Turkey KVKK and the GDPR

Turkey's Kişisel Verileri Koruma Kanunu (KVKK) (also known as the "Data Protection Law") is a relatively strong data protection law with similarities to the EU's General Data Protection Regulation (GDPR).

Passed in 2016, Turkey's KVKK more closely resembles the GDPR's predecessor, the Data Protection Directive, but contains some unique provisions not found in the EU GDPR (which applies across the entire European Economic Area, with an equivalent law in the UK).

This article will compare how these two laws apply across eight areas: Application, definitions, principles, transparency obligations, lawfulness, rights, "special category data," and enforcement.

How Turkey KVKK and GDPR Laws Apply

Who is covered by each law? Here's Article 2 of the KVKK, which sets out the Turkish law's scope:

The GDPR's scope is set out across its own Article 2 ("material scope," meaning the types of activities covered by the law) and Article 3 ("territorial scope," meaning the location of organizations covered by the law).

Here's a table explaining how each law applies.

Article 28 of the KVKK also provides some circumstances where the law doesn't apply, including domestic activities, national security, and judicial proceedings. The GDPR allows for a similar range of exceptions.

Key Definitions and Concepts in Turkey KVKK vs GDPR

Turkey and all EU countries have signed the Council of Europe's Convention 108+ treaty, which clearly influences both laws. As such, both laws use similar language.

The following definitions come from Article 3 of the KVKK, and each has roughly the same meaning in the GDPR.

• Personal data: Any information relating to an identified or identifiable natural person
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system
• Data processor: The natural or legal person who processes personal data on behalf of the data controller upon its authorization
• Data subject: The natural person (living individual) whose personal data are processed

Principles of Data Processing in Turkey KVKK vs GDPR

Both the KVKK and the GDPR provide a set of principles that must be applied whenever you process personal data.

Here's the relevant section of Turkey's KVKK:

And here's the relevant part of the GDPR:

Here's a table setting out each law's principles:

The GDPR provides two further principles that are not included in the KVKK:

• Integrity and confidentiality. This GDPR principle requires organizations to keep personal data secure. The KVKK dedicates Article 12 to security.
• Accountability. Data controllers must be able to demonstrate their compliance with the principles. This principle is implicit in the KVKK.

Your Privacy Policy for Turkey KVKK vs GDPR

Both the KVKK and the GDPR include transparency requirements. One of the ways to meet these requirements is by publishing a Privacy Policy (or "Privacy Notice").

To comply with either law, you should publish your Privacy Policy on your website, within your app (if you have one), and provide links to your Privacy Policy whenever you collect personal data.

Include a link to your Privacy Policy in your site's footer, like so:

For mobile apps, link your Privacy Policy to a "Settings" or "About" type of menu within the app itself, as seen here:

To comply with the requirement to display your Privacy Policy wherever you collect personal data, add a link to the following places (and similar types of places) on your site:

• Contact forms where users submit an email address and a message to you
• Account registration forms where users sign up for a personal account
• Checkout pages where shoppers finalize an order and send you financial information and a mailing address

See our feature article for more information: Where Should I Place My Privacy Policy?

Article 10 of the KVKK sets out the law's transparency requirements, known as "the obligation of the data controller to inform." Controllers must provide the following information to data subjects via a Privacy Policy:

• The identity of the data controller and of its representative, if any
• The purpose of processing personal data
• Any other organizations to whom the personal data may be transferred, and the purposes for any such transfer
• The method and legal basis of collection of personal data
• An explanation of the KVKK's data subject rights (we'll explore these rights below)

You must provide the above information to data subjects "at the time when personal data are obtained" (whether directly from the data subject or indirectly from a third party).

Here's how you can disclose the data controller and contact details:

Always disclose your purpose for collecting data and ensure it's accurate and up to date. Here's how you can inform users what your legal basis is, such as "legitimate interests" as seen in the example clause below. Let them know why you process personal data that you collect:

Be transparent about your data sharing and disclosing practices in a clause like this:

Disclose user rights and make sure users understand they have the ability to exercise them, as seen here:

The GDPR's transparency obligations are set out at Article 12 (which describes how to provide the information), Article 13 (for when you collect personal data directly from the data subject), and Article 14 (for when you obtain personal data indirectly).

Here's a summary of the information you'll need in your GDPR Privacy Policy, covering both Articles 13 and 14.

