The short answer to "Is KVKK (Türkiye's data-protection law) mandatory for companies?" depends on whether you process personal data. Almost every company that keeps employee payroll records, a customer list, a visitor log or camera footage falls within the scope of Law No. 6698 on the Protection of Personal Data ("the Law"). However, not every obligation applies to everyone in the same way; in particular, there are exemptions from VERBİS (the Data Controllers' Registry Information System) registration, introduced by decisions of the Personal Data Protection Board (Kurul, "the Board").
In this article we summarize, from primary sources, the core obligations the Law places on companies, the VERBİS exemptions, and which administrative fine is provided for under which article in the event of a violation. The deadline and procedure for notifying the Board when a data breach occurs are covered in detail in the article on KVKK data breach notification.
Who does the Law apply to?
According to Article 2 of Law No. 6698, the Law applies to natural persons whose personal data is processed, and to natural and legal persons who process that data wholly or partly by automated means, or by non-automated means as part of a data filing system. For a company, the key concept is the "data controller": Article 3 of the Law defines it as the natural or legal person who determines the purposes and means of processing personal data and who establishes and manages the data filing system. A service provider that processes data on the company's behalf, in turn, is considered a "data processor."
Article 28 of the Law leaves certain situations outside its scope, for example an individual's activities that relate only to themselves and to family members living in the same household, or processing for official statistical purposes in anonymized form. These exceptions do not cover the ordinary data processing of commercial activity. Therefore, for a company that has employees or customers, the answer to the question "Is KVKK mandatory?" is, according to the text of the Law, yes.
Companies' core obligations
Obligation to inform (Art. 10). When personal data is obtained, the data controller is obliged to inform data subjects of the controller's identity, the purpose of processing, to whom and for what purpose the data may be transferred, the method and legal basis of collection, and the rights set out in Article 11.
Data subject applications (Arts. 11 and 13). Individuals can exercise rights such as learning whether their data is being processed and requesting correction, deletion and compensation for damage by applying to the data controller. Under Article 13, an application must be concluded, depending on the nature of the request, as soon as possible and within thirty days at the latest, free of charge as a rule. How to track this process is covered in the article on automating the KVKK application process.
Data security (Art. 12). The data controller must take every technical and administrative measure necessary to prevent unlawful processing of and access to data and to ensure that the data is safeguarded. If the data is processed by another person, the controller is jointly responsible with that person for these measures, and it must carry out, or have carried out, the audits needed within its own organization to apply the Law. The confidentiality obligation of employees and data processors continues after they leave their duties. The obligation to give notice in the event of a breach is also found in paragraph 5 of this article.
Compliance with Board decisions (Art. 15). Information and documents requested by the Board during an examination must be sent within fifteen days. If the Board finds a violation of the law and decides that it must be remedied, the decision must be carried out without delay and within thirty days at the latest from the date it is served.
Notification of transfers abroad (Art. 9). Under Article 9, which was rewritten by the 2024 amendment, if a standard contract is used for a transfer abroad, notification is made to the Personal Data Protection Authority (Kurum, "the Authority") within five business days of the contract's signing.
Specific practices such as the use of generative AI tools or biometric attendance tracking are concrete examples of these obligations; for them, see the articles on an in-house AI policy and biometric attendance tracking.
Is VERBİS registration mandatory for everyone?
Article 16 of the Law says that natural and legal persons who process personal data "must register with the Data Controllers' Registry before starting data processing" and gives the Board the authority to introduce exemptions based on objective criteria. Any change in the registration information must also be reported immediately. According to the Authority's sources reviewed for this article, the exemption framework has taken shape as follows:
- Decision No. 2018/87 (July 19, 2018): Data controllers that are natural or legal persons with an annual employee count below 50 and an annual balance-sheet total below the amount stated in the decision, and whose main activity is not the processing of special categories of personal data, were exempted from registration with the Registry. The decision was taken in addition to those previously exempted by Decision No. 2018/32.
- Decision No. 2023/1154 (July 6, 2023): While the employee-count criterion stayed the same, the annual balance-sheet total threshold was raised on the grounds of economic conditions.
- Decision No. 2025/1572 (September 4, 2025): Among data controllers whose main activity is the processing of special categories of personal data, those with an annual employee count below 10 and an annual balance-sheet total below the amount stated in the decision were also brought within the exemption.
- Decision No. 2025/2393 (December 25, 2025): For those who keep books on a balance-sheet basis, the employee-count and balance-sheet criteria are applied together; for those who do not keep books on a balance-sheet basis, since no balance-sheet information exists, only the employee count is used.
