[REVISION HISTORY]

KVKK enforcement of data protection regulations

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-09-03 11:10 UTC → 2026-09-06 07:51 UTC · added ~~removed~~

The Turkish Personal Data Protection Authority (KVKK) has issued significant administrative fines against different sectors for violations of data protection regulations. In August 2026, the KVKK fined an online sports and gambling platform 250,000 TL. The penalty was issued after an investigation found the platform made live match broadcasts conditional upon users providing explicit consent for commercial electronic communications. The Board ruled this practice violated the principle that consent must be given of ‘free will’. In September 2026, the authority imposed a total fine of 1 million TL on a company in the food service sector following a data breach affecting 505,337 customers. The breach occurred when attackers used malware to capture credentials from an employee’s browser to access internal systems. The KVKK issued an 800,000 TL fine for inadequate technical and administrative security measures and a 200,000 TL fine for failing to notify affected individuals in a timely manner. The authority noted the breach carried a ‘high probability of causing negative impacts’ on those affected. Later in September 2026, the KVKK imposed a 90,000 TL fine on an internet service provider regarding in-flight Wi-Fi access. Following a passenger complaint, the authority determined the provider was responsible for data processing practices that made Wi-Fi access conditional upon explicit consent. The KVKK ruled this practice unlawful under Law No. 6698, stating it violated the principles of ‘lawfulness and honesty’ and noting that other legal grounds for data processing exist beyond explicit consent.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.