Introduction
Compensation for breach of privacy in Turkey is an important legal remedy for individuals, foreign residents, tourists, employees, patients, public figures, businesspeople and companies whose private life, personal data, image, correspondence, reputation or personal dignity has been unlawfully violated. Privacy is not limited to secrecy inside a person’s home. It includes personal identity, family life, intimate life, health information, personal photographs, videos, voice recordings, correspondence, personal data, location information, financial information, online accounts, private messages and the individual’s control over personal information.
In modern legal practice, breach of privacy claims often arise from unauthorized publication of photographs, unlawful sharing of private videos, disclosure of medical records, leaking personal data, sharing private messages, hidden camera recordings, recording conversations without consent, doxing, exposing home address or phone number, publication of private family information, misuse of patient data, workplace surveillance, social media harassment, revenge posting, hacking of accounts, unlawful processing of personal data and online reputation attacks.
Turkish law protects privacy through constitutional law, civil law, criminal law, personal data protection law and internet law. Article 20 of the Constitution of the Republic of Türkiye states that everyone has the right to demand respect for private and family life, that the privacy of private and family life cannot be violated, and that everyone has the right to protection of personal data concerning them. The same constitutional provision states that personal data may be processed only in cases prescribed by law or with the explicit consent of the person.
A breach of privacy may lead to different remedies. The victim may request cessation of the violation, prevention of future violations, determination of unlawfulness, removal of content, publication of correction or judgment, material compensation, moral compensation, criminal complaint, application to the Turkish Personal Data Protection Authority, or other legal measures depending on the facts. The most common civil remedy is moral compensation because privacy violations often cause emotional distress, humiliation, anxiety, reputational harm and loss of dignity.
What Is Breach of Privacy Under Turkish Law?
A breach of privacy occurs when a person’s private life, personal information, private images, correspondence or personal sphere is unlawfully accessed, recorded, disclosed, shared, processed or used without a valid legal basis. The violation may be committed by an individual, employer, media organization, company, hospital, clinic, hotel, school, public authority, online platform, data controller, former spouse, partner, employee, hacker or social media user.
Privacy is closely connected to personality rights. The Turkish Civil Code protects personality rights broadly. Article 24 provides that a person whose personality rights are unlawfully attacked may request protection from the judge, and that every attack against personality rights is unlawful unless justified by the person’s consent, a superior private or public interest, or the exercise of legal authority. Article 25 allows the claimant to request prevention of a threatened attack, cessation of an ongoing attack, determination of unlawfulness even after the attack has ended if its effects continue, publication or notification of correction or judgment, and also preserves the right to claim material and moral compensation.
Therefore, breach of privacy is not evaluated only as a technical data issue. It is also a violation of the individual’s personality rights. If someone shares a person’s private photograph without consent, discloses medical information, publishes private messages, records intimate moments, exposes family information or reveals personal data in a damaging way, the victim may argue that their personality rights and private life have been violated.
Legal Basis for Privacy Compensation Claims in Turkey
Privacy compensation claims in Turkey may rely on several legal grounds.
The first basis is the Constitution. Article 20 guarantees respect for private and family life and protection of personal data. This provision is especially important when the violation involves public authorities, workplace data, medical records, public-sector records or state responsibility.
The second basis is the Turkish Civil Code. Articles 24 and 25 provide general protection against unlawful attacks on personality rights and allow preventive, corrective and compensatory remedies. These provisions are frequently used in lawsuits involving privacy, reputation, image rights, private correspondence, personal photographs, private life and dignity.
The third basis is the Turkish Code of Obligations. Article 58 provides that a person whose personality rights have been damaged may request monetary moral compensation, and the judge may decide another form of remedy instead of or in addition to monetary compensation, including a decision condemning the attack and publication of that decision.
The fourth basis is the Personal Data Protection Law No. 6698, commonly known as KVKK. The purpose of the KVKK is to protect fundamental rights and freedoms, especially the privacy of private life, in the processing of personal data and to regulate obligations of persons processing personal data. The law gives individuals rights to learn whether their personal data is processed, request information, learn the purpose of processing, request correction, request deletion or destruction under legal conditions, and use other data subject rights.
The fifth basis may be criminal law. Article 134 of the Turkish Penal Code regulates violation of the privacy of private life. It criminalizes violation of private life and provides higher consequences where privacy is violated by recording images or sounds, or where private images or sounds are unlawfully disclosed.
