Data Protection and Privacy Rules in the Turkish Telecom Sector

Introduction

Data protection and privacy rules in the Turkish telecom sector are among the most important compliance areas for telecom operators, internet service providers, mobile network operators, fixed-line providers, satellite communication companies, virtual mobile network operators, data transmission service providers, hosting providers, and digital communication platforms operating in Turkey.

The telecommunications sector processes some of the most sensitive categories of user-related information in modern commercial life. Telecom operators may process subscriber identity data, phone numbers, addresses, IP addresses, IMEI numbers, SIM card information, billing records, payment details, call detail records, traffic data, location data, customer service recordings, device information, technical logs, marketing preferences, and complaint records. These data can reveal not only who a person is, but also where they are, when they communicate, which services they use, and how they behave online.

For this reason, privacy protection in the Turkish telecom sector is not merely an administrative formality. It is a core legal obligation arising from the Turkish Constitution, Law No. 6698 on the Protection of Personal Data, Law No. 5809 on Electronic Communications, BTK regulations, sector-specific confidentiality rules, cybersecurity obligations, consumer protection principles, and general principles of contract and tort law.

The Information and Communication Technologies Authority, known in Turkish as Bilgi Teknolojileri ve İletişim Kurumu or BTK, is the main regulatory authority supervising the Turkish telecommunications sector. BTK describes itself as the institution that regulates and supervises the telecommunications sector in Turkey and as Turkey’s first sectoral regulatory authority.

The Personal Data Protection Authority, known as KVKK, is also a key authority because telecom companies act as data controllers or data processors in relation to many personal data processing activities. Therefore, telecom operators in Turkey must comply with both general data protection law and sector-specific telecom privacy rules.

Legal Framework for Data Protection in the Turkish Telecom Sector

The main data protection legislation in Turkey is Law No. 6698 on the Protection of Personal Data, commonly referred to as KVKK. Article 4 of the law sets out the general principles of personal data processing, including lawfulness and fairness, accuracy and being kept up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate to the purposes of processing, and retention only for the period required by law or by the processing purpose.

In the telecommunications sector, KVKK is supplemented by Law No. 5809 on Electronic Communications and BTK’s secondary regulations. Law No. 5809 gives BTK authority to regulate subscriber, user, consumer and end-user rights, as well as the processing of personal information and protection of confidentiality in the electronic communications sector.

The most important sector-specific regulation is the Regulation on the Processing of Personal Data and Protection of Confidentiality in the Electronic Communications Sector. The stated purpose of this regulation is to determine the procedures and principles for processing personal data and protecting confidentiality in the electronic communications sector in order to protect privacy and fundamental rights and freedoms.

This regulation was published in the Official Gazette dated 4 December 2020 and numbered 31324. It introduced sector-specific rules on security measures, breach notification, explicit consent, traffic and location data, cross-border transfers, number display, automatic call forwarding, and other privacy-related telecom issues.

Therefore, telecom operators in Turkey cannot rely only on a general KVKK privacy notice. They must also comply with the special requirements imposed by BTK for the electronic communications sector.

Why Telecom Data Is Highly Sensitive

Telecom data is different from ordinary customer data because it is closely connected to private life, communication freedom, location, habits, social relations, and digital identity. A retail company may process a customer’s name and purchase history, but a telecom operator may process information showing when a person connected to the internet, which IP address was assigned, which base station was used, where a mobile device was located, which number was called, how long the call lasted, and which billing pattern was created.

This does not mean that every telecom dataset is automatically “special category personal data” under KVKK. However, telecom data can be highly intrusive because it allows detailed profiling when combined with other information. Traffic and location data may reveal work routines, home location, travel patterns, religious places visited, medical visits, political meetings, social relationships, and personal habits.

For this reason, telecom privacy compliance should be built on a higher standard of care. Operators should treat subscriber data, traffic data, and location data as high-risk data categories even when they are not legally classified as special category personal data.

Subscriber Data in the Turkish Telecom Sector

Subscriber data includes information collected during the establishment and performance of a telecom service agreement. This may include name, surname, Turkish identity number, passport number, tax number for corporate customers, address, phone number, e-mail address, subscription number, customer number, SIM card information, device information, billing address, payment method, contract documents, identity verification records, and customer service records.

Processing subscriber data is usually necessary for establishing and performing the subscription agreement. However, necessity does not mean unlimited processing. The operator must process only the data required for lawful and legitimate purposes. The data must be accurate, updated where necessary, securely stored, and deleted or anonymized when the legal retention period expires.

