Administrative Fines under Turkish Data Protection Law (KVKK) in 2025

Under the Personal Data Protection Law No. 6698 (KVKK), companies and individuals that fail to comply with their obligations face significant administrative fines. As of 2025, the penalty ranges are as follows:

• Failure to fulfill the information (privacy notice) obligation:

  Minimum TRY 68.083 – Maximum TRY 1.362.021

  
  

• Failure to ensure data security:

  Minimum TRY 204.285 – Maximum TRY 13.620.402

  
  

• Failure to comply with decisions of the Data Protection Authority (the Board):

  Minimum TRY 340.476 – Maximum TRY 13.620.402

  
  

• Failure to register or notify the Data Controllers’ Registry (VERBIS):

  Minimum TRY 272.380 – Maximum TRY 13.620.402

  
  

• Failure to notify the Authority of standard contractual clauses for cross-border data transfers:

  Minimum TRY 71.965 – Maximum TRY 1.439.300

  
  

These fines highlight the importance of strict compliance with KVKK obligations, particularly in areas of data security, transparency, and cross-border data transfers.

AKL

Your Legal Guide in Turkey