Differences Between The KVKK And The GDPR

ADMD Mavioğlu & Alkan Law Firm
Eda Özkapu & Feyza Türkekul

I.  DEFINITION OF PERSONAL DATA

Pursuant to Article 3 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), personal data is defined as any information relating to an identified or identifiable natural person. Although the concept is expressed in these terms under Turkish law, different legal systems adopt different approaches. Under the General Data Protection Regulation of the European Union (“GDPR”), which constitutes the general framework in this field, personal data is defined as “any information relating to an identified or identifiable natural person”. Based on this definition, it may be stated that personal data is regarded under EU legislation as a value pertaining specifically to “natural persons”. By contrast, Certain approaches in Anglo-American legal scholarship and practice have placed greater emphasis on the economic and proprietary aspects of personal datahaving economic value. Accordingly, this approach addresses personal data primarily within the framework of contract and tort law rather than through the protection of personal data as such.

II.  THE NECESSITY OF PERSONAL DATA PROTECTION

In light of the developments in modern technology, changes and advances in the collection, processing and storage of data have rendered greater attention and care necessary with regard to issues such as privacy and the protection of fundamental rights and freedoms, thereby creating a need for legal regulations aimed at protecting the confidentiality of personal data. Personal data is frequently and extensively processed by both public institutions and private-sector actors through information systems and automated means. Although this facilities interaction between individuals and service providers and provides various operational advantages, it also entails significant risks, including data security breaches and violations of individuals’ private information. Accordingly a legitimate and sustainable balance must be maintained between the effective provision of digital services and the fundamental rights and freedoms of individuals. As a result of this need the KVKK and the GDPR have emerged as legal frameworks aimed at protecting individuals’ privacy and regulating rights relating to personal data.

III.  PERSONAL DATA UNDER TURKISH LAW

Within the framework of fundamental rights and duties regulated in the second part of the Constitution, the privacy of private life is recognized as a fundamental right. Article 20 of the Constitution provides that “Everyone has the right to demand respect for his or her private and family life. The privacy of private and family life shall not be violated.” Thus, this right is afforded constitutional protection. In addition to this general provision, Law No. 5982 on the Amendment of Certain Provisions of the Constitution of the Republic of Türkiye, adopted in 2010, added a paragraph to Article 20 providing that everyone has the right to request the protection of his or her personal data. With this additional paragraph, individuals’ rights over their data were expanded, and rights relating to information, access, deletion, the use of data for legitimate and specific purposes, and supervision were expressly recognized.

The provision also aims to apply to and protect personal data processed by all public and private institutions and organizations, without distinguishing between the public and private sectors. Under the Law, a “data recording system” is defined as any recording system in which personal data is structured and processed according to certain criteria.

Accordingly, subject to the scope under Article 2 and the exceptions under Article 28 of the KVKK, the determination of obligations relating to the processing of personal data is based primarily on the nature and scope of the processing activity rather than on whether the data controller is a public or private-law legal entity.

Following the general framework established by the Constitution, specific protection mechanisms in this field have been regulated by the KVKK. Based on the general definition of personal data under Article 3 of the KVKK, four elements of the concept of personal data are generally recognized in Turkish law. These elements may be examined as follows:

1)      Identified or identifiable: The concept of “identifiable” indicates that it is not necessary for the identity of the person to have already been determined. It is sufficient that the person can be distinguished or singled out. When determining whether a person is identifiable, the data controller or third parties must exercise the necessary care and diligence in accordance with the principles of good faith, to establish the person’s identity.

2)      Natural person: In this respect, Turkish law limits the concept of personal data to natural persons and does not include legal persons within the scope of the definition.

3)      Relationship to the individual: For information to qualify as personal data, it must be capable of being connected to the identity of the person concerned. Legal doctrine considers three factors in determining whether such a connection exists: content, purpose and result.

• Content criterion: refers to the information that directly belongs to the individual.

• Purpose criterion: is based on the use of information to evaluate a person, influence his or her behaviour, or treat that person in a particular manner.

• Result criterion: This concerns whether the use and processing of the information affects the rights and interests of the person.

Based on these factors, it is important to note that each criterion may apply in relation to different individuals; therefore, the same information may constitute the personal data of more than one person.

