# KVKK enforcement of data protection regulations

> Live situation record from CLSTR: https://clstr.news/situations/kvkk-enforcement-of-data-protection-regulations
> Updated: 2026-09-05T09:57:52.000Z. Sources: 11. Developments: 3.

The Turkish Personal Data Protection Authority (KVKK) has issued significant administrative fines against different sectors for violations of data protection regulations.

In August 2026, the KVKK fined an online sports and gambling platform 250,000 TL. The penalty was issued after an investigation found the platform made live match broadcasts conditional upon users providing explicit consent for commercial electronic communications. The Board ruled this practice violated the principle that consent must be given of ‘free will’.

In September 2026, the authority imposed a total fine of 1 million TL on a company in the food service sector following a data breach affecting 505,337 customers. The breach occurred when attackers used malware to capture credentials from an employee’s browser to access internal systems. The KVKK issued an 800,000 TL fine for inadequate technical and administrative security measures and a 200,000 TL fine for failing to notify affected individuals in a timely manner. The authority noted the breach carried a ‘high probability of causing negative impacts’ on those affected.

Later in September 2026, the KVKK imposed a 90,000 TL fine on an internet service provider regarding in-flight Wi-Fi access. Following a passenger complaint, the authority determined the provider was responsible for data processing practices that made Wi-Fi access conditional upon explicit consent. The KVKK ruled this practice unlawful under Law No. 6698, stating it violated the principles of ‘lawfulness and honesty’ and noting that other legal grounds for data processing exist beyond explicit consent.

## Timeline

### 2026-09-05: KVKK fines internet provider over in-flight data consent

Turkey's KVKK fined an internet service provider 90,000 TL for forcing passengers to give explicit consent for personal data processing to access in-flight Wi-Fi.

4 sources. https://clstr.news/cluster/kvkk-fines-internet-provider-over-in-flight-data-consent

### 2026-09-03: KVKK fines food sector company 1 million TL after data breach

Turkey's KVKK fined a food service company 1 million TL after a cyberattack compromised the personal data of over 505,000 customers through malware and stolen credentials.

6 sources. https://clstr.news/cluster/kvkk-fines-food-sector-company-1-million-tl-after-data-breach

### 2026-08-26: KVKK fines sports platform 250,000 TL over data consent

Turkey's KVKK fined a sports platform 250,000 TL for conditioning live match broadcasts on users providing explicit consent for commercial electronic communications.

2 sources. https://clstr.news/cluster/kvkk-fines-sports-platform-250000-tl-over-data-consent

---
Cite as: KVKK enforcement of data protection regulations. CLSTR, https://clstr.news/situations/kvkk-enforcement-of-data-protection-regulations