• The controller's identity and contact information, including for its EU representative and data protection officer (DPO) (if relevant)
• The types of personal data you process
• Your purposes for processing personal data
• Your legal bases for processing personal data, including an explanation of your legitimate interests, if relevant
• Your storage periods for different types of personal data
• Which other parties you share personal data with (their specific identities, or, if necessary what types of organizations they are)
• Your sources of personal data
• If you transfer personal data outside of the EU, the international data transfer safeguards you rely on for these transfers
• An explanation of the GDPR's data subject rights, including any relevant automated decision-making activities
• Contact details for the relevant data protection authority (DPA) if people wish to make a complaint

Note that the screenshot examples in the previous section will apply here as well, and demonstrate information that should be included in all Privacy Policies.

A Valid Legal Basis under Turkey KVKK vs GDPR

Both the GDPR and KVKK require controllers to have a legal justification for processing personal data, known as a "legal basis" (or lawful basis) under the GDPR and a "condition for processing" under the KVKK.

Here's Article 5 of the KVKK, which sets out the law's conditions for processing:

And here's the equivalent at Article 6 (1) of the GDPR:

Here's how these provisions compare:

Facilitating Data Protection Rights under Turkey KVKK vs GDPR

Both the KVKK and the GDPR provide data subjects with certain rights over their personal data.

Here's how the KVKK's rights look in Article 11 (1):

The GDPR dedicates an entire chapter (Chapter 3) to data subject rights, comprising 11 articles across five sections.

Here's a comparison of some of the key rights under each law:

As noted, the KVKK does not provide a right to data portability. The law also lacks other rights found under the GDPR, such as a broad "right to object" to certain processing activities and the "right to restrict" data processing.

Controllers may not normally charge a fee for facilitating a data subject rights request under either law, and the initial deadline for carrying out a request is similar under both laws (30 days under the KVKK, one month under the GDPR).

Correctly Handle Special Category Data under Turkey KVKK vs GDPR

Both the KVKK and the GDPR treat certain types of information as "special category data." Under both laws, there are stricter rules for processing special category data.

Article 6 (1) of the KVKK treats personal data that reveals the following information as "special category data:"

• Race
• Ethnic origin
• Political opinions
• Philosophical beliefs
• Religion
• Religious sect or other beliefs
• Appearance
• Memberships of associations, foundations, or trade unions
• Health
• Sexual life
• Criminal convictions and security measures
• Genetic and biometric data

The GDPR provides a similar list of types of "special category data" under Article 9 (1), except that the EU law:

• Does not explicitly include "religious sect or other belief" or "appearance" as "special category data." However, these types of information might be deemed special category data if they reveal information about a person's religion or race.
• Does not include "criminal conviction data" in its list of special category data. However, criminal conviction data is subject to special rules under Article 10 of the GDPR.
• Only treats genetic or biometric data as special category data if it is processed for the purpose of uniquely identifying an individual.

Whereas the GDPR provides ten legal bases for processing special category data, the KVKK requires controllers to obtain explicit consent before doing so. The exceptions are "health and sexual life" data, which may be processed by medical professionals without consent.

Explicit consent involves getting users to take a notable action to prove they consent to something, such as by checking a box next to an "I Agree" or "I Consent" statement, like so:

How are Turkey KVKK vs GDPR Laws Enforced

Both the KVKK and the GDPR are enforced by data protection authorities (DPAs) and via legal claims by data subjects.

KVKK enforcement is down to the Turkish DPA, the Kişisel Verileri Koruma Kurumu (which, like the law, is also initialized as "KVKK"), whereas each EU member state has at least one national DPA to enforce the GDPR.

Maximum fines under the KVKK can range from TKY 5,000 to 1 million (USD 186 to 37,300), while the GDPR's penalties can reach up to EUR 20 million (USD 21.4 million) or 4% of annual turnover.

A DPA may order corrective measures under both laws, including an order to stop processing personal data altogether.

Summary

While the GDPR is longer and more detailed than the KVKK, both laws provide a robust data protection framework and impose many obligations on organizations.

If your business has an effective GDPR compliance program, meeting the KVKK's requirements should not require too much additional work.

However, Turkish companies seeking to adjust to the EU's strict data protection standards might need to make more serious adjustments, particularly in the areas of transparency and data subject rights.

Make sure you have a compliant Privacy Policy displayed correctly, disclosing your valid legal basis for processing personal data. Be transparent about what rights data subjects have, and get consent when necessary before processing special categories of personal data.