4)      Any information: The wording adopted by the legislator indicates an intention to define the boundaries of the concept of personal data as broadly as possible. Accordingly all objective and subjective information concerning an individual falls within the definition. Within this broad framework, the information is not required to be “accurate and definitive”.

After defining the concept of personal data in this manner, the legislator defined special categories of personal data under Article 6 of the KVKK. Pursuant to the relevant provision, “data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data” are defined as special categories of personal data. The KVKK adopts an exhaustive approach (numerus clausus) in defining special categories of personal data. The most important distinguishing feature of special categories of personal data is that such information may cause harm or discrimination to the person if disclosed to others. For this reason, special categories of personal data may also be described as data requiring a higher level of protection. Accordingly, the provision cannot be extended by analogy.

However, Article 28 of Law No. 6698 also regulates certain circumstances in which the provisions of the Law do not apply. Accordingly, the processing of personal data by natural persons solely within the scope of activities relating to themselves or members of their household, provided that the data is not disclosed to third parties and the obligations concerning data security are complied with, is excluded from the scope of the Law.

In addition, the processing of personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, adjudication or enforcement proceedings is excluded from the scope of Law No. 6698. Furthermore, the Law does not apply where personal data is processed by public institutions and organizations authorized by law within the scope of preventive, protective or intelligence activities carried out for the purposes of ensuring national defence, national security, public security, public order or economic security. These exceptions define the boundaries of the Law’s scope of application by taking into account the nature of personal data processing activities and the public interest and clearly establish the circumstances in which such activities fall outside the scope of Law No. 6698.  

IV.  LEGAL LIABILITY RELATING TO THE PROTECTION OF PERSONAL DATA

The Law establishes the procedures and principles that natural and legal persons must comply with when processing personal data, while also providing for the legal consequences and sanctions arising from non-compliance with these requirements. These obligations include:

1. Using personal data in accordance with the law and the principle of good faith, in an accurate, specific, clear and legitimate manner, proportionately and to the extent necessary; retaining the data only for as long as necessary for the relevant purpose and processing them in accordance with that purpose;

2. Ensuring that personal data processing activities are based on an appropriate legal basis and, where processing is based on explicit consent, obtaining such consent in accordance with the law;

3. Ensuring that the method of collecting personal data and the legal basis for such collection are appropriate;

4. Providing the data subject with the required information;

5. Preventing the unlawful use of stored personal data;

6. Taking all necessary technical and administrative measures to ensure the security of personal data.

Within the scope of the data controller’s obligation to inform, the means of processing must be specific, clear and legitimate. Accordingly the sanctions, applicable to acts constituting violations of the Law are regulated under Articles 17 and 18 in chapter five, entitled “Crimes and Misdemeanours” The legislator has divided violations into two categories. With regard to acts constituting crimes, Article 17 of the KVKK directly refers to Articles 135 to 140 of the Turkish Penal Code (TPC) Law No. 5237.  Accordingly:

1. Pursuant to Article 135 of the TPC, unlawfully recording personal data is punishable by imprisonment from one to three years; an increase in the sentence is also provided depending on the nature of the data
2. Article 136 regulates the unlawful disclosure, dissemination or acquisition of personal data and provides for imprisonment from two to four years.
3. Article 137 provides that where such offences are committed by public officials through abuse of the authority conferred by their duties or by taking advantage of the convenience provided by a particular profession or occupation, the penalties shall be increased by one half.
4. Under Article 138, persons who are under an obligation to destroy data but fail to fulfil that obligation may be sentenced to imprisonment from one to two years.
5. Article 139 provides that the investigation and prosecution of offences concerning personal data are not subject to a complaint and that public prosecutors shall conduct investigations ex officio.
6. Article 140 refers to the security measures applicable to legal persons under Article 60 of the TPC. In particular, where offences are committed for the benefit of private-law legal persons, measures such as revocation of the authorization to conduct the relevant activity or confiscation may be imposed.

In light of these provisions, acts constituting offences under the KVKK essentially materialize in the unlawful recording, dissemination or transfer of personal data to third parties, or in the failure to delete such data. Investigations and prosecutions concerning these offences are not complaint-based; public prosecutors are required to act ex officio. These offences fall within the jurisdiction of the Criminal Courts of First Instance.

