Compensation for Data Protection Violations in Turkey

Introduction

Compensation for data protection violations in Turkey is an increasingly important legal remedy for individuals, foreign residents, tourists, employees, patients, consumers, investors and business professionals whose personal data has been unlawfully collected, processed, transferred, disclosed, leaked, stored, used, sold, shared or accessed. In the digital economy, personal data has become one of the most valuable assets held by companies, hospitals, hotels, banks, e-commerce platforms, employers, clinics, schools, public authorities, mobile applications, insurance companies, telecom providers, social media platforms and online service providers.

A data protection violation may cause serious harm. A person may suffer identity theft, financial loss, reputational damage, emotional distress, unwanted marketing, fraud risk, loss of privacy, exposure of health information, disclosure of employment records, publication of private photographs, unauthorized transfer of data abroad or misuse of sensitive personal information. A business professional may lose clients after a data leak. A patient may suffer humiliation if medical records are disclosed. An employee may be harmed by unlawful monitoring or exposure of salary and disciplinary data. A foreign patient may find before-and-after medical photographs used in advertising without valid consent.

Turkey’s main data protection statute is the Personal Data Protection Law No. 6698, commonly referred to as KVKK. The law’s purpose is to protect fundamental rights and freedoms, especially the privacy of private life, in the processing of personal data and to regulate the obligations of persons who process personal data. The law applies to real persons whose personal data is processed and to real or legal persons who process such data by automatic means or non-automatic means as part of a data recording system.

Under Turkish law, a data subject is not limited to filing an administrative complaint. A person who suffers damage because of unlawful processing may request compensation. Article 11 of the KVKK expressly gives data subjects the right to request compensation where they suffer damage due to unlawful processing of personal data. In addition, Article 14 states that the compensation rights of persons whose personality rights are violated are reserved under general provisions.

What Is a Data Protection Violation in Turkey?

A data protection violation occurs when personal data is processed contrary to the KVKK, general legal principles, data subject rights, data controller obligations, information duties, data security duties, transfer rules or consent requirements. The violation may involve unlawful collection, excessive data processing, lack of legal basis, failure to inform the data subject, failure to delete data, unauthorized disclosure, unauthorized access, unlawful transfer to third parties, data breach, cyberattack, employee misuse, public disclosure, misuse of special categories of data or unlawful transfer abroad.

Personal data is broadly defined as any information relating to an identified or identifiable real person. This may include name, surname, identity number, passport number, phone number, e-mail address, home address, IP address, photographs, voice records, location data, employment records, salary information, bank details, health information, biometric data, genetic data, customer records, online identifiers and similar information. The KVKK defines personal data as all information relating to an identified or identifiable real person and defines processing very broadly to include collection, recording, storage, preservation, alteration, disclosure, transfer, acquisition, classification and prevention of use.

A data protection violation may be committed by a data controller or a data processor. A data controller is the person or organization that determines the purposes and means of processing and is responsible for establishing and managing the data recording system. A data processor processes personal data on behalf of the controller based on authorization. These definitions are important because compensation claims and administrative complaints usually require identification of the proper data controller and, where relevant, the processor involved.

Legal Basis of Data Protection Compensation Claims

The legal basis of compensation for data protection violations in Turkey is multi-layered. The first and most direct basis is Article 11 of the KVKK, which gives data subjects several rights, including the right to request compensation for damage suffered due to unlawful processing of personal data.

The second basis is the right to apply to the data controller and then complain to the Personal Data Protection Board. Article 13 requires the data subject to submit KVKK-related requests to the data controller in writing or through other methods determined by the Board. The controller must respond as soon as possible and in any event within thirty days. If the request is rejected, the response is insufficient or no response is given in time, Article 14 allows the data subject to complain to the Board within thirty days from learning the response and in any event within sixty days from the application date.

The third basis is general civil liability. Article 14 of the KVKK expressly preserves the compensation rights of persons whose personality rights are violated. This means that a victim may seek compensation before civil courts under general provisions where unlawful data processing also violates privacy, honour, dignity, reputation, image rights, health confidentiality or other personality rights.

The fourth basis is the Turkish Civil Code and Turkish Code of Obligations. Data protection violations often amount to attacks on personality rights. Unlawful publication of photographs, disclosure of medical records, exposure of private address, leaking private messages, processing sensitive information or using personal data for harassment may justify moral compensation and, where financial loss exists, material compensation.

The fifth basis may be criminal law. Article 17 of the KVKK refers personal-data-related offences to Articles 135 to 140 of the Turkish Penal Code. Depending on the facts, unlawful recording of personal data, unlawful transfer or acquisition of data, failure to destroy data, violation of privacy, unlawful recording or disclosure of communications, blackmail, threats or fraud may also become relevant.