For the amounts of the current balance-sheet thresholds, refer to the texts of the relevant decisions. One important distinction: these decisions concern only the obligation to register with and notify the Registry. They contain no exemption from the obligations to inform, to ensure data security or to handle applications; a company exempt from VERBİS is still subject to the other provisions of the Law.
Administrative fines: which violations does Article 18 list?
Article 18 of the Law lists, in five sub-paragraphs, the violations for which an administrative fine is provided:
- (a) failing to fulfill the obligation to inform in Article 10,
- (b) failing to fulfill the data security obligations in Article 12,
- (c) failing to carry out the decisions given by the Board under Article 15,
- (ç) acting contrary to the obligation to register with and notify the Registry in Article 16,
- (d) with the sub-paragraph added in 2024, failing to make the notification of a transfer abroad in paragraph 5 of Article 9.
The lower and upper limits for each sub-paragraph are set separately in the Law. Under paragraph 2 of the article, as amended in 2024, the fines in sub-paragraphs (a)–(ç) are imposed on the data controller, while the fine in sub-paragraph (d) is imposed on natural persons and private-law legal entities that are data controllers or data processors. Paragraph 3, also added in 2024, provides that an action may be brought in the administrative courts against the administrative fines imposed by the Board.
The amounts of the fines are not fixed. According to the Authority's announcement of December 31, 2025, the fines in Article 18 are revalued at the beginning of every calendar year under paragraph 7 of Article 17 of the Kabahatler Kanunu (the Misdemeanors Law). For this reason, no amounts are given in this article; the current table should be monitored on the Authority's page.
Alongside the administrative sanction, Article 17 of the Law refers to Articles 135–140 of the Turkish Penal Code (Türk Ceza Kanunu, TCK) for offenses relating to personal data; for those who, contrary to Article 7, fail to delete or anonymize data, it also points to Article 138 of the TCK.
Where to start?
The steps below are a general framework derived from the provisions above:
- Inventory: Map out which unit processes which personal data, for what purpose, in which system, and to whom it transfers the data. This list is the input for both the privacy notice and a possible VERBİS filing.
- VERBİS assessment: Document your position under the current Board decisions, based on the number of employees, the bookkeeping method and whether the main activity is the processing of special categories of personal data.
- Privacy notices: For each group of people, such as employees, candidates, customers and visitors, prepare texts that cover the headings in Article 10.
- Application channel: Set up a record-keeping system that lets you track applications within the thirty-day period.
- Security and suppliers: Plan the technical and administrative measures, the contracts with data processors and periodic internal audits.
Frequently asked questions
Is KVKK mandatory for small companies too? There is no threshold based on company size for the Law to apply. Scale criteria appear in the Board decisions only for the VERBİS registration exemption.
What penalty applies to not registering with VERBİS? Acting contrary to the obligation to register with and notify the Registry, where a registration obligation exists, is among the violations for which sub-paragraph (ç) of Article 18 provides an administrative fine.
Who is a KVKK fine imposed on? The fines in sub-paragraphs (a)–(ç) are imposed on the data controller; the fine in sub-paragraph (d) is imposed on natural persons and private-law legal entities that are data controllers or data processors.
Conclusion
Every company that processes personal data falls within the scope of KVKK; the scale exemptions in the Board decisions concern only VERBİS registration. From Orient Global's perspective, starting with a personal data inventory is the most efficient step, because it puts the privacy notices, the VERBİS assessment and the security measures on the same foundation.
Why logistics experience matters here. Personal data is part of the daily flow of a logistics or distribution business: recipient names, addresses and phone numbers on delivery orders, driver and warehouse staff records, visitor logs at the gate and camera footage on the dock. A depot typically deals with all four groups named in the privacy-notice step above (employees, candidates, customers and visitors), and the inventory step asks of personal data what a logistics team asks of every shipment: where it is held and who it is handed to next. The security-and-suppliers step will also look familiar to anyone who has run a carrier network: written terms, a named contact at each partner and periodic checks that the agreed controls are really in place. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end to end, building and leading teams of 100+ people and delivering lasting gains in operational performance through KPI-driven programs. He has also designed and directed large-scale logistics and distribution networks across leading retail, logistics and distribution organizations, managing nationwide warehouse and transport operations and network and capacity planning. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information only and does not constitute legal or financial advice. Please consult your own specialist about your situation.
#interimmanagement #forwarddeployedengineering