Turkey

Law 6698 has no single article spelling out extraterritorial reach in the way Europe's General Data Protection Regulation does. Reach is instead built from the Registry of Data Controllers Regulation, which defines a 'data controller representative' as a legal person resident in Turkey or a citizen of the Republic of Turkey, and which set 1 October 2018 as the start and 31 December 2021 as the deadline for registration by controllers resident abroad, with no headcount or balance-sheet threshold attached to that category. The Board's breach decision points the same way: a controller based abroad must report to the Board where the breach affects people in Turkey who use its goods or services. The size exemption (fewer than 50 employees and annual balance sheet under 100 million lira, where processing sensitive data is not the main business) comes from Board Decision 2018/87 as amended by Decision 2023/1154, and on its face applies to controllers generally; the registration timetable nevertheless lists controllers resident abroad as a separate group with no threshold.

The general law works in three steps. Step one: is there a decision that the destination country, a sector inside it, or an international organisation offers adequate protection? Step two, if not: have the parties put in place one of the appropriate safeguards listed in the law? Step three, if neither: does one of a short, closed list of one-off exceptions apply? Step one is currently empty. The Authority's own page says in terms that no determination has been made. Sector overrides, strongest first: payment and electronic money institutions (systems, backups and data in Turkey, cloud only from a named approved list); banks (the Banking Regulation and Supervision Agency's information systems regulation is the controlling instrument); public bodies and critical infrastructure (the 2019 information and communication security circular and the guide issued under it, now overseen by the Cybersecurity Directorate); telecoms (the Information and Communication Technologies Authority regulates subscriber, traffic and location data separately); health (Ministry of Health rules and the central health data system); insurance (support services and internal systems regulations, the support services one amended on 23 July 2026).

Routes in practice. (1) Standard contract: four versions exist (controller to controller, controller to processor, processor to processor, processor to controller), adopted by Board Decision 2024/959 of 4 June 2024. It must be notified to the Authority within five working days of the last signature, on paper or through registered electronic mail. Failure to notify is itself a fineable offence. Filing is not a formality: in 2025 the Authority received 2,497 standard contracts, opened 70 own-motion investigations off the back of them, finished 21 and fined 3 organisations a total of 150,000 lira. (2) Binding corporate rules: approved once by the Board, then the group transfers without asking again. Application forms and guides are published. (3) Written undertaking plus Board permission: in 2025, 90 undertakings were submitted, 89 were decided, 13 were allowed and 76 were refused. Treat this route as a last resort. (4) One-off exceptions such as the person's informed explicit consent, contract necessity, an overriding public interest, or legal claims. The law and regulation both say these are for occasional, irregular transfers, not routine flows.

Enforcement is rated active rather than aggressive: the volume is high but individual fines are modest by European standards, and the biggest single block of penalties is for failing to register rather than for mishandling data. 2025 numbers from the Authority's own annual report: 876 controllers fined, made up of 140 arising from complaints and tip-offs, 142 from breach notifications and 594 from registry failures. Fines totalled 352,510,494 lira, of which 216,860,000 lira was registry-related. 328 new breach files were opened in 2025, 32 of them against controllers based outside Turkey. The Authority also asked 42 public bodies to take disciplinary action against responsible staff. Its output in 2026 continues: binding principle decisions in February, May and July 2026, a compliance guide for public bodies in July 2026, and named breach announcements in August 2026. On the security side, Presidential Decree No 177 of 8 January 2025 created the Cybersecurity Directorate, Law No 7545 of 19 March 2025 gave it powers, and by 2026 the national cyber incident response centre's services had moved onto the Directorate's site.

Ceiling: the Regulation on Deletion, Destruction or Anonymisation of Personal Data requires controllers that must register to hold a personal data retention and destruction policy, and to erase, destroy or anonymise the data at the first periodic destruction run following the date the duty to delete arose. That makes the interval between destruction runs the real deadline, and it is set in your own policy rather than by a single national number. Floor: general Turkish commercial and tax legislation requires business records to be kept for a period of years, and sector regulators impose their own record-keeping periods on banks, payment institutions, insurers and telecoms operators. Where the two collide, the retention duty in the specific law wins and the data must be kept, but it must then be locked down and used only for the purpose that justified keeping it. We did not verify the individual commercial and tax periods against a government source in this run, so treat those numbers as unconfirmed.

Clock one: Board Decision 2019/10 of 24 January 2019 reads the law's phrase 'as soon as possible' as 72 hours from becoming aware, using the Authority's published breach form, with information supplied in stages if it is not all available at once. Individuals must be told directly where contact details exist, otherwise by a suitable method such as a notice on the controller's own website. A processor that suffers the breach must tell its controller without any delay. A controller based abroad must notify on the same terms where the consequences hit people in Turkey who use its goods or services. Clock two: cyber incident reporting to the Cybersecurity Directorate, which since 2025 holds the national incident response role and inherited the national cyber incident response centre's services; we did not verify a specific number of hours in this run. Clock three: financial regulators run their own incident reporting for banks, payment institutions and electronic money institutions. Overlapping clocks are the usual operational failure here: the 72-hour privacy report is the one everyone remembers and the regulator-specific ones are the ones people miss.

(1) In 2025, 594 of 876 penalised organisations were penalised over the register of data controllers, for 216.86 million lira of the 352.5 million lira total, an average of roughly 365,000 lira each. The Authority states expressly that it continues to take action against controllers resident abroad as well as domestic ones. (2) Written undertakings plus Board permission: 90 submitted, 89 decided, 13 allowed, 76 refused. If your transfer plan depends on this route, assume it fails. (3) Standard contracts must be filed within five working days; in 2025 the Authority turned 70 of the 2,497 filings into own-motion investigations and fined three organisations. Filing a defective or unsigned contract triggers a formal review by law. (4) The representative must be a company established in Turkey or a Turkish citizen, so a regional office in another country will not do. (5) There is no adequacy decision for any country, sector or international organisation, so a European company cannot rely on Turkey treating the European Union as safe. Separately, Turkish law also attaches criminal offences to unlawfully recording, passing on or failing to delete personal data, which can reach individuals rather than only the company; we did not verify the current text of those offences in this run.

Dated: (a) Principle Decision 2026/266, published on 28 February 2026, gave controllers six months to fix loyalty-card checkout processes; Board Decision 2026/1491 of 22 July 2026 pushed that deadline out to 28 February 2027. (b) Principle Decision 2026/1301 of 1 July 2026 governs how public-law controllers may publish personal data on the internet, with a public explainer issued on 27 July 2026, and a compliance guide for public bodies followed on 28 July 2026. (c) Principle Decision 2026/1095 of 20 May 2026 covers processing the personal data of accident victims. Dormant switches that can change the picture without consultation: the Board can declare a country, a sector within a country or an international organisation adequate at any time, and can equally suspend or revoke such a decision looking forward, reviewing every four years; the Board can add or remove exemptions from the register by decision, as it did on 4 September 2025 for micro-businesses whose main activity is processing sensitive data; and the central bank has an express power to stop payment institutions sharing data abroad, or to add further limits, whenever it judges that the payments market is being harmed. Secondary legislation under the 2025 Cybersecurity Law is still being issued, including procurement rules in April 2026.