KVKK vs GDPR: What Foreign Companies Need to Know

If you already know the GDPR, you have a head start on Turkey's data protection law (KVKKKVKKPersonal Data Protection Law No. 6698Türkiye's data protection statute — the rules on collecting, storing and transferring personal data, and the authority that enforces them.Glossary →, Law No. 6698) — but not a free pass. The two regimes share the same architecture: both are rights-based, both run on a data controller / data processor model, and both rest on the same core principles. The differences, though, are real and they catch foreign companies out. KVKK grew from an explicit-consent culture, it carries a registration step (VERBİS) that has no GDPR equivalent, it does not impose a Data Protection Officer mandate in the GDPR sense, and after the March 2024 reform (Law No. 7499) its cross-border transfer rules changed substantially. The single most important takeaway is this: being GDPR-compliant does not make you KVKK-compliant. This guide maps the overlaps and, more usefully, the gaps.

The Short Answer: Same Blueprint, Different Building

For a foreign company that already runs a GDPR programme, the honest summary is: you can reuse most of your thinking, but you cannot copy-paste your compliance. Turkey's Law on the Protection of Personal Data No. 6698 — the Kişisel Verilerin Korunması Kanunu, or KVKK — was built on the same European foundations as the GDPR. It protects the same right, uses the same vocabulary, and asks you to do many of the same things.

But KVKK is a sovereign Turkish law, enforced by a Turkish authority, with its own procedures, its own registry, and its own penalties denominated in Turkish lira. Where GDPR and KVKK diverge, the Turkish version controls inside Turkey — and assuming the two are interchangeable is the most common and most expensive mistake foreign businesses make.

Where KVKK and GDPR Line Up

Start with the good news, because it is substantial. If your organisation is GDPR-mature, large parts of your framework will translate directly.

Both are rights-based regimes

KVKK, like the GDPR, treats data protection as a fundamental right of the individual rather than a mere compliance formality. In Turkey that right is anchored in the Constitution and given detail by Law No. 6698. Individuals (in KVKK language, the ilgili kişi — the "data subject" or "relevant person") hold enforceable rights: to learn whether their data is processed, to request information, to seek correction or erasure, and to object. These mirror the GDPR's data subject rights closely enough that a GDPR rights-handling process is a strong starting point.

The controller / processor model is the same

KVKK uses the same two-actor structure you know from the GDPR:

• Data controller (veri sorumlusu) — the party that determines the purposes and means of processing. This is the GDPR "controller."
• Data processor (veri işleyen) — the party that processes data on the controller's behalf and under its instruction. This is the GDPR "processor."

Allocating roles, papering processor relationships, and pinning down who is accountable for what all work the way your GDPR programme already does.

The core principles overlap

Both laws require that personal data be processed lawfully and fairly, for specified and legitimate purposes, kept accurate and up to date, limited to what is necessary, and retained no longer than needed. A GDPR data-protection-by-design mindset maps cleanly onto KVKK's principles. The destination is similar; it is the route and the paperwork that differ.

Where KVKK and GDPR Diverge — The Parts That Catch Foreign Companies

This is the section that matters. The similarities are comforting; the differences are where compliance fails. The table below is a high-level map, and the subsections that follow explain the four divergences that most often trip up foreign companies.

1. The explicit-consent legacy

The most important cultural difference is how each law thinks about lawful basis. The GDPR deliberately offers six bases and lets you choose the most appropriate one; in practice many EU controllers rely on contract, legal obligation, or legitimate interests, keeping consent as a last resort.

KVKK grew up the other way around. For years it was read as explicit-consent-centric: explicit consent (açık rıza) sat at the centre, with a defined list of statutory exceptions around it, and the room to lean on something resembling the GDPR's "legitimate interests" was narrower. The 2024 reform moved KVKK closer to the GDPR's approach to lawful bases, but the wording is its own, and the practical habits of Turkish regulators and counterparties still reflect that consent-first history.

2. VERBİS — a registry with no GDPR equivalent

There is no GDPR analogue to VERBİS (the Veri Sorumluları Sicili, the Data Controllers' Registry). The GDPR scrapped general notification-to-the-regulator years ago; Turkey kept a registry. Many data controllers operating in Turkey must enrol in VERBİS and keep their entry current.

Whether your organisation is obliged to register depends on thresholds set by the Board — typically tied to factors such as employee numbers and annual financial figures, with sector-specific exemptions. Because those thresholds are set qualitatively here and change over time, you should confirm your specific position rather than assume you fall in or out. A foreign company that is fully GDPR-compliant can still be in breach in Turkey purely for never having registered.