Material Compensation and Moral Compensation
A breach of privacy may lead to both material compensation and moral compensation.
Material compensation covers financial losses. These may include loss of employment, loss of commercial opportunity, loss of clients, costs of psychological treatment, costs of digital removal services, legal expenses, identity theft-related losses, security costs, relocation expenses, loss of income, damage to business reputation or other measurable economic harm.
For example, if a private medical record is leaked and the victim loses employment opportunity, material compensation may be claimed if causation can be proven. If a company unlawfully discloses a person’s address and the victim must change residence or take security measures, those costs may be claimed. If private images are leaked and the victim loses sponsorship or commercial contracts, the financial loss may be part of the compensation claim.
Moral compensation is more common. Privacy violations often harm dignity, emotional security, reputation, social life and mental well-being. A victim may suffer humiliation, anxiety, fear, social isolation, loss of trust, sleep problems, family conflict, professional damage or psychological trauma. Article 58 of the Turkish Code of Obligations is the main civil-law basis for moral compensation where personality rights are damaged.
Moral compensation is not calculated through a fixed tariff. The judge considers the nature of the violation, degree of fault, whether the act was intentional, how widely the information was shared, whether the content is intimate, whether the victim is a child, whether the defendant removed the content, whether the violation continued, whether the act caused reputational harm, and whether the victim suffered serious emotional consequences.
Unauthorized Sharing of Photos and Videos
Unauthorized sharing of photos and videos is one of the most common privacy violations in Turkey. The legal assessment depends on the nature of the image, where it was taken, how it was obtained, whether consent existed, whether the image relates to private life, whether the publication serves a public interest and whether the sharing violates personality rights.
A photograph taken in a public place is not automatically free to publish in any context. If the photograph targets a person, humiliates them, exposes their private life, is used commercially without consent, reveals sensitive information or creates reputational harm, it may violate personality rights. If the photograph or video concerns private life, intimate life, home life, family life, health condition or personal vulnerability, the legal protection is stronger.
Videos and images recorded secretly may also create criminal consequences. Article 134 of the Turkish Penal Code specifically refers to violation of private life and aggravates the situation where privacy is violated by recording images or sounds. It also criminalizes unlawful disclosure of private images or sounds.
A victim may pursue several remedies at the same time: criminal complaint, civil compensation lawsuit, request for removal or access blocking where applicable, and preservation of digital evidence.
Disclosure of Private Messages and Correspondence
Private messages, emails, WhatsApp conversations, direct messages, letters and personal correspondence may fall within the scope of private life and personality rights. Publishing private correspondence without consent can create serious civil and criminal consequences, especially where the content is intimate, confidential, family-related, medical, financial or professionally sensitive.
A common mistake is assuming that because one person is a party to a conversation, they can freely publish the entire conversation. This is not always correct. A person may use correspondence as evidence in a legal dispute under strict conditions, but public sharing on social media, sending it to third parties, exposing it to employers or publishing it to shame the other party may constitute a privacy violation.
Civil compensation may be claimed if the disclosure harms dignity, reputation, private life or emotional well-being. Material compensation may also be possible if the disclosure causes financial damage, loss of employment or commercial loss.
The legal strategy should distinguish between lawful evidentiary use and unlawful public disclosure. Courts will examine purpose, necessity, proportionality, consent, context and the extent of dissemination.
Breach of Privacy and Personal Data Protection
Many privacy violations also involve personal data. Personal data may include name, phone number, address, identity number, passport information, photographs, voice, location data, health information, financial data, employment records, biometric data, online identifiers and other information relating to an identified or identifiable person.
The KVKK protects individuals in the processing of personal data. Article 1 states that the purpose of the law is to protect fundamental rights and freedoms, especially privacy of private life, in personal data processing. Article 11 gives data subjects rights such as learning whether personal data is processed, requesting information, learning the purpose of processing, knowing third parties to whom data is transferred, requesting correction, requesting deletion or destruction under legal conditions, and other rights.
A person whose personal data has been unlawfully processed may first apply to the data controller. If the application is rejected, the response is insufficient, or no response is given in time, the person may file a complaint with the Turkish Personal Data Protection Authority within the statutory period. Article 14 of the KVKK also expressly states that the compensation rights of persons whose personality rights are violated are reserved under general provisions.
