Turkey KVKK readiness check

Turkey’s KVKK — Law No. 6698, in force since 2016 — is one of the region’s most actively enforced data protection regimes, and the 2024 amendment (Law No. 7499) rewrote cross-border transfers: adequacy decisions, standard contracts notified to the Authority within 5 business days, approved undertakings or BCRs — with explicit consent no longer a valid basis for routine transfers since 1 September 2024. VERBIS registration is mandatory for most controllers, with new exemption decisions in late 2025 (2025/1572 and 2025/2393) that changed the thresholds. Breaches go to the Board within 72 hours; data-subject applications must be answered within 30 days. Twelve questions tell you where you stand.