For example, a telecom operator may need identity information to activate a mobile line and prevent fraudulent subscriptions. However, the same operator should not use identity documents for unrelated marketing or profiling purposes unless a separate legal basis exists.

Operators should also be careful with dealer and reseller networks. Many privacy violations occur not at headquarters but through sales points, call centers, field teams, subcontractors, or customer representatives. Unauthorized SIM card activation, identity document misuse, incorrect subscriber matching, or disclosure of customer information by dealers may create serious legal liability.

Traffic Data and Communication Metadata

Traffic data is one of the most important privacy topics in the telecom sector. It may include data generated during the transmission of communication, such as calling number, called number, call duration, connection time, IP allocation records, internet session logs, routing data, SMS metadata, base station connection information, and other technical data required for communication.

Traffic data is not the same as communication content. However, metadata can still be highly sensitive. Knowing who communicated with whom, when, for how long, and from where may reveal significant information about a person’s private life.

Under the sector-specific regulation, operators must comply with special rules on traffic and location data, explicit consent, security, and confidentiality. Legal commentary on the regulation emphasizes that it covers traffic and location data and requires clear information before obtaining consent for processing.

Telecom operators should ensure that traffic data is accessed only by authorized personnel and only for legitimate purposes such as service provision, billing, network security, fraud prevention, technical troubleshooting, legal retention, or compliance with lawful official requests.

Operators should also maintain access logs. Sector commentary notes that operators must take technical and administrative measures and keep transaction records concerning access to personal data and related systems for two years.

Location Data and Privacy Risks

Location data is especially sensitive in mobile communications. It may be generated through base station connections, GPS-based services, Wi-Fi networks, mobile applications, SIM activity, emergency service systems, or value-added location-based services.

Location data may show where a person lives, works, travels, meets others, receives medical treatment, worships, shops, or spends time. Because of this, location data requires strict legal and technical controls.

Operators should distinguish between location data required for the technical provision of the service and location data processed for additional commercial purposes. For example, processing location information to route a mobile communication signal may be technically necessary. However, using location data for targeted advertising, analytics, customer segmentation, or third-party services generally requires a separate legal assessment and, in many cases, explicit consent.

Before obtaining explicit consent, the subscriber or user should be clearly informed about the type of data, the scope of processing, the purpose of processing, and the processing period. The information should be understandable and specific. Vague language such as “your data may be used to improve services” is usually insufficient for high-risk processing.

Explicit Consent in Telecom Data Processing

Explicit consent plays an important role in telecom privacy law, but it should not be misunderstood. Under Turkish data protection law, explicit consent is not the only legal basis for processing personal data. Some processing activities may rely on legal obligation, contract performance, legitimate interest, establishment or protection of a right, or other lawful grounds under KVKK.

However, explicit consent is often required where telecom data is processed for purposes beyond the core service, such as marketing, profiling, location-based advertising, personalized offers, third-party sharing, or certain value-added services.

The sector-specific regulation includes detailed rules on explicit consent. Legal commentary explains that before obtaining consent, the subscriber or user should be informed clearly about the type of personal data to be processed, the types of traffic and location data, the scope, the purpose of processing, and the processing period.

Consent must be freely given. Operators should not make unnecessary data processing a condition of receiving the main telecom service. For example, a mobile operator should not require a subscriber to consent to marketing profiling as a condition for obtaining basic mobile service. Consent should also be withdrawable, and withdrawal should be as easy as giving consent.

A compliant consent mechanism should include separate options for separate processing purposes. Marketing consent, location-based service consent, third-party sharing consent, and personalized advertisement consent should not be bundled into a single vague approval.

Obligation to Inform Subscribers and Users

The obligation to inform is one of the central principles of Turkish data protection law. Telecom operators must inform subscribers and users about how their personal data is processed. The information should include the identity of the data controller, purposes of processing, recipients or recipient categories, method and legal basis of collection, and data subject rights.

The KVKK Communiqué on the obligation to inform states that processing purposes must be specified, explicit and legitimate, and that general or ambiguous statements should be avoided. It also requires the notice to be delivered in intelligible, clear and plain language.

This rule is particularly important in telecom services because privacy notices are often long, technical, and difficult for consumers to understand. Operators should prepare layered notices. A short first-layer notice may explain the key points, while a detailed privacy policy may provide full legal information.