This means that a KVKK complaint and a civil compensation lawsuit are not the same thing. A complaint before the Personal Data Protection Authority may lead to administrative examination and sanctions, while compensation is usually pursued through civil courts under general provisions.
Medical Privacy and Patient Data
Medical privacy is one of the most sensitive privacy areas. Health data is highly personal. Disclosure of diagnosis, treatment details, surgery records, test results, photographs before and after medical procedures, pregnancy information, psychiatric records, genetic information or cosmetic surgery information may cause serious harm.
Medical privacy violations may occur in hospitals, clinics, dental clinics, cosmetic surgery centers, hair transplant clinics, laboratories, pharmacies or health tourism companies. Examples include sharing patient photos without consent, using before-after images in advertisements, disclosing diagnosis to third parties, sending medical records to unauthorized persons, publishing patient testimonials with identifiable information, or failing to secure patient files.
Foreign patients are especially vulnerable in health tourism. A clinic may use a foreign patient’s photographs for promotion, disclose treatment details to coordinators or intermediaries, or communicate sensitive health information through unsecured channels. If consent was not valid, clear, specific and informed, a privacy violation may arise.
A patient may claim removal of content, moral compensation, material compensation for financial losses, KVKK remedies and, in serious cases, criminal complaint depending on the facts.
Workplace Privacy Violations
Privacy violations may also occur in employment relationships. Employers may monitor emails, install cameras, track location, review devices, process health data, share disciplinary records, disclose salary information, publish employee photographs, or reveal private information about workers. Employers may have legitimate interests in workplace security and business organization, but monitoring must be lawful, proportionate, transparent and limited.
Workplace privacy disputes may involve CCTV cameras, remote-work monitoring tools, biometric attendance systems, GPS tracking, corporate email review, background checks, health reports, disciplinary files and sharing of employee data with third parties. If the employer processes personal data without legal basis or violates the employee’s personality rights, the employee may have civil and administrative remedies.
The Constitutional Court has emphasized that personal data protection is connected to human dignity and free development of personality, and that public authorities have positive obligations to prevent unauthorized access, use and disclosure of personal data.
A workplace privacy claim may include moral compensation, material damages, KVKK application, labour-law claims, reinstatement-related arguments, or complaint mechanisms depending on the facts.
Online Privacy Violations and Social Media
Online privacy violations are among the fastest-growing areas of compensation law in Turkey. A person’s private photographs, videos, messages, address, phone number, family information, medical information or personal data may be shared on Instagram, X, Facebook, TikTok, YouTube, Telegram, WhatsApp groups, websites, forums, blogs or news platforms.
Online privacy violations are especially harmful because content may spread rapidly, be copied, reposted and archived. Even if the original post is deleted, screenshots or mirror posts may continue. Therefore, evidence preservation and urgent action are critical.
A victim may consider civil compensation, criminal complaint, content removal, access blocking, KVKK complaint and notification to platforms. However, internet remedies must be used carefully. The Constitutional Court has repeatedly stressed that access blocking under Law No. 5651 should be balanced with freedom of expression and press freedom, and that such measures should be reserved for cases where the unlawfulness and interference with personality rights are apparent and urgent intervention is necessary.
In online privacy cases, evidence should be secured before the content disappears. Screenshots should include URL, date, account name and context. In serious cases, notarial determination, expert preservation or criminal complaint may be necessary.
Content Removal and Access Blocking
Where privacy is violated through internet content, the victim may seek removal or access restriction depending on the legal route. Law No. 5651 has historically provided procedures for content removal and access blocking in cases involving personality rights. However, this area has been constitutionally sensitive. The Constitutional Court’s pilot decision found structural problems in the application of Article 9 access-blocking procedures and emphasized that the mechanism lacked certain safeguards for freedom of expression and press freedom.
This does not mean that victims have no remedy. It means that requests must be carefully prepared and should focus on clear, urgent and apparent violations such as private images, intimate content, unlawful disclosure of personal data, severe reputation attacks or content that creates ongoing harm. A broad access-blocking request against journalistic criticism may fail or create freedom-of-expression issues. A narrowly tailored request for removal of private photographs or medical data is legally stronger.
