Per-Jurisdiction Rights Guides
Your Data Rights in Turkey Under the KVKK
A calm, factual look at what Turkey's personal data protection law gives you, who enforces it, and how to ask an organisation to act on your information.
In short
Under Turkey's KVKK (Law No. 6698 on the Protection of Personal Data), you can ask any organisation holding your data whether it processes your information, request a copy, have inaccurate records corrected, and seek erasure or blocking where the legal grounds no longer apply. The Kişisel Verileri Koruma Kurumu (KVKK Authority) oversees these rights.
What the KVKK is and who it protects
Turkey's framework for personal data is the Kişisel Verilerin Korunması Kanunu, or KVKK, formally Law No. 6698 on the Protection of Personal Data, which came into force in 2016. It sets out how organisations, called data controllers (veri sorumlusu), may collect and use information about identified or identifiable individuals, and it gives those individuals a set of rights they can exercise directly.
The law is supervised by the Kişisel Verileri Koruma Kurumu, the Personal Data Protection Authority, often shortened to KVKK Authority or KVKK Kurumu. It maintains a public registry of data controllers (VERBİS), issues guidance, handles complaints, and can impose administrative measures where the law is breached.
If you live in Turkey, or an organisation operating in Turkey holds information about you, the KVKK generally applies to that processing. The rights below are yours to use, and you do not need a lawyer to send a request. This article is general information, not legal advice.
- Law: KVKK, Law No. 6698 on the Protection of Personal Data
- Regulator: Kişisel Verileri Koruma Kurumu (KVKK Authority)
- Key role: data controller (veri sorumlusu) decides how and why your data is used
The rights the KVKK gives you
Article 11 of the KVKK lists the rights every individual can exercise. Together they let you find out what an organisation holds about you, see it, correct it, and in defined circumstances have it removed. The organisation must respond to a valid request, in principle within 30 days.
These rights cover learning whether your personal data is processed at all, requesting information about that processing and its purpose, finding out which third parties your data has been shared with inside or outside Turkey, and asking for inaccurate or incomplete records to be corrected.
You can also ask for your data to be erased or blocked once the reasons that justified keeping it have disappeared, and you can object to results produced solely by automated analysis where they work against you. Where unlawful processing has caused you harm, the law allows you to seek compensation through the courts.
- Learn whether your personal data is being processed, and request details of how and why
- Find out which third parties, at home or abroad, have received your data
- Have inaccurate or incomplete data corrected, and ask that recipients be told
- Request erasure or blocking when the grounds for processing no longer apply
- Object to outcomes based solely on automated processing that disadvantage you
How to use your rights, calmly and on your own terms
You exercise KVKK rights by sending a request directly to the data controller, the organisation that decides why and how your data is used. Most Turkish organisations publish a privacy notice (aydınlatma metni) and an application channel, such as a registered email address (KEP), a contact form, or a notarised letter. Identify the right controller first, then write to them clearly stating what you want and including enough detail to confirm your identity.
The controller should reply within 30 days. If they refuse, do not answer, or give a response you consider inadequate, you can lodge a complaint with the Kişisel Verileri Koruma Kurumu. As a rule you complain to the Authority only after first applying to the controller, so keep a dated copy of your original request and their reply.
OSINTA is a self-only tool: it helps you see and understand your own digital footprint and prepare your own rights requests, so you decide what to send and to whom. It does not act on your behalf, monitor anyone, or guarantee an outcome. The decisions stay with you. Again, this is general information, not legal advice; for a specific situation consult a qualified Turkish lawyer or the Authority's own guidance.
- Find the data controller and its published application channel
- Write a clear request stating which right you are using and including identity details
- Keep a dated copy; expect a reply within about 30 days
- If unresolved, complain to the Kişisel Verileri Koruma Kurumu
Frequently asked questions
What does KVKK stand for?
KVKK stands for Kişisel Verilerin Korunması Kanunu, Turkey's Law No. 6698 on the Protection of Personal Data. The same abbreviation is also used informally for the supervisory authority, the Kişisel Verileri Koruma Kurumu, which enforces the law.
How long does an organisation have to respond to my KVKK request?
As a general rule the data controller must respond to a valid request within 30 days. If the response is missing, refused, or inadequate, you can then take the matter to the Kişisel Verileri Koruma Kurumu. Timing and exceptions can vary, so check the Authority's current guidance.
Can I ask for my data to be deleted under the KVKK?
Yes. Article 11 lets you request erasure or blocking of your personal data once the reasons that justified processing it no longer apply. The controller assesses whether a legal basis to keep the data still exists, so erasure is a right to request, not an automatic guarantee.
Do I need a lawyer to use my KVKK rights?
No. You can apply directly to a data controller yourself, and you can complain to the Kişisel Verileri Koruma Kurumu without legal representation. This guide is general information, not legal advice; for a specific or complex situation, a qualified Turkish lawyer can help.
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Understand your footprint, then exercise your rights
OSINTA helps you see your own digital footprint and prepare your own KVKK or DSAR requests, calmly and on your terms.