The privacy notice should not be hidden inside a long subscription agreement. It should be accessible before or at the time of data collection. For online subscriptions, mobile applications, call center sales, dealer sales, and digital onboarding, the operator should be able to prove that the subscriber was properly informed.

Data Security Obligations of Telecom Operators

Telecom operators must take technical and administrative measures to protect personal data. Data security in the telecom sector includes preventing unauthorized access, unlawful disclosure, accidental loss, destruction, alteration, data leakage, insider misuse, cyberattack, incorrect data matching, and unauthorized system access.

The sector-specific regulation imposes requirements for personal data security, data breach notification, explicit consent, traffic and location data, and confidentiality. BTK also has sectoral network and information security responsibilities. BTK’s Sectoral Cyber Incident Response Team page states that operators are subject to obligations under the Network and Information Security Regulation in the Electronic Communications Sector.

A telecom operator’s security framework should include:

Role-based access control.

Multi-factor authentication for sensitive systems.

Encryption of sensitive data.

Logging and monitoring of access to customer data.

Segregation of duties between departments.

Secure identity verification procedures.

Dealer and subcontractor controls.

Secure software development.

Regular vulnerability scanning and penetration testing.

Incident response planning.

Data breach notification procedures.

Employee confidentiality undertakings.

Regular privacy and security training.

Access to subscriber data should be limited according to business need. A call center employee should not be able to view all traffic data unless necessary. A dealer should not have access to full subscriber history. A technical team should see only the data required for troubleshooting.

Data Breach Notification in the Telecom Sector

Data breaches in the telecom sector may involve leaked subscriber databases, unauthorized SIM activation, exposure of invoices, incorrect e-mail delivery, unauthorized access to call records, compromised dealer systems, customer portal vulnerabilities, cyberattacks, or loss of log records.

Under Turkish data protection law, data controllers must notify the Personal Data Protection Authority in case of a personal data breach according to the applicable procedure. In the telecom sector, breach notification may also involve BTK depending on the nature of the incident and applicable sectoral rules. Sectoral legal commentary explains that the BTK regulation includes specific requirements on notifying security risks and data breaches.

A telecom operator should therefore maintain a written breach response plan. The plan should identify who will assess the incident, who will notify authorities, who will communicate with subscribers, who will preserve evidence, who will handle technical containment, and how legal risk will be managed.

The operator should not delay breach assessment. In privacy incidents, the first hours are critical. The company must determine the affected systems, type of data, number of subscribers, cause of breach, containment measures, legal notification obligations, and potential subscriber impact.

Cross-Border Transfer of Telecom Data

Telecom operators may transfer personal data abroad in many situations. Examples include cloud hosting, foreign parent company access, international technical support, global CRM systems, roaming partners, international payment systems, cybersecurity vendors, and foreign analytics tools.

Cross-border transfer of personal data under Turkish law requires careful analysis. KVKK announced that Article 9 of Law No. 6698 on transfer of personal data abroad was amended by Article 34 of Law No. 7499, and the Authority published translated materials on the procedures and principles for cross-border transfers and standard contract texts.

For telecom companies, cross-border transfer is particularly sensitive because subscriber data, traffic data, location data, or technical logs may be high-risk. The operator should identify all foreign transfers, assess transfer mechanisms, review vendor contracts, evaluate data localization or minimization options, and ensure compliance with KVKK requirements.

A telecom company should not allow foreign group companies or vendors to access Turkish subscriber data merely because they are part of the same corporate group. Group company access is still a data transfer and requires a lawful basis.

Data Retention, Deletion and Anonymization

Telecom operators must balance legal retention obligations with the principle of storage limitation. Some telecom records may need to be retained for billing, dispute resolution, legal obligations, fraud prevention, security, or official requests. However, personal data should not be retained indefinitely.

The KVKK By-Law on Erasure, Destruction or Anonymization of Personal Data determines procedures and principles concerning erasure, destruction and anonymization of personal data processed in accordance with Law No. 6698.

A telecom operator should prepare a personal data retention and destruction policy. The policy should classify data types, identify legal retention periods, determine deletion or anonymization methods, specify periodic destruction intervals, and assign internal responsibilities.

Retention rules should be implemented technically. It is not enough to state in a policy that data will be deleted. The operator must ensure that CRM systems, billing platforms, backup systems, call center recordings, logs, dealer systems, and cloud systems support deletion or anonymization.

