Don’t do SECURITY. Do business SECURELY.
Threat intelInsightsBook a consultation
Back to all insights

Türkiye’s personal data protection law is enacted

Türkiye’s Personal Data Protection Law No. 6698 is published, introducing the country’s first comprehensive data protection regime.

Türkiye’s Personal Data Protection Law No. 6698 (KVKK) has been published in the Official Gazette, introducing the country’s first comprehensive data protection law, largely modelled on the EU Data Protection Directive.

Key points

  • Requires technical and administrative security measures.
  • Establishes the Personal Data Protection Authority and Board.
  • Restricts transfers of personal data abroad.
  • Introduces registration duties for data controllers.

UK organisations with Turkish customers, employees or operations should assess their obligations under the new law, particularly the restrictions on transferring personal data out of Türkiye and the planned controller registry.

Source: Personal Data Protection Law No. 6698 (KVKK)

Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.

Get our weekly insights by emailA free weekly threat and vulnerability round-up with a link to our threat log spreadsheet, plus legal, regulatory, standards, and AI updates.
Subscribe free

How we can help: consulting, auditing, and AI governance. Book a complimentary consultation.

More insights