Legal Bases for Processing Personal Data

Also known as: Processing Conditions, Lawful Bases, Kişisel Veri İşleme Şartları

In short

The legal grounds listed in Article 5 of the KVKK, at least one of which must be present for a personal data processing activity to be lawful.

Under the KVKK, personal data may as a rule not be processed without the data subject’s explicit consent; however, Article 5(2) lists the cases where data may be processed without consent. In practice, most of a company’s processing relies on one of these conditions rather than on consent.

The Conditions

Express provision by law: For example, tax legislation requiring certain information on invoices.
Physical impossibility: Processing necessary to protect the life or physical integrity of a person unable to give consent.
Conclusion or performance of a contract: Processing the data of the parties to a contract where necessary for its conclusion or performance, for example using a delivery address for shipping.
Legal obligation: Processing necessary for the controller to comply with a legal obligation, for example notifying employee details to the social security institution.
Data made public: Processing data made public by the data subject, limited to the purpose of publication.
Establishment, exercise or protection of a right: For example, using data as evidence in litigation.
Legitimate interest: Processing necessary for the controller’s legitimate interests, provided it does not harm the data subject’s fundamental rights and freedoms.

Choosing the Right Basis

The basis must be determined before processing begins, separately for each purpose. The chosen basis is stated as the legal ground in the privacy notice and recorded in the personal data inventory. Changing the basis later is possible, but trying to rely on another condition when consent is withdrawn for processing presented as consent-based may be found misleading and contrary to good faith.

Having a basis is not enough on its own. Processing must also comply with the general principles in Article 4 of the KVKK: it must be relevant, limited and proportionate to its purpose, and data must not be kept longer than necessary. For special categories of personal data, the separate and narrower conditions in Article 6 apply.

Frequently Asked Questions

Can one processing activity rely on more than one basis?

Yes, but the most appropriate basis should be identified for each activity and stated correctly in the privacy notice. Requesting consent where another basis applies is not recommended, as it misleads the individual.

Do the same bases apply to special categories of data?

No. Special categories are subject to the narrower conditions in Article 6 of the KVKK; legitimate interest is not among them.

← Glossary A–Z