Marketing, Profiling and Personalized Offers

Telecom operators often use customer data for marketing purposes. They may wish to send SMS campaigns, call subscribers, offer personalized tariffs, recommend internet packages, analyze usage patterns, or target customers based on location or behavior.

Marketing activities create serious privacy risks. A phone number is personal data. Usage patterns, call records, location behavior, and internet consumption patterns may create detailed customer profiles. Therefore, marketing processing must be based on a lawful ground and should comply with both data protection law and commercial electronic communication rules.

Operators should distinguish between service-related notifications and marketing communications. A message about invoice payment or service interruption may be necessary for contract performance. A message advertising a new data package is a marketing communication and may require consent.

Profiling must be handled carefully. If the operator analyzes traffic data or location data to create customer segments, this processing should be assessed separately. The subscriber should be informed clearly, and explicit consent may be required depending on the purpose and data category.

Data Subject Rights in Telecom Services

Subscribers and users have rights under Turkish data protection law. They may request information on whether their personal data is processed, learn the purpose of processing, know third parties to whom data has been transferred, request correction of inaccurate data, request deletion or destruction under legal conditions, object to certain processing results, and claim compensation for damages caused by unlawful processing.

The KVKK page on complaints states that a data subject must first apply to the data controller under Article 13 before lodging a complaint with the Board. If the request is refused, the answer is insufficient, or the controller does not respond within 30 days, the data subject may lodge a complaint within the relevant statutory periods.

Telecom operators should create an internal process for handling data subject applications. Customer service teams should be trained to distinguish ordinary service complaints from KVKK applications. A subscriber asking “What data do you hold about me?” or “Delete my personal data” may be exercising statutory data protection rights.

The operator should respond within legal deadlines and should preserve evidence of the response.

Data Controllers Registry and Telecom Operators

Many telecom operators are required to register with the Data Controllers Registry, known as VERBIS, depending on the applicable criteria. The By-Law on Data Controllers Registry regulates the establishment and management of the registry to be kept publicly available under the supervision of the Personal Data Protection Board.

Registration is not merely an administrative formality. It requires the operator to identify data categories, purposes of processing, recipient groups, retention periods, transfer activities, data subject groups, and security measures.

Telecom companies should ensure that their VERBIS registration matches their actual processing activities. If the registry says one thing but the company’s systems do another, this may create compliance risk.

Dealer, Call Center and Vendor Risks

Telecom operators usually rely on complex commercial networks. Dealers sell SIM cards and subscriptions. Call centers handle customer requests. Technical vendors maintain systems. Software vendors manage CRM and billing platforms. Cloud providers host data. Marketing agencies run campaigns. Collection firms may process debt-related information.

Each of these relationships creates privacy risk. The operator must determine whether the third party acts as a data processor, independent data controller, joint controller, reseller, agent, or subcontractor. Contracts should include confidentiality, data security, access limits, audit rights, breach notification, deletion obligations, and subcontracting restrictions.

Dealer networks are especially risky because identity documents, subscriber forms, SIM activation records, and customer approvals may be handled outside the central company environment. Operators should audit dealers, restrict access, train personnel, and monitor unusual activity.

BTK Audits and Regulatory Enforcement

BTK has audit and enforcement powers in the telecommunications sector. BTK’s audit page states that under Law No. 5809, operators are monitored for compliance with license terms, equipment standards, sector legislation, and spectrum use, and sanctions may be imposed on operators that do not comply with regulations.

In data protection matters, telecom operators may face both BTK and KVKK scrutiny. BTK may focus on sectoral obligations, network security, confidentiality, operator duties, and authorization compliance. KVKK may focus on personal data processing principles, privacy notices, consent, data security, breach notification, and data subject rights.

Therefore, telecom companies should be audit-ready. They should preserve compliance documents, privacy notices, consent records, access logs, data inventories, security policies, breach records, training records, vendor agreements, deletion logs, and board-level compliance decisions.

Common Privacy Violations in the Turkish Telecom Sector

Common violations include:

Sending invoices or account information to the wrong person.

Activating SIM cards without proper identity verification.

Disclosing subscriber information to unauthorized relatives or third parties.

Allowing dealers to misuse identity documents.

Failing to secure customer portals.

Using traffic or location data for marketing without lawful basis.

Sending marketing SMS messages without valid consent.

Failing to delete old subscriber data.

