What is VERBIS in Turkey?

VERBIS is the Turkish data controllers registry. Many controllers are required to register with VERBIS as part of their obligations under the KVKK.

Middle East & North Africa

Cookie consent in Türkiye

Q: Did Turkey ease cross border transfer rules?

Yes. A 2024 amendment relaxed the previously strict transfer regime by introducing standard contractual clauses and adequacy-style mechanisms, making lawful transfers more practical.

Consent and privacy law in Türkiye

Turkey's data protection law, KVKK Law No. 6698, dates from 2016 and is modelled on the earlier EU Data Protection Directive, enforced by the authority of the same name. A distinctive feature has been a strict approach to cross border transfers, which historically required either explicit consent or the rare use of an authority-approved undertaking, making transfers difficult. A 2024 amendment relaxed transfer rules by introducing standard contractual clauses and adequacy-style mechanisms, and adjusted the rules on sensitive data. Explicit consent must be specific and informed. Data controllers often must register with VERBIS, the controllers registry. Notices in Turkish are expected, and cookies that identify users are personal data.

Authority

Kişisel Verileri Koruma Kurumu (KVKK)

Status

Law No. 6698 on the Protection of Personal Data since 2016, amended in 2024

Primary law

KVKK

Languages

Türkçe

Who must comply

KVKK applies to organisations and individuals that fall within its scope and process personal data covered by the law.

Penalties

Administrative fines updated annually, with criminal penalties for some offences

Key obligations

Lawful and fair processing
Explicit consent
Transparency and privacy notices
Processing of special categories of personal data
Data minimisation and proportionality
Data security
Data-subject rights
Domestic and international data transfers
Data retention and deletion
Data breach notification
Data Controllers’ Registry (VERBİS)
Administrative sanctions and regulatory oversight

Local guidance

Register with VERBIS where required
Use the new transfer mechanisms from the 2024 amendment
Obtain specific and informed explicit consent
Provide notices in Turkish

How ConsentX helps

Cookie and Tracker Discovery
Consent Management
Consent Records
Prior-Script Blocking
Privacy Notices
Region-Based Rules
Consent Withdrawal
DSAR Workflows
Audit Evidence

Get started free

yoursite.com

Türkiye

We value your privacy

We ask for your consent before any non-essential cookie, with the rules that apply in your region.

Allow allReject non-essentialManage preferences

Consent recorded

sha256 · chain ok

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get Türkiye ready with ConsentX

Geo-aware banners, prior-script blocking, DSAR and tamper-evident evidence.

Get started free Book a demo

How to comply with Türkiye using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Türkiye.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Türkiye requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Türkiye audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.