Key Principles of Personal Data Processing

A compensation claim should not only say that “my data was used.” It should identify which legal principle was violated. Article 4 of the KVKK states that personal data may be processed only in accordance with procedures and principles set out by law. It also requires personal data to be processed lawfully and fairly, to be accurate and up to date where necessary, to be processed for specific, explicit and legitimate purposes, to be relevant, limited and proportionate to the processing purpose, and to be retained only for the period required by law or by the purpose of processing.

These principles are central in data protection litigation. If a company collects identity numbers for a simple newsletter subscription, the processing may be excessive. If a clinic stores patient photographs indefinitely without a valid purpose, retention may be disproportionate. If an employer monitors private employee communications without necessity, fairness and proportionality may be violated. If an e-commerce platform shares customer data with third-party advertisers without a valid legal basis, the purpose limitation and transfer rules may be breached.

A strong compensation claim should explain which principle was violated, how the violation occurred, how the claimant was harmed and which evidence proves the link between unlawful processing and damage.

Common Types of Data Protection Violations

Data protection violations in Turkey may arise in many forms.

Common examples include unauthorized SMS marketing, sharing phone numbers with third parties, leaking customer databases, unlawful publication of patient photographs, disclosure of health records, sending invoices or legal notices to the wrong person, exposing employee salary information, using CCTV excessively, monitoring employees without transparency, retaining data after the legal purpose ends, refusing deletion requests, selling personal data to marketing companies, sharing customer data abroad without legal basis, using biometric systems without necessity, processing special categories of data without proper safeguards, and failing to notify a data breach.

Data breaches are particularly serious. They may occur through cyberattacks, ransomware, phishing, employee error, misconfigured databases, cloud storage mistakes, unauthorized access, stolen laptops, weak passwords, third-party processor failures or internal misuse. Data breaches can expose identity numbers, passport details, phone numbers, financial data, medical records, passwords, customer files, photographs or employment records.

The Personal Data Protection Board has treated data security as a serious obligation. Article 12 of the KVKK requires data controllers to take all necessary technical and administrative measures to prevent unlawful processing, prevent unlawful access and ensure preservation of personal data. It also provides that if personal data is obtained by others through unlawful means, the controller must notify the data subject and the Board as soon as possible.

Special Categories of Personal Data

Special categories of personal data require stronger protection because misuse may cause discrimination, humiliation, social harm, professional damage or serious privacy violations. Under the KVKK, special categories include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, biometric data and genetic data.

Special category violations can lead to stronger compensation claims. Disclosure of health data may affect employment or social life. Disclosure of union membership may create workplace pressure. Biometric data misuse may create identity and security risks. Genetic data misuse may create serious privacy and family-life consequences. Publication of sexual-life data or intimate health information may cause severe moral harm.

The KVKK was amended in 2024 regarding special categories of personal data. The Personal Data Protection Authority announced in 2025 that Article 6 was amended by Law No. 7499 and that new processing conditions were added for special categories of personal data. The Authority also published a guide to help data controllers process special categories based on correct legal grounds and comply with their obligations.

Because special category data is more sensitive, courts may evaluate harm more seriously. A claimant should emphasize the type of data, how sensitive it is, who accessed it, whether it was published, whether it caused discrimination or humiliation, and whether the controller took adequate safeguards.

Unlawful Transfer of Personal Data

Data transfer may occur domestically or internationally. Article 8 of the KVKK regulates transfer of personal data within Turkey and states that personal data cannot be transferred without explicit consent, unless one of the statutory conditions applies. This is important where a company shares customer data with affiliates, marketing partners, debt collectors, call centers, insurance companies, clinics, agencies, employers or third-party service providers.

International transfer is especially important for foreign companies, cloud providers, international clinics, e-commerce platforms, travel agencies, payment systems, global applications and multinational employers. The Personal Data Protection Authority announced that Article 9 on transfer abroad was amended by Law No. 7499 and that the Authority made available English translations of the by-law and standard contract texts for international transfers.

An unlawful transfer may cause compensation liability if the data subject suffers damage. For example, a Turkish clinic may transfer patient photographs to a foreign marketing company without legal basis. An employer may transfer employee health data to a foreign group company without proper safeguards. A hotel may share passport records or contact information with unauthorized third parties. A data subject may claim material and moral damages if the transfer leads to privacy violation, identity risk, fraud, emotional distress or reputational harm.

