 on the Protection of Personal Data (KVKK)

Overview

Law No. 6698 on the Protection of Personal Data was published in Official Gazette no. 29677 of 7 April 2016. This page rests on the text consolidated with the 2024 amendments made by Law 7499. The law sets data-security duties for controllers and processors, the public Data Controllers Registry and a tiered regime for cross-border transfers. It governs both data centres hosting personal data and SoSo CAD's own SaaS hosting.

Transfers abroad are covered by Article 9. A transfer is allowed where a processing condition exists and an adequacy decision covers the country, sector or organisation; adequacy is reviewed at least every four years. Without adequacy, appropriate safeguards are needed: non-treaty agreements, Board-approved binding corporate rules, Board-published standard contracts, or Board-approved written undertakings. Standard contracts must be notified to the Authority within five working days of signature.

Data security is addressed in Article 12: controllers must take all technical and administrative measures to prevent unlawful processing and access and to safeguard data, and they are jointly responsible with processors. Controllers register in the public Data Controllers Registry before processing, unless exempted by Board criteria. Both provisions make documented measures and clear processor contracts part of the compliance picture.

Article 18 sets administrative fines. Data security failures carry fines of 15,000 to 1,000,000 TL and failure to notify standard contracts 50,000 to 1,000,000 TL; these are the base amounts in the Law text. The text is official legislation, so current amounts and wording should be taken from mevzuat.gov.tr. Related documents include the Regulation on Transfers Abroad, the Personal Data Security Guide, GDPR and ISO/IEC 27001. Together these provisions make security design and contractual arrangements with processors a legal matter, not just a technical choice.

Key points

1. Transfers abroad need a processing condition and an adequacy decision; adequacy is reviewed at least every four years (Article 9(1)-(2)).
2. Without adequacy: appropriate safeguards such as non-treaty agreements, Board-approved BCRs, Board-published standard contracts or Board-approved written undertakings (Article 9(4)).
3. Standard contracts must be notified to the Authority within five working days of signature (Article 9(5)).
4. Controllers must take all technical and administrative measures and are jointly responsible with processors (Article 12(1)-(2)).
5. Controllers register in the public Data Controllers Registry before processing unless exempted (Article 16(1)-(2)).
6. Fines: data security failures 15,000-1,000,000 TL; failure to notify standard contracts 50,000-1,000,000 TL (Article 18(1)(b),(d)).
7. The law was amended in 2024 by Law 7499.

Using it in design

• Product/deployment: offer TR-region or on-prem hosting so Turkish customers avoid Article 9 transfers.
• If any processing or support access is abroad, track a standard-contract notification task.
• In data-centre design, expose a 'personal data hosted' flag that raises physical-security and access-logging defaults.
• Document technical and administrative measures (access control, logging, backup) in contracts with processors.

Who should read it

Data center owners hosting personal data, SaaS providers, legal and compliance teams, and security designers.

Related standards

• KVKK Yurt Dışına Aktarım Yönetmeliği
• Kişisel Veri Güvenliği Rehberi
• GDPR (EU) 2016/679
• ISO/IEC 27001

Publication details

Authors

Türkiye Büyük Millet Meclisi

Publisher

Türkiye Büyük Millet Meclisi

Year

2016

Document number

Kanun No. 6698 (RG 29677, 07.04.2016)

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation