← Global Privacy Laws Research Library
Personal Data Protection Law No. 6698
Law No. 6698 on the Protection of Personal Data: Turkey
Prepared by Shubhank Suman · Last reviewed
CURRENT: MAJOR 2024 AMENDMENTS
- Legal character
- National statute
- Region
- Europe
- Ratified
- 24 March 2016
- Official Gazette
- 7 April 2016
What it covers
KVKK regulates:
- personal-data processing
- general principles
- special categories
- consent
- transparency
- data-subject rights
- controller registration
- security
- breaches
- international transfers
- regulatory powers
- administrative penalties.
Why it matters
The 2024 amendment fundamentally changed two areas:
1. Article 6: special-category personal data
2. Article 9: international transfers
The Turkish authority confirms these amendments were introduced by Law No. 7499. (KVKK)
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
HIGH
KVKK is not an AI Act.
It is relevant to AI because:
- biometrics are special-category data
- AI profiling may involve personal data
- automated analysis may process special categories
- AI systems may transfer data internationally.
The Turkish authority has separately published biometric-data guidance specifically discussing biometric processing under Article 6. (KVKK)
Cybersecurity
VERY HIGH
Article 12 is the central security provision and the authority has extensive guidance on technical/organisational security.
Current validity
CURRENT: 2024 AMENDED FRAMEWORK.
The pre-2024 version of Articles 6 and 9 is no longer the current text. The authority confirms the 2024 amendment and subsequent transfer regulations/standard contracts. (KVKK)
Read first
Articles 4–6 → Article 9 → Articles 10–12 → Article 18 → 2024 transfer regulation/standard contracts.
Provisions / sections covered
Article 4: General principles
Personal data must be processed according to lawful, fair and transparent principles and for specific purposes.
Article 5: General personal data
Contains conditions for processing ordinary personal data.
Article 6: Special categories
Special-category data includes:
- racial/ethnic origin
- political opinion
- philosophical belief
- religion
- appearance
- association/trade-union membership
- health
- sexual life
- criminal convictions/security measures
- biometric data
- genetic data.
The 2024 amendment changed the processing conditions materially. (KVKK)
Article 9: International transfers
The amended Article 9 now provides a more structured transfer framework based on:
- adequacy decisions
- appropriate safeguards
- standard contractual mechanisms
- other statutory transfer situations.
The Turkish DPA has published standard contracts for:
- controller → controller
- controller → processor
- processor → processor
- processor → controller.
(KVKK)
Article 10: Information obligation
Transparency.
Article 11: Data-subject rights
Access, correction and other statutory rights.
Article 12: Security
Controllers must implement technical and organisational security measures.
Article 18: Administrative sanctions
Provides the administrative enforcement framework.
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Profiling
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Enforcement and penalties
- Transparency
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.