KVKK No. 6698 regulates the basic principles to be followed in the processing of personal data and the obligations of the data controller.
Basic Concepts
- Personal data: Any information belonging to an identified/identifiable person
- Data controller: Person/company processing the data
- Relevant person: Data person being processed limited
- As long as the period required by the legislation or purpose
Legal Basis (KVKK article 5)
- Explicit consent
- Prescribed by law
- Establishment/execution of the contract
- Legal obligation
- Publicity
- Right establishment/defense
- Legitimate interest (balance) test)
Comparison with GDPR
- GDPR is more comprehensive
- High penalties (4% global turnover)
- Companies in Türkiye must also be GDPR compliant in serving EU citizens
KVKK Board Decisions
KVKK Board found that relying on "explicit consent" to continue the contract cripples the element of free will and It consistently accepts that it is invalid.
KVKK expert lawyer recommended.