KVKK Administrative Fines 2026: Current Amounts in Turkey

Article 18 of Law No. 6698 on the Protection of Personal Data (KVKK) sets administrative fines with minimum and maximum limits for five types of breach. Under Article 17(7) of the Misdemeanours Law, these amounts are increased at the start of each year by the revaluation rate announced under the Tax Procedure Law. The rate for 2026 is 25.49% (Tax Procedure Law General Communiqué No. 585, Official Gazette of 27 November 2025). The amounts below apply to breaches committed between 1 January and 31 December 2026.

KVKK Administrative Fines for 2026

Breach	Legal basis	Minimum	Maximum
Failure to fulfil the duty to inform	Art. 18(1)(a) (Art. 10)	TRY 85,437	TRY 1,709,200
Failure to fulfil data security obligations	Art. 18(1)(b) (Art. 12)	TRY 256,357	TRY 17,092,242
Failure to comply with Board decisions	Art. 18(1)(c) (Art. 15)	TRY 427,263	TRY 17,092,242
Breach of the VERBİS registration and notification obligation	Art. 18(1)(ç) (Art. 16)	TRY 341,809	TRY 17,092,242
Failure to notify standard contractual clauses to the Authority within 5 business days	Art. 18(1)(d) (Art. 9(5))	TRY 90,308	TRY 1,806,177

The amounts are calculated by increasing the base amounts in the Law by each year’s revaluation rate and, as the Misdemeanours Law requires, disregarding fractions of a lira. The fine for failing to notify standard contractual clauses was introduced by Law No. 7499 with effect from 1 June 2024, so it was increased for the first time in 2025.

KVKK Fines in Previous Years

Minimum and maximum limits for earlier years, useful for determining the amount applicable to the breach date or assessing an older decision:

Year	Type	Duty to inform	Data security	Board decisions	VERBİS	SCC notification
2026	Minimum	85,437	256,357	427,263	341,809	90,308
	Maximum	1,709,200	17,092,242	17,092,242	17,092,242	1,806,177
2025	Minimum	68,083	204,285	340,476	272,380	71,965
	Maximum	1,362,021	13,620,402	13,620,402	13,620,402	1,439,300
2024	Minimum	47,303	141,934	236,557	189,245	50,000
	Maximum	946,308	9,463,213	9,463,213	9,463,213	1,000,000
2023	Minimum	29,852	89,571	149,285	119,428	–
	Maximum	597,191	5,971,989	5,971,989	5,971,989	–
2022	Minimum	13,391	40,179	66,965	53,572	–
	Maximum	267,883	2,678,863	2,678,863	2,678,863	–

Amounts are in Turkish lira. The SCC notification fine did not exist before 1 June 2024.

Which Year’s Amount Applies?

Under the Misdemeanours Law, a misdemeanour is committed when the act takes place, and the rules in force at that time apply. A fine imposed in 2026 for a data breach that occurred in 2025 is therefore, as a rule, based on the 2025 amounts.

Continuing breaches are different. Where a company has never prepared a privacy notice, has never registered with VERBİS or has kept inadequate security measures in place for a long time, the current year’s amounts may apply as long as the breach continues. Remedying an old breach limits both future risk and the debate about the applicable amount.

How Does the Board Set the Amount?

For fines with a minimum and maximum, Article 17(2) of the Misdemeanours Law requires the seriousness of the breach, the degree of fault and the economic situation of the offender to be considered together. Factors that stand out in Board decisions include:

• The number of people affected and the nature of the data, in particular whether special categories of personal data are involved
• How long the breach lasted and whether it was repeated
• Whether a personal data breach was notified to the Board and to data subjects on time
• Cooperation with the Authority during the investigation and the measures taken to remedy the breach
• The size and economic situation of the data controller

Several breaches can be found in the same investigation. In a data breach case, for example, separate fines may be imposed for inadequate security measures and for breach of the duty to inform.

Who Is Fined?

Fines for the duty to inform, data security, Board decisions and VERBİS are imposed on the data controller. The fine for failing to notify standard contractual clauses may be imposed on the data controller or the data processor, depending on who made the transfer. Fines apply to individuals and private-law legal entities. Public bodies are not fined; instead, disciplinary rules apply to the officials concerned upon notification by the Board.

Administrative fines are separate from data-related criminal offences. Unlawfully recording, disclosing or obtaining personal data may also constitute a criminal offence under the Turkish Criminal Code.

Payment and Early-Payment Discount

Where the relevant law sets no payment period, an administrative fine must be paid within one month of notification. Paying within this period earns a 25% discount. Payment does not affect the right to challenge the decision; companies often take the discount and pursue the lawsuit separately.

Challenging a Fine: Administrative Courts

Following the amendment made by Law No. 7499, since 1 June 2024 fines imposed by the Board are challenged by an annulment action before the administrative courts. The general deadline is 60 days from notification of the decision. For fines imposed before that date, the competent forum was the criminal judgeship of peace, with a 15-day deadline. See challenging administrative fines for details.

Areas with the Highest Fine Risk

The breaches most frequently seen in Board decisions are:

• No privacy notice, or a privacy notice combined with the explicit consent text
• Data security gaps such as inadequate access authorisation and missing logs
• Failure to notify a data breach to the Board within 72 hours; see our guide Personal Data Breach: The First 72 Hours
• Failure to register with VERBİS or to keep the registration up to date
• Failure to notify standard contractual clauses for cross-border data transfers

What Will the Amounts Be in 2027?

The 2027 amounts will be set by the revaluation rate to be announced for 2026. The rate is published at the end of November each year by a Tax Procedure Law General Communiqué. This page will be updated once the rate is announced.