A civil compensation lawsuit may proceed separately from content removal. Even if the content is removed, the victim may still claim moral compensation for the harm already suffered.
Criminal Complaint for Breach of Privacy
Some privacy violations are also crimes. The most relevant provision is Article 134 of the Turkish Penal Code, which regulates violation of privacy of private life. It covers violation of private life and aggravated situations involving recording images or sounds, as well as unlawful disclosure of private images or sounds.
Depending on the facts, other offences may also be relevant, such as unlawful recording of personal data, unlawfully giving or obtaining personal data, threats, blackmail, insult, harassment, unlawful access to accounts or violation of communication secrecy. Criminal proceedings may help identify anonymous perpetrators, obtain platform or IP information, collect digital evidence and secure expert analysis.
However, a criminal complaint does not automatically produce compensation. The criminal court focuses on punishment. The victim may still need a separate civil compensation lawsuit to claim material and moral damages. Criminal evidence may support the civil case, but compensation requires separate legal assessment of damage, causal link and amount.
Evidence Required for Privacy Compensation Claims
Evidence is decisive in breach of privacy claims. The claimant must prove the violation, identity or responsibility of the defendant, unlawfulness, damage and causal link.
Useful evidence includes screenshots, URLs, social media links, account names, publication dates, notarial determinations, platform reports, witness statements, private messages, emails, photographs, videos, medical records, KVKK applications, data controller responses, criminal complaint files, police reports, expert reports, employment documents, hospital records, psychological treatment records, invoices and proof of financial loss.
In digital cases, ordinary screenshots may be challenged. The defendant may deny authorship, delete the content or claim manipulation. Therefore, stronger preservation methods should be considered in serious cases. The victim should document the content immediately, preserve metadata where possible, record URLs, and avoid altering the original digital evidence.
If material compensation is claimed, financial evidence is necessary. If moral compensation is claimed, the victim should document emotional and reputational effects through medical records, psychological reports, witness statements, family impact, workplace consequences and evidence of dissemination.
Limitation Periods
Limitation periods depend on the legal basis. For tort-based civil compensation claims, Article 72 of the Turkish Code of Obligations generally provides a two-year period from the date the injured person learns of the damage and liable person, and in any event a ten-year period from the harmful act. If the act also constitutes a criminal offence and criminal law provides a longer limitation period, the longer criminal limitation period may apply.
Privacy violations may also involve criminal offences, especially under Article 134 of the Turkish Penal Code. Therefore, limitation analysis must consider both civil and criminal dimensions. However, victims should not wait. Online evidence may disappear, platform data may be deleted, witnesses may become unavailable and the harm may spread.
In KVKK matters, the data subject must first apply to the data controller. If the application is rejected, the response is insufficient, or no response is received in time, the person may file a complaint with the Personal Data Protection Authority within thirty days from learning the response and in any event within sixty days from the application date.
These administrative periods do not replace civil limitation rules. A victim seeking compensation should separately evaluate civil lawsuit deadlines.
Which Court Handles Privacy Compensation Claims?
General privacy compensation claims are usually filed before civil courts of first instance because they concern personality rights and tort-based compensation. If the privacy violation arises from employment, labour courts may become relevant. If the violation arises from a commercial relationship or unfair competition between merchants, commercial courts may need to be considered. If the violation is committed by a public authority, administrative courts may be relevant depending on the act. If the issue concerns personal data processing, the Personal Data Protection Authority may also be involved, but administrative complaint is different from compensation litigation.
Article 25 of the Turkish Civil Code provides a special venue rule: a claimant seeking protection of personality rights may file the case before the court of their own residence or the defendant’s residence.
In online cases, identifying the defendant may be difficult. The responsible person may be an account holder, website operator, content provider, company, employer, clinic, media organization or anonymous user. Criminal complaint and platform requests may be necessary to identify the person behind the content.
Privacy Claims by Foreigners in Turkey
Foreigners can file compensation claims for breach of privacy in Turkey if Turkish courts have jurisdiction or if the violation is connected to Turkey. A foreign tourist may have private images shared by a hotel or clinic. A foreign patient may have medical records or before-after photographs published without consent. A foreign employee may have private data disclosed by an employer. A foreign businessperson may be targeted by private-life exposure or online harassment in Turkey.