Data Breach Notification and 72-Hour Rule

Data breach notification is a critical issue in Turkey. Under Article 12 of the KVKK, if processed personal data is obtained by others through unlawful means, the data controller must notify the data subject and the Board as soon as possible. The Board’s 24 January 2019 decision interpreted “as soon as possible” as requiring notification to the Board without delay and within 72 hours from the date the controller learns of the breach. The same decision requires affected persons to be notified within the shortest reasonable time after they are identified.

Late notification may aggravate the violation. If a data controller delays notification, data subjects may lose the chance to protect themselves against fraud, identity theft, password abuse, financial loss or reputational harm. For example, if leaked customer data includes identity numbers and contact details, affected persons should be warned promptly. If leaked data includes passwords, bank information or health data, urgent notification becomes even more important.

The Board has also identified the minimum content of breach notices to data subjects. According to the Board’s 18 September 2019 decision, the notice should be clear and simple and include information such as when the breach occurred, which personal data categories were affected, possible consequences, measures taken or recommended to reduce negative effects, and contact channels for further information.

Failure to notify properly may support both administrative sanctions and civil compensation arguments. A claimant may argue that the controller’s delay or insufficient notice increased the damage.

Administrative Complaint and Civil Compensation

A common misunderstanding is that a KVKK complaint automatically provides compensation. It does not. The administrative complaint process and civil compensation lawsuit are different legal routes.

The complaint process before the Personal Data Protection Board may result in administrative examination, orders to remedy violations, decisions on unlawful processing, data processing suspension in urgent cases and administrative fines. Article 15 allows the Board to examine complaints or act ex officio, request information and documents, conduct investigations, order the controller to remedy unlawful processing and, in certain urgent circumstances, stop processing or transfer abroad.

However, compensation is generally pursued under general provisions before civil courts. Article 14 expressly states that the right to compensation for persons whose personality rights are violated is reserved. Therefore, a data subject may use a Board decision as strong supporting evidence in a civil compensation case, but the civil court still examines damage, causation, unlawfulness and amount.

In practice, the best strategy may involve both routes. The data subject may first apply to the controller, then file a complaint before the Board where necessary, and separately prepare a civil compensation lawsuit for material and moral damages.

Material Compensation for Data Protection Violations

Material compensation covers measurable financial losses caused by a data protection violation. These may include identity theft losses, unauthorized transactions, fraud-related damages, loss of employment, loss of clients, lost business opportunities, credit damage, cybersecurity expenses, account recovery expenses, legal expenses, medical or psychological treatment costs, relocation or security expenses and loss of income.

For example, if a data breach exposes a person’s identity and bank information and the person suffers financial fraud, material compensation may be claimed if causation is proven. If a company unlawfully discloses an employee’s medical data and the employee loses a job opportunity, material damages may be possible. If a clinic publishes a patient’s images without consent and the patient loses commercial contracts, this may create a financial claim.

Material compensation requires proof. The claimant should collect bank records, fraud reports, police complaints, invoices, cancellation emails, employment documents, customer loss records, expert reports, cybersecurity service invoices and other objective evidence. The claimant must show not only that a data violation occurred, but that the specific financial loss resulted from that violation.

Moral Compensation for Data Protection Violations

Moral compensation is often the main claim in data protection violation cases. Personal data is closely linked to dignity, privacy, reputation, identity and personal autonomy. Unlawful disclosure of personal data may cause anxiety, humiliation, fear, loss of control, emotional distress, family conflict, professional embarrassment, social isolation and reputational harm.

Moral damages may be especially strong where the data is sensitive. Disclosure of health records, sexual-life information, biometric data, criminal records, private photographs, location history, family information or intimate messages can seriously violate personality rights. In such cases, the claimant may rely on general personality rights protection and moral compensation rules in addition to the KVKK.

The amount of moral compensation is not calculated through a fixed table. Courts may consider the nature of the data, sensitivity, degree of fault, whether the violation was intentional, number of persons who accessed the data, whether the data was published online, duration of exposure, whether the controller notified the breach, whether the controller took corrective action, psychological impact, reputational harm and fairness.

A strong moral compensation claim should explain concretely how the violation affected the claimant’s life. It should not merely state “my personal data was processed unlawfully.” It should describe fear of fraud, embarrassment, professional harm, family consequences, psychological distress, loss of privacy and the continuing impact of the violation.

Data Protection Violations in Healthcare and Medical Tourism

Healthcare data is among the most sensitive forms of personal data. Hospitals, clinics, dental centers, cosmetic surgery clinics, hair transplant centers, laboratories, pharmacies and health tourism companies process large amounts of special category data. A violation may involve disclosure of diagnosis, medical reports, before-after photographs, surgery records, laboratory results, psychiatric records, reproductive health data, genetic information, treatment invoices or patient contact details.