Article 18 of the KVKK regulates the part of unlawful conduct that constitutes a misdemeanour. These are violations that do not constitute crimes but are subject to administrative fines. Accordingly, where natural or legal persons acting as data controllers breach the obligations set out below, the Personal Data Protection Board (“Board”) may impose administrative fines within the limits prescribed by the KVKK. Administrative fines are increased each year according to the applicable revaluation rate.

1. Violation of the obligation to inform under Article 10: from TRY 85,437 to TRY 1,709,200;

2. Violation of obligations relating to data security under Article 12: from TRY 256,357 to TRY    17,092,242;

3. Failure to comply with decisions of the Board under Article 15: from TRY 427,263 to TRY 17,092,242;

4. Violation of the registration and notification obligation concerning the Data Controllers Registry

     (VERBIS) under Article 16: from TRY 341,809 to TRY 17,092,242;

5. Failure to comply with the notification obligation concerning standard contractual clauses in

     transfers of personal data abroad under Article 9/5: from TRY 90,308 to TRY 1,806,177.

Some Assessments Regarding Board Decisions:

The Board has issued various decisions concerning applications involving violations in different sectors. These decisions demonstrate the importance of the data security obligations set out particularly in Article 12 of the KVKK and clarify the administrative and technical measures that data controllers are expected to take.

•  Decision No. 2018/91 dated 26 July 2018:

It was determined that, during purchases made through the website of a ready-to-wear clothing company, personal data such as customers’ delivery addresses, names, surnames and contact details became accessible to other persons shopping through the same website. Following an application by the data subject, the Board concluded that the company had failed to take the necessary technical and administrative measures under Article 12 of the KVKK and imposed an administrative fine.

• Decision No. 2018/143 dated 5 December 2018:

The data subject applied to the Board alleging that information concerning medication used under a doctor’s supervision had been shared by the pharmacy from which the medication was obtained with a third party without any applicable processing condition. The Board determined that the conditions prescribed by law for the processing of special categories of personal data had not been satisfied and that the pharmacy had acted contrary to Article 12/4 of the KVKK. An administrative fine was imposed on the pharmacy.

• Decision No. 2017/62 dated 21 December 2017:

The Board emphasised that measures must be taken to prevent personal data from being seen, heard or learned by unauthorised persons during the provision of various services in banking, healthcare, postal and courier services, tourism, retail chains, subscription services and public institutions. Otherwise, data controllers may be held liable for administrative fines.

• Decision No. 2017/61 dated 21 December 2017:

In its assessment concerning websites and mobile applications that matched individuals’ names with telephone numbers without their explicit consent, the Board stated that such activities were contrary to the KVKK. It also determined that the unlawful acquisition of personal data constituted an offence under Article 136 of the TPC and decided to notify the Chief Public Prosecutor’s Office. 

V.  DEFINITION OF THE GDPR

The GDPR, adopted by the European Union and entering into force on 25 May 2018, is regarded as one of the strictest regulations at the international level in the field of data protection. As a regulation directly applicable within the continental European legal system, it not only protects the personal data of individuals within the European Union and the European Economic Area, but also imposes binding requirements where data relating to such individuals is processed by actors outside the EU.

The primary objective of the Regulation is to ensure that individuals have effective control over their personal data and that natural and legal persons processing data are subject to oversight on a common basis. In this respect, the GDPR both protects fundamental individual rights and ensures the secure circulation of data within the EU through common rules.

VI.  FUNDAMENTAL PRINCIPLES OF THE GDPR

• Geographical Scope:

The GDPR does not apply solely depending on whether the processing activity is actually carried out within the borders of the European Union (“EU”). Under certain conditions, it also applies to activities carried out by data controllers and processors established outside the EU.

Processing of personal data carried out in the context of the activities of an establishment of a controller or processor in the EU, as well as processing carried out in connection with the offering of goods or services to data subjects in the EU or the monitoring of their behaviour within the EU, fall within the scope of the GDPR.

• Lawfulness, Fairness and Transparency:

Personal data must be processed lawfully, fairly and transparently in relation to the data subject. The data controller must ensure that data subjects have clear and understandable information about the purposes for which their personal data is processed, the legal basis for processing and how the processing is carried out.

• Purpose Limitation:

Personal data must be collected for specified, explicit and legitimate purposes and must not subsequently be processed in a manner incompatible with those purposes. Accordingly, the data controller is required to use personal data only to the extent necessary for the specified processing purpose.