Foreign claimants may usually be represented by a Turkish lawyer through a valid power of attorney. They should preserve passport copies, residence information, medical records, screenshots, platform links, correspondence, invoices, psychological reports and any foreign documents showing harm. Documents issued abroad may need apostille and sworn translation.
Foreign patients and tourists should act quickly because they may leave Turkey before evidence is secured. If the violation involves a Turkish clinic, hotel, employer, platform user or company, Turkish remedies may be practical and effective.
Common Mistakes in Privacy Claims
Common mistakes include failing to preserve digital evidence, relying only on ordinary screenshots, waiting too long, not identifying the correct defendant, confusing KVKK complaint with compensation lawsuit, deleting messages, responding emotionally online, signing settlement documents without legal review, failing to request removal of content, and not documenting emotional or financial harm.
Another common mistake is assuming that every unpleasant publication is a privacy violation. Turkish law balances privacy with freedom of expression, public interest and press freedom. A publication about a matter of public interest may be treated differently from disclosure of intimate photographs or medical records. The claim must explain why the information belongs to private life, why publication was unlawful, and why the victim’s interest outweighs any alleged public interest.
A strong privacy claim should focus on concrete facts: what was disclosed, who disclosed it, where it was shared, how many people saw it, why it was private, what harm it caused, what evidence proves it and what remedy is requested.
Practical Steps After Breach of Privacy in Turkey
A person whose privacy is violated should act immediately.
First, preserve evidence. Save URLs, screenshots, dates, account names, messages, emails and platform details. Second, avoid deleting original communications. Third, request removal from the platform where appropriate. Fourth, consider notarial or technical preservation for serious cases. Fifth, file a criminal complaint if private images, recordings, threats, blackmail or hacking are involved. Sixth, apply to the data controller if personal data processing is involved under KVKK. Seventh, consider a complaint before the Personal Data Protection Authority where the KVKK route applies. Eighth, prepare a civil compensation claim for material and moral damages. Ninth, obtain medical or psychological support if emotional harm is serious. Tenth, avoid signing settlement or waiver documents without legal review.
The first days after a privacy violation are often decisive. Digital content can spread quickly, and evidence can disappear just as quickly.
Why Legal Representation Is Important
Breach of privacy compensation claims in Turkey require careful legal strategy because they may involve civil law, criminal law, KVKK, internet law, employment law, medical privacy, media law and international elements. A lawyer can identify the correct legal basis, preserve evidence, determine defendants, file criminal complaints, prepare KVKK applications, request content removal, file civil lawsuits, calculate damages and negotiate settlements.
Legal representation is especially important in cases involving private images, medical data, foreign patients, anonymous accounts, revenge posting, workplace surveillance, data leaks, online harassment, defamation combined with privacy violation and high reputational harm.
A well-prepared claim should not merely state that privacy was breached. It should explain which aspect of private life was violated, why the disclosure was unlawful, how the defendant is responsible, what damage occurred, which evidence proves the claim and which remedies are necessary.
Conclusion
Compensation for breach of privacy in Turkey protects individuals whose private life, personal data, image, correspondence, medical information, family life, dignity or personality rights are unlawfully violated. The legal framework is broad and includes the Constitution, Turkish Civil Code, Turkish Code of Obligations, Personal Data Protection Law, Turkish Penal Code and internet-related remedies.
Article 20 of the Constitution guarantees respect for private and family life and the right to protection of personal data. Articles 24 and 25 of the Turkish Civil Code allow persons whose personality rights are attacked to seek protection, cessation, determination of unlawfulness, publication or correction, and compensation. Article 58 of the Turkish Code of Obligations allows moral compensation where personality rights are damaged.
The KVKK provides specific rights for persons whose personal data is processed and preserves compensation rights under general provisions where personality rights are violated. Article 134 of the Turkish Penal Code may also apply where private life is violated through recording, disclosure or other unlawful conduct.
A successful privacy compensation claim depends on fast evidence preservation, correct legal classification, identification of defendants, proof of unlawfulness, proof of harm and timely legal action. For Turkish citizens, foreign residents, tourists, patients, employees and businesspeople alike, a properly prepared breach of privacy claim in Turkey can help stop ongoing violations, remove unlawful content, obtain moral compensation, recover financial losses and restore legal protection for private life and personal dignity.
No Responses