GDPR (General Data Protection Regulation)

The GDPR (General Data Protection Regulation) is the EU’s General Data Protection Regulation, applicable since 25 May 2018. It is the current core instrument of the European data protection tradition that also inspired the KVKK.

When Does It Apply to Turkish Companies?

The GDPR does not apply only to companies established in the EU. A non-EU company is also subject to the GDPR in two cases:

• It offers goods or services to individuals in the EU (whether or not payment is required),
• It monitors the behaviour of individuals in the EU taking place within the EU, for example by tracking website visitors for profiling or behavioural advertising.

An e-commerce site selling to Europe, a software company serving European users or an app tracking visitors in the EU may fall within scope. Companies with no establishment in the EU but subject to the GDPR must as a rule appoint a representative in the EU.

Sanctions

Breaches of the GDPR are subject to administrative fines of up to EUR 20 million or four per cent of total worldwide annual turnover in the preceding financial year, whichever is higher. Fines are imposed by the supervisory authority of the relevant EU country.

Key Differences from the KVKK

• Legal bases: The relationship between explicit consent and other legal bases, and the use of legitimate interest, are regulated differently in the GDPR.
• Right to object: The GDPR grants a general right to object to processing based on legitimate interest; the KVKK has no such general right.
• Data protection officer: The GDPR requires a data protection officer in certain cases; the KVKK has no such requirement.
• Breach notification: Both set a 72-hour deadline, but the GDPR exempts breaches unlikely to result in risk.
• Registration: The KVKK has VERBİS registration; the GDPR requires internal records of processing activities rather than a central registry.
• Profiling: The GDPR has a stricter regime for decisions based solely on automated processing.

Transfers from the EU to Turkey

Since there is no European Commission adequacy decision for Turkey, an EU customer or group company sending data to Turkey usually relies on the Commission’s standard contractual clauses. For transfers from Turkey to the EU, the KVKK’s own standard contractual clauses are used; the two sets of clauses do not replace each other.