• Data Minimisation:

The processing of personal data must be limited to the data necessary for achieving the purposes of processing. Accordingly, collecting or processing more personal data than necessary is inconsistent with the GDPR’s principle of data minimisation.

• Sanctions for Non-Compliance :

Significant administrative fines are provided for data controllers and processors that fail to comply with the Regulation. These sanctions are intended to strengthen the deterrent effect of the GDPR.

• Accountability:

Under the GDPR, the data controller is required not only to comply with the fundamental principles concerning the processing of personal data, but also to demonstrate such compliance when necessary. Accordingly, the data controller must not only act in compliance with the legislation, but also establish policies, procedures and record-keeping mechanisms capable of demonstrating such compliance.

• Consent Requirement and Withdrawal:

Where explicit consent constitutes the legal basis for processing personal data, the consent must be freely given, specific to a particular subject matter and based on information provided to the data subject.

The data controller must be able to demonstrate that the data subject has given consent. The data subject has the right to withdraw consent at any time, and withdrawal must be as easy as giving consent.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

• Data Breach Notification Obligation:

In the event of a personal data security breach, the GDPR requires the data controller, under certain conditions, to notify the competent supervisory authority and, where necessary, the affected data subjects.

This provision aims to ensure not only the protection of personal data security but also the effective implementation of transparency and accountability.

• Right to Information:

Users have the right to learn what data is collected from them, for what purposes such data is collected and how long it will be stored.

• Rights of Access, Rectification and Updating:

Data subjects have the right to access their personal data and, where such data is inaccurate, to request its rectification or updating.

• Right to be Forgotten:
• Under the GDPR, individuals are granted the right to request the erasure of their personal data where certain conditions are met. This right is referred to as the “right to be forgotten.
• Right to Restriction of Processing:

Data subjects may request restriction of the processing of their personal data when the conditions specified under the GDPR are met. This right may apply, in particular, where the accuracy of the data is contested by the data subject, the processing is unlawful, or the data controller no longer needs the data but the data subject considers it necessary for the establishment, exercise or defence of a legal claim.

VII.  DIFFERENCES BETWEEN THE KVKK AND THE GDPR

A)     Difference in Scope:

One of the most significant differences between the KVKK and the GDPR concerns their territorial scope. The KVKK essentially regulates personal data processing activities carried out within the Republic of Türkiye. The Law covers the activities of data controllers established in Türkiye and may also apply to the activities of foreign companies processing personal data in Türkiye. However, the territorial scope of the KVKK is not as broad as that of the GDPR. Unlike Article 3 of the GDPR, the KVKK does not contain an explicit provision establishing extraterritorial effect.

For example, where an e-commerce company operating in Türkiye sells products to consumers in Germany or France, develops a mobile application targeting individuals in the EU, or analyses user behaviour through its website, it may fall within the scope of the GDPR. Therefore, the company may be required to comply with both the KVKK and the GDPR simultaneously.

On the other hand, the GDPR may require data controllers located outside the EU to appoint an EU Representative in certain circumstances. This representative is intended to facilitate communication with supervisory authorities and the exercise of data subjects’ rights. The KVKK does not provide for a mandatory EU representation system in the same sense as the GDPR. Instead, foreign data controllers may be required to designate a representative in Türkiye within the scope of their obligations to register with VERBIS.

B) Right to Be Forgotten:

The right to be forgotten regulated under Article 17 of the GDPR is a critical right enables individuals to exercise control over their past presence on digital platforms and among data processors. Under this right, a data subject may, where the relevant conditions are met, request the deletion of information, images, documents and other content relating to his or her past. As a reflection of this right, individuals may exercise legally grounded control over their past and remove their digital visibility. This is an essential aspect of data protection regulations in terms of protecting privacy and personality rights.

However, the KVKK does not expressly regulate the right to be forgotten. This may make information concerning a person’s past relatively easy to access in digital environments and may create significant privacy-related problems for individuals. Under Turkish law, it may be possible to delete criminal records when the relevant conditions are satisfied. Nevertheless, the absence of an express right to be forgotten in the KVKK may lead to disproportionate consequences concerning individuals’ digital past.