3. No DPO mandate — but a "contact person"

The GDPR requires a Data Protection Officer (DPO) in defined situations — an independent role with statutory tasks and protections. KVKK has no DPO mandate in that sense.

What KVKK requires instead, for controllers registered in VERBİS, is a contact person (irtibat kişisi). This is a narrower role: a liaison point between the company and the Authority, not an independent supervisor of the company's processing. Foreign controllers established outside Turkey may also need to designate a representative in Turkey. The practical point: do not assume your existing DPO satisfies KVKK, and do not assume a VERBİS contact person discharges your GDPR DPO duties. They are different roles solving different problems.

4. Cross-border transfers — overhauled in 2024

This is the area where the two regimes have moved closest and yet where foreign companies most often breach KVKK. It deserves its own section, below.

The 2024 Reform and Cross-Border Transfers

On 12 March 2024, Law No. 7499 amended KVKK and, together with the implementing regulation that followed, replaced Turkey's old, heavily consent-based model for sending personal data abroad with a tiered framework that tracks the structure GDPR users already recognise.

At a high level, personal data may now leave Turkey through one of three routes:

1. An adequacy decision — transfer to a country, sector, or international organisation the Board has formally recognised as providing adequate protection.
2. Appropriate safeguards — where there is no adequacy decision, transfer based on instruments such as the Board's standard contractual clauses (SCCs), binding corporate rules (BCRs) for intra-group flows, or an approved undertaking.
3. Exceptional cases — limited, occasional transfers resting on explicit consent or specific statutory grounds.

If you know GDPR Chapter V, this shape will feel familiar. But the instruments are Turkish: the Board's SCCs are not the EU Commission's SCCs, the Turkish text governs, and there are procedural steps — including a notification to the Authority within a set short period after signing the Board's SCCs — that have no GDPR equivalent.

The two-direction problem

There is also a structural asymmetry GDPR-mature groups must plan for. Because the EU has not issued an adequacy decision recognising Turkey, data flowing into Turkey from the EU still needs its own GDPR safeguards (typically the EU Commission's SCCs put in place by the EU sender) — entirely separate from the Turkish instruments needed for data flowing out of Turkey. Many groups therefore run two parallel sets of transfer contracts.

For the agreements that sit behind these flows, this overlaps with how we handle data-processing agreements and contractual clauses.

A Practical Mapping Exercise for GDPR-Mature Companies

Rather than rebuilding from scratch, treat KVKK readiness as a gap analysis against your existing GDPR programme. A defensible approach usually runs as follows:

• Re-map lawful bases. Take each processing activity and check its basis against Article 5 of Law No. 6698 — do not assume your GDPR basis (especially legitimate interests) transfers.
• Check VERBİS. Determine whether you meet the registration thresholds, register if so, appoint a contact person, and keep the entry current.
• Localise your notices. KVKK requires its own clarification text (aydınlatma metni) and, where relied on, explicit consent forms — these are not the same documents as your GDPR privacy notice.
• Rebuild transfers. Identify every flow that leaves Turkey, select a current 2024-regime mechanism, and complete any required filing; separately confirm the GDPR safeguards for flows into Turkey.
• Sort out roles. Confirm whether you need a GDPR DPO, a VERBİS contact person, a Turkish representative — or some combination.
• Align incident response. Both regimes require breach notification; build one procedure that satisfies the stricter of the two timelines (confirm the current Turkish requirement) and run it under realistic time pressure.

Penalties: Two Regimes, Two Separate Exposures

Non-compliance is assessed under each regime independently, and the two can bite at once.

Under KVKK, the Authority's Board can impose administrative fines — for example for security failures, registration failures, or breaches of its decisions — alongside corrective orders. These fines are set in Turkish lira and re-indexed each year, so any specific figure dates quickly; confirm the current bands before relying on them. Serious unlawful processing can additionally engage criminal provisions of the Turkish Penal Code (Law No. 5237).

Under the GDPR, EU supervisory authorities can impose their own fines and enforcement measures, and data subjects may bring civil claims. For an international group, the real danger is parallel exposure: a single misconfigured transfer or one missing notice can trigger consequences in Turkey and in the EU simultaneously.

Data protection rarely sits alone. If you are setting up a foreign-owned company in Turkey, it is far cheaper to bake KVKK in from day one than to retrofit it; and in a deal it forms part of data-protection due diligence. For a structured KVKK-versus-GDPR gap review, speak with our Istanbul team.

Frequently asked questions