Foreign patients are particularly vulnerable. A clinic may use before-and-after photographs in advertising without valid explicit consent. A health tourism intermediary may share patient information with hotels, drivers or foreign marketing companies. A dental clinic may transfer patient images and medical records to third parties. A cosmetic surgery clinic may communicate health data through unsecured messaging systems.

Because health data is a special category of personal data, legal compliance is stricter. The 2024 amendments to special category data processing and the Authority’s 2025 guide make correct legal basis and safeguards especially important for data controllers processing sensitive data.

A patient whose medical data is unlawfully processed may claim removal of content, deletion of data, administrative complaint, criminal complaint in serious cases and civil compensation for material and moral harm.

Employee Data Protection Violations

Employers process employee data such as identity information, salary, performance records, disciplinary files, health reports, biometric entry records, camera images, e-mail logs, GPS data, criminal record documents, family information and union-related data. Employee data violations may occur through excessive monitoring, unlawful camera surveillance, disclosure of salary information, sharing health reports with colleagues, use of biometric systems without necessity, reading private communications, unlawful transfer to group companies or failure to delete former employee data.

Employment relationships create power imbalance. Consent given by an employee may not always be considered freely given if refusal would create workplace pressure. Therefore, employers should rely on proper legal bases, provide transparent privacy notices, limit processing, implement security measures and avoid excessive monitoring.

An employee may seek compensation if unlawful processing causes emotional distress, reputational harm, discrimination, dismissal, workplace harassment or financial loss. If the data violation is connected to termination, discrimination, mobbing or employment receivables, labour court jurisdiction may need to be considered.

Consumer, E-Commerce and Marketing Data Violations

E-commerce platforms, retailers, call centers, online marketplaces, travel agencies, telecom providers and mobile applications process large amounts of consumer data. Violations may include unauthorized marketing messages, sharing phone numbers with third parties, retaining payment data unnecessarily, leaking customer databases, failure to honor deletion requests, using data for unrelated advertising, profiling customers without transparency or transferring data abroad unlawfully.

Unwanted marketing alone may not always justify high compensation, but repeated misuse of contact information, disclosure to multiple third parties, identity risk or emotional distress may strengthen the claim. A consumer may request deletion, correction, information about transfers, cessation of unlawful processing, complaint to the Board and compensation where damage exists.

Consumers should preserve SMS messages, e-mails, call logs, privacy notices, screenshots, data controller responses and any evidence showing that their personal data was used without legal basis.

Evidence Required for Data Protection Compensation Claims

Evidence is decisive in compensation claims. Useful evidence may include data controller responses, privacy notices, consent forms, screenshots, SMS messages, e-mails, call records, breach notifications, Board decisions, data subject application documents, complaint records, platform logs, medical records, employment documents, forensic reports, cyber incident reports, invoices, bank records, police reports, witness statements and expert reports.

The claimant should first identify what data was processed, who processed it, when it was processed, why it was unlawful, whether it was transferred, who accessed it, what harm occurred and what evidence proves causation.

If the violation involves online publication, the claimant should preserve URLs, screenshots, dates, account names and platform details. If the violation involves a data breach, the claimant should keep the breach notification, any warning from the controller, evidence of fraud attempts, password reset notices and bank warnings. If the violation involves health data, the claimant should collect medical records, clinic communications and evidence of unauthorized publication or transfer.

A civil compensation lawsuit is stronger where the claimant can combine legal violation evidence with concrete harm evidence.

Limitation Periods

Limitation periods depend on the legal basis of the claim. KVKK administrative complaint deadlines are specific: the data subject must first apply to the data controller, and if the application is rejected, answered insufficiently or unanswered, the data subject may complain to the Board within thirty days from learning the response and in any event within sixty days from the application date.

Civil compensation claims may follow general limitation rules depending on whether the claim is based on tort, contract, personality rights, employment, consumer law or another legal basis. If the data violation also constitutes a criminal offence, criminal limitation periods may affect civil analysis in some cases.

The safest approach is to act quickly. Digital evidence may disappear, logs may be deleted, controllers may change systems, online content may be removed and financial harm may become harder to prove. A victim should not wait until the administrative complaint process ends before preserving civil evidence.

Which Court Handles Data Protection Compensation Claims?

The competent court depends on the legal nature of the dispute. General personality-rights-based compensation claims may be filed before civil courts of first instance. Employment-related data violations may fall before labour courts. Consumer-related data violations may involve consumer courts. Commercial disputes between companies may fall before commercial courts. Public authority data violations may require administrative court analysis. Criminal offences involving personal data may be pursued through criminal complaint separately.