Although the right to be forgotten is not expressly defined in legislation, including the KVKK, the Court of Cassation has referred to this right in certain decisions based on the protection of fundamental rights and freedoms. Similarly, the Constitutional Court has, in a relevant dispute, decided to keep the identity of an individual confidential based on the protection of the person’s honour and dignity.

C) Differences in Sanctions:

The differences between the regulations are reflected not only in their substantive content but also in the sanctions arising from non-compliance. From this perspective, the most significant difference concerns the deterrent effect of the penalties and the upper limits of administrative fines.

Under the KVKK, sanctions primarily consist of administrative fines imposed by the Personal Data Protection Board. These sanctions, regulated under Article 18 of Law No. 6698, apply to acts such as violations of the obligation to inform, failure to fulfil data security obligations, failure to comply with Board decisions and violations of the obligation to register with VERBIS.

The Personal Data Protection Authority updated the administrative fines under the KVKK effective as of 1 January 2026, representing a 25.49% increase compared with the previous period. Depending on the nature of the violation, administrative fines range from TRY 85,437 to TRY 17,092,242. In addition, certain acts do not merely result in administrative sanctions but may also constitute crimes under Articles 135–140 of the TPC. Although these amounts establish a certain supervision and regulatory mechanism at the national level, they may be insufficiently deterrent, particularly for large-scale or internationally operating companies.

By contrast, the GDPR provides for a much more comprehensive and effective sanction mechanism. Pursuant to Article 83 of the GDPR, a two-tier administrative fine system applies depending on the nature of the violation. Less serious violations, such as failure to comply with rules concerning certification or the appointment of a Data Protection Officer (“DPO”), may result in administrative fines of up to EUR 10 million or up to 2% of the undertaking’s total worldwide annual turnover for the preceding financial year.

Where more serious violations, such as non-compliance with consent rules, breaches of data security and violations of data subjects’ rights, administrative fines of up to EUR 20 million or up to 4% of the undertaking’s total worldwide annual turnover may be imposed. The higher of the two amounts is applied. 

When determining the amount of a fine under the GDPR, supervisory authorities consider not only the occurrence of the infringement but also factors such as its duration, the number of affected individuals, the category of data concerned, the degree of fault of the company, the technical and administrative measures adopted, whether the infringement was intentional and whether similar previous infringements exist. These figures have a highly deterrent effect not only on a local scale but also for organizations operating internationally.

These significant differences in sanctions lead data processors and controllers operating under the GDPR to act with much greater caution. High fines prevent the Regulation from remaining merely theoretical and encourage the effective implementation of data protection policies. On the other hand, data controllers providing services in Türkiye may also be required to comply with both regulations when processing the data of persons residing within the EU.

D) Explicit Consent:

Under the KVKK, explicit consent is consent relating to a specific subject, based on information and freely given by the data subject. The GDPR, in addition to these elements, specifically requires consent to be demonstrated by a clear affirmative action indicating the data subject’s agreement to the processing of his or her personal data, namely an unambiguous expression of will. Such unambiguous affirmative actions may include clicking an “I agree” button, actively ticking a consent box or providing an electronic signature. Furthermore, under Article 7(4) of the GDPR, where the performance of a contract or the provision of a service is made conditional upon consent to the processing of personal data that is not necessary for the performance of that contract or service, this must be taken into particular account when assessing whether consent has been freely given. The KVKK does not contain a directly corresponding provision stating that consent may not be made a precondition for a service. However, in the decisions of the Board, such practices are assessed in terms of the principle of good faith and the requirement of “free will” under Article 3.

E) Data Breaches:

Article 12/5 of the KVKK provides that, where processed personal data are unlawfully obtained by others that, where processed personal data were unlawfully obtained by others, the data controller should notify the data subject and the Board “as soon as possible”. This wording differed from the GDPR’s obligation to notify the supervisory authority without undue delay and, where applicable, no later than 72 hours after becoming aware of the breach. However, in its Decision No. 2019/10 dated 24 January 2019, the Board interpreted the expression “as soon as possible” as 72 hours in order to avoid inconsistency with the GDPR. The Board also decided that the data controller should notify the Board without undue delay from the date on which it became aware of the breach, identify the persons affected by the breach, and notify the relevant data subjects within the shortest reasonable period through appropriate methods, such as direct notification where the contact details of the data subject are available or publication on the data controller’s website where direct notification is not possible. Where the data controller cannot notify the Board within 72 hours for a justified reason, the reasons for the delay should be explained to the Board together with the notification. In this respect, alignment between the Regulation and the Law has been established.