Allowing excessive employee access to subscriber records.

Failing to notify data breaches.

Transferring subscriber data abroad without proper safeguards.

Keeping consent records in an unverifiable manner.

Using vague privacy notices.

Ignoring data subject applications.

These violations may lead to administrative fines, compensation claims, consumer complaints, reputational damage, and loss of trust.

Practical Compliance Checklist for Telecom Operators

A telecom operator in Turkey should implement a structured privacy compliance program. The following checklist may be used:

Prepare a sector-specific data inventory.

Map subscriber data, traffic data, location data, billing data, and technical logs.

Identify the legal basis for each processing activity.

Prepare clear and layered privacy notices.

Separate explicit consent mechanisms by purpose.

Avoid making unnecessary consent a condition of core service.

Create a reliable consent withdrawal mechanism.

Restrict employee, dealer, and vendor access.

Keep access logs for sensitive systems.

Prepare traffic and location data processing procedures.

Review marketing and profiling activities.

Audit cross-border transfers.

Prepare data retention and destruction policies.

Implement breach response procedures.

Train call center, dealer, sales, technical, and legal teams.

Review vendor and processor agreements.

Maintain VERBIS registration accurately.

Respond to data subject requests within legal deadlines.

Monitor BTK and KVKK decisions.

Prepare for BTK and KVKK audits.

Conclusion

Data protection and privacy rules in the Turkish telecom sector require a higher level of care than ordinary commercial data processing. Telecom operators process subscriber data, traffic data, location data, billing records, IP information, call records, customer service recordings, and technical logs. These data can reveal intimate details about a person’s private life, communication habits, movements, and digital identity.

The legal framework is based on KVKK, Law No. 5809, BTK’s sector-specific regulation on personal data processing and confidentiality, network and information security rules, consumer protection principles, and general privacy law. Telecom operators must comply with both the Personal Data Protection Authority’s expectations and BTK’s sectoral requirements.

For telecom companies, privacy compliance is not limited to publishing a privacy notice. It requires a complete governance system covering legal basis analysis, explicit consent, subscriber information, data security, traffic and location data controls, breach notification, vendor management, cross-border transfers, data retention, deletion, marketing compliance, and audit readiness.

For subscribers, data protection rights are essential tools against unlawful processing, unauthorized disclosure, unwanted marketing, incorrect data, identity misuse, and privacy violations.

As mobile networks, fiber infrastructure, 5G, IoT, cloud communication, e-SIM technologies, and digital platforms continue to grow, data protection will remain one of the most important legal issues in the Turkish telecom sector. Companies that invest in strong privacy compliance will reduce regulatory risk, protect consumer trust, and build a more sustainable position in the Turkish telecommunications market.

Frequently Asked Questions

What is the main data protection law in Turkey?

The main law is Law No. 6698 on the Protection of Personal Data, commonly known as KVKK. Telecom operators must also comply with Law No. 5809 and BTK’s sector-specific privacy regulations.

Are telecom operators data controllers?

In many processing activities, telecom operators act as data controllers because they determine the purposes and means of processing subscriber data, traffic data, billing data, and customer records.

Is traffic data personal data?

Traffic data may be personal data where it relates to an identified or identifiable person. Because telecom traffic data can reveal communication patterns, it should be treated as highly sensitive from a compliance perspective.

Is location data protected in Turkey?

Yes. Location data in telecom services is subject to data protection and confidentiality rules. Processing location data for additional purposes such as marketing or profiling generally requires careful legal assessment and may require explicit consent.

Can telecom operators use customer data for marketing?

Telecom operators may use customer data for marketing only if there is a lawful basis and applicable commercial communication rules are followed. In many cases, explicit consent or valid marketing approval will be required.

What should telecom operators do in case of a data breach?

They should immediately assess the incident, contain the breach, preserve evidence, identify affected data and users, evaluate notification duties to KVKK, BTK and subscribers, and implement corrective measures.

Can telecom data be transferred abroad?

Cross-border transfers may be possible, but they must comply with Turkish personal data transfer rules. Telecom operators should review cloud services, foreign group access, international vendors, roaming arrangements, and technical support systems carefully.

What are the main privacy risks for telecom operators in Turkey?

The main risks include unlawful processing of traffic or location data, weak consent mechanisms, unauthorized dealer access, data breaches, excessive employee access, unlawful marketing messages, insecure cross-border transfers, failure to delete old data, and inadequate breach notification.