The Personal Data Protection Board is not a compensation court. It may impose administrative measures and fines, but compensation generally requires a civil lawsuit under general provisions. A Board decision may strongly support the civil case, but the claimant must still prove damage and causal link.

Data Protection Claims by Foreigners in Turkey

Foreigners can claim compensation for data protection violations in Turkey if their personal data is processed in Turkey, the data controller is in Turkey, the violation occurred in Turkey, or Turkish courts have jurisdiction. This may include foreign patients, tourists, employees, investors, customers and residents.

A foreign patient may claim compensation if a Turkish clinic publishes medical photographs without valid consent. A foreign tourist may claim if a hotel unlawfully discloses passport or contact details. A foreign employee may claim if an employer transfers data to a group company without proper safeguards. A foreign customer may claim if a Turkish e-commerce platform leaks identity or payment data.

Foreign claimants may act through a Turkish lawyer by power of attorney. Documents issued abroad, such as fraud reports, medical records, psychological reports or employment-loss evidence, may need apostille and sworn translation.

Common Mistakes in Data Protection Claims

Common mistakes include confusing a Board complaint with a compensation lawsuit, failing to apply to the data controller before complaining to the Board, missing administrative complaint deadlines, relying only on emotional statements without evidence, failing to prove financial loss, not preserving breach notifications, deleting marketing messages, not identifying the correct data controller, failing to document online publications, and signing settlement documents without addressing deletion, non-use and non-transfer obligations.

Another common mistake is claiming compensation for any technical KVKK violation without showing damage. A procedural violation may support an administrative complaint, but civil compensation requires harm, causation and legal basis. The strongest cases combine unlawful processing with concrete consequences such as privacy exposure, financial loss, identity risk, reputational damage or emotional distress.

Practical Steps After a Data Protection Violation

A person who suspects a data protection violation in Turkey should act systematically. First, identify the data controller. Second, preserve all evidence, including screenshots, messages, privacy notices, consent forms and breach notifications. Third, submit a written application to the data controller under Article 13. Fourth, evaluate the controller’s response within the statutory period. Fifth, file a complaint to the Board if the response is rejected, insufficient or absent. Sixth, collect evidence of damage. Seventh, consider a civil compensation lawsuit if material or moral harm occurred. Eighth, file a criminal complaint where private data, health data, images, identity information or accounts were unlawfully obtained or disclosed. Ninth, request deletion, correction, cessation of processing or notification to third parties where appropriate.

A well-prepared legal strategy should combine administrative, civil and, where necessary, criminal remedies.

Why Legal Representation Is Important

Data protection compensation claims require legal and technical analysis. A lawyer must identify the data controller, determine the violated KVKK provisions, prepare the data subject application, file the Board complaint, preserve evidence, analyze civil liability, calculate material and moral damages, choose the correct court and coordinate any criminal complaint.

Legal representation is especially important in health data breaches, employee monitoring cases, large data leaks, foreign patient claims, cross-border transfers, biometric data disputes, online publication of personal data, identity theft, financial fraud and high reputational harm.

A strong claim should not merely state that personal data was processed unlawfully. It should explain what data was processed, why the processing was unlawful, which obligation was breached, how the claimant suffered damage, what evidence proves the causal link and what compensation is justified.

Conclusion

Compensation for data protection violations in Turkey protects individuals whose personal data has been unlawfully processed, disclosed, transferred, retained, accessed or leaked. The KVKK provides data subjects with rights to learn whether data is processed, request information, learn processing purpose, learn third-party transfers, request correction, request deletion or destruction, object to harmful automated analysis and request compensation where unlawful processing causes damage.

Data controllers must take necessary technical and administrative measures to prevent unlawful processing, prevent unlawful access and preserve personal data. They must also notify the Board and affected persons when personal data is unlawfully obtained by others. The Board interprets breach notification to the Board as requiring notification without delay and within 72 hours from learning of the breach.

The compensation route is separate from administrative complaint. A KVKK complaint may lead to administrative action and fines, while compensation for material and moral damages is pursued under general civil-law provisions. Article 14 of the KVKK expressly preserves compensation rights for persons whose personality rights are violated.

A successful data protection compensation claim in Turkey depends on evidence, correct legal classification, proof of damage, causal link, timely applications and identification of the responsible data controller. For Turkish citizens, foreign residents, tourists, employees, patients and consumers alike, a properly prepared claim can help stop unlawful processing, obtain deletion or correction, support administrative enforcement and recover compensation for financial loss, privacy harm, emotional distress and reputational damage.