Foreign entities targetting the Turkish market or collecting personal data of Turkish residents must comply with the Turkish Personal Data Protection Law (KVKK No. 6698).


1. Cross-Border Data Transfer

Transferring personal data of Turkish citizens abroad is highly restricted. It requires the explicit consent of the data subject, or the existence of an adequate protection level in the destination country, or standard contractual clauses (SCC) approved by the KVKK Board.


2. VERBIS Registration

Foreign data controllers who process personal data of data subjects in Turkey must appoint a local Data Controller Representative and register with the online VERBIS system, under threat of heavy administrative fines.



Frequently Asked Questions (FAQ)

Does KVKK Apply to Foreign Data Controllers?

  1. Applicability: Yes, if you process personal data of individuals living in Turkey.
  2. VERBIS: Mandatory to register in the VERBIS database and appoint a local rep.
  3. Data Export: Standard contractual clauses (SCC) must be signed for transferring data out.