Another issue concerns whether data subjects must themselves be notified. Under the KVKK, as a mandatory requirement of the Law, notification of both the Board and the relevant data subject as soon as possible is envisaged in the event of a breach. The GDPR, however, establishes a higher threshold for notifying data subjects: the breach must be likely to result in a high risk to the rights and freedoms of individuals. In addition, under the GDPR, the obligation to notify data subjects does not arise where, for example, the data had been encrypted in advance and remain unintelligible to unauthorised persons, appropriate subsequent measures have eliminated the high risk, or individual notification would involve disproportionate effort, in which case a public communication may be sufficient.

F) Data Protection Officers (DPO – Data Protection Officer):

Under the GDPR, a data controller or data processor is required to appoint a DPO where any of the following circumstances exists:

a) The processing is carried out by a public authority or body, except for courts acting in their judicial capacity.

b) The core activities of the data controller or processor consist of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale.

c) The core activities of the data controller or processor consist of large-scale processing of special categories of personal data or personal data relating to criminal convictions and offences.

The KVKK does not establish a position equivalent to a DPO. Instead, it provides for a “contact person” within the scope of VERBIS (Data Controllers Registry Information System). The contact person is not a supervisory or advisory body; rather, he or she acts as a bridge for communication between the Authority and the data controller, is directly subject to the company’s internal administrative hierarchy and is not independent. The primary duties of the contact person are to carry out transactions on behalf of the data controller through VERBIS and to forward notifications received from the Authority to the data controller. The DPO, on the other hand, has a broader and more detailed range of responsibilities, including informing and advising the data controller and employees on compliance, monitoring compliance with the GDPR and internal policies, providing opinions in Data Protection Impact Assessment (DPIA) processes and following up on such processes.

G) Transfer of Data Abroad:

The transfer of personal data abroad is one of the most critical and highly regulated issues under both the KVKK and the GDPR. Although the amendment made to the KVKK in 2024 brought the Turkish data transfer regime largely into alignment with the GDPR, differences between the regulations remain. The GDPR adopts a three-tier mechanism for transfers of personal data outside the EU:

1. Adequacy decision: This is the primary and preferred mechanism. The European Commission conducts a comprehensive assessment of the legal framework, human rights standards and independence of the data protection authority of the third country to which the data will be transferred and issues an adequacy decision. Adequacy decisions have been adopted for countries including the United Kingdom, Japan, the United States, Switzerland and South Korea.

2. Appropriate safeguards: These apply where there is no adequacy decision. SCCs (Standard Contractual Clauses) are contractual clauses pre-approved by the European Commission. The parties transferring and receiving the data sign these clauses without modifying them. Where the parties use SCCs, they do not need to obtain separate approval from EU data protection authorities.

3. Explicit consent: This is not a general transfer mechanism and may only be used on a limited basis in exceptional circumstances.

The KVKK has introduced a similar graduated system. Adequacy decisions are issued by the Personal Data Protection Board, which assesses the legislation of the relevant country, international agreements and the existence of data protection authorities. Where no adequacy decision is issued, standard contractual clauses published by the Board may be used; however, the standard contractual clauses must be notified to the Personal Data Protection Authority within five business days of their execution. In the absence of an adequacy decision, a transfer may be carried out by providing one of the appropriate safeguards prescribed by the Law. These safeguards include standard contractual clauses published by the Board, binding corporate rules and other safeguard mechanisms provided for under the Law. In the case of standard contractual clauses, notification to the Authority must additionally be made within five business days of execution.

VIII.  CONCLUSION

In this context although the KVKK and GDPR are substantially aligned in terms of their fundamental objectives and principles, the GDPR provides a more comprehensive framework particularly with regard to accountability, the effective exercise of data subject rights, the institutionalization of data protection compliance and sanctions. Nevertheless following the amendments made to the KVKK’s international data transfer regime in 2024, Turkish data protection law has moved significantly closer to the GDPR. Accordingly it is important to continue the alignment process between the KVKK and the GDPR while conducting this process in accordance with the needs of Turkish law and the structure of national legislation, in order to strengthen the effective protection of personal data and ensure that Türkiye has a predictable and reliable legal framework for international data transfers.