KVKK Compliance Guide (Turkey)
opt-in — explicit consent required for sensitive personal data. Use compliance: { type: 'opt-in' } in your ConsentiSetup config.Turkey's Kişisel Verilerin Korunması Kanunu (KVKK) — Law No. 6698 — came into force in April 2016 and is enforced by the Kişisel Verileri Koruma Kurumu (KVK Board / KVKK Authority). It is inspired by the EU GDPR's predecessor (Directive 95/46/EC) and has been progressively updated to align with modern GDPR requirements. Consenti supports KVKK via regulation: 'kvkk'.
Official references
Key requirements
| Requirement | Detail |
|---|---|
| Compliance Group | Opt-in — informed, related to a specific matter, based on free will |
| Sensitive data | Explicit consent required (race, ethnicity, political opinion, religion, sect, health, sexual life, criminal record, biometrics, security measures) |
| Blanket consent | Not valid — consent must be specific per purpose |
| Withdrawal | Must be possible at any time; equivalent mechanism to giving consent |
| VERBİS registration | Data controllers above certain size thresholds must register in the data controller registry |
| Cross-border transfer | Requires either data subject consent or KVK Board authorisation (or country adequacy) |
| Enforcer | KVK Board (Kişisel Verileri Koruma Kurumu) |
KVKK vs. GDPR
| GDPR | KVKK | |
|---|---|---|
| Opt-in required | Yes | Yes |
| Lawful bases | 6 (Art. 6) | Similar list in Art. 5–6; consent is primary |
| Sensitive data | Art. 9 special categories | Art. 6 — broader list including security measures |
| DPO equivalent | DPO (mandatory for some) | No mandatory DPO requirement |
| Registry | No mandatory controller registry | VERBİS — mandatory for qualifying controllers |
| GPC | Optional | Not recognised |
Enabling KVKK mode
Frontend widget
new ConsentiSetup({
compliance: { type: 'opt-in' },
})Profile configuration (dashboard)
{
"regulation": "kvkk"
}Unlike DPDPA (which has a dedicated dpdpa profile block rendered automatically), KVKK has no dedicated metadata field yet. Turkish law requires the data controller's identity and contact information to be disclosed — add it directly to preferenceModal.htmlText (or mainBanner.htmlText) via profileOverride or the dashboard's text editor.
What Consenti does — and what it doesn't
Everything above is the consent-collection UX layer: opt-in capture, per-category records, withdrawal, and erasure. KVKK imposes registry and transfer obligations beyond what a consent widget can satisfy on its own. Consenti does not:
- Complete VERBİS (Data Controllers' Registry) registration — that's an administrative filing with the KVK Board you complete outside the product, if your organisation meets the qualifying size/processing thresholds
- Obtain KVK Board authorisation for a cross-border transfer that lacks an adequacy decision or explicit data-subject consent — that's a legal/administrative step, not a widget config
- Guarantee data localisation for data subject to Turkey-specific storage expectations — self-hosting
@consenti/apimeans you control where it runs, not that it runs in Turkey - Author sector-specific written consent forms some KVK Board guidance requires beyond cookie consent — Consenti covers the cookie/tracking consent surface, not every KVKK consent touchpoint your organisation may have
Operator checklist
Beyond configuring Consenti's opt-in consent group, an operator with KVKK exposure still needs to:
- Register in VERBİS if your organisation meets the KVK Board's size/processing thresholds, and keep that registration current
- Confirm the cross-border transfer legal basis (consent, KVK Board authorisation, or adequacy) before routing data to non-Turkey infrastructure
- Keep the data controller's identity and contact information current in
preferenceModal.htmlTextormainBanner.htmlText, as required by Turkish law - Configure each cookie category with a genuinely distinct, specific purpose — KVKK does not recognise blanket consent, so the underlying per-category records need to reflect real purpose granularity even if your banner offers an "accept all" shortcut
Erasure
KVKK Article 7 grants data subjects the right to request deletion. Use:
DELETE /consenti/api/v1/consent/:visitorIdFor the widget-side "Forget me" button and the events both sides fire, see the Right to Erasure guide.