KVKK
Turkish Personal Data Protection Law
Türkiye's personal data protection law for organizations that process personal data of people in Türkiye.
Quick navigation
KVKK
What it means
KVKK sets rules for processing personal data in Türkiye. On websites, cookie and tracking technologies can fall under KVKK when they collect identifiers, behavior, preferences, or other visitor-related data.
The practical goal is transparency and control: visitors should understand what data is collected, why it is collected, who receives it, and how they can manage consent or object where applicable.
Türkiye
Who must comply
- You are established in Türkiye and process personal data.
- You offer a website, service, campaign, or product to people in Türkiye.
- You collect behavioral, analytics, advertising, or profiling data from visitors in Türkiye.
KVKK
What you need to do
- Provide an understandable privacy notice before or during data collection.
- Use explicit consent where required, especially for non-essential cookies and marketing technologies.
- Separate mandatory cookies from analytics, advertising, and personalization cookies.
- Keep records of consent and preference changes.
- Respect data subject rights such as access, correction, deletion, and objection.
Plain language
What it is not
KVKK
FAQ
Does KVKK apply to foreign companies?
It can, when the service is directed to people in Türkiye or personal data of people in Türkiye is processed in practice.
Is every cookie forbidden without consent?
No. Strictly necessary cookies may run for the service to work. Optional analytics, advertising, and profiling cookies usually require a clearer choice.
What should a KVKK cookie layer explain?
It should explain cookie categories, purposes, providers, retention periods where possible, and how the visitor can change preferences.