This is the English version of a Turkish article. The original, with further detail and linked petition templates, is at KVKK: Kişisel Verileriniz İzinsiz Kullanılırsa.
If you believe your personal data is being processed without consent the order of steps is fixed: apply first to the data controller, and complain to the Personal Data Protection Board only if that produces nothing. The controller must deal with the application within thirty days. A complaint made directly to the Board is rejected for want of that prior application.
An advertising message from a company you have never bought from. Information you left on one site turning up somewhere else. These may be unlawful processing of your personal data.
Law no. 6698 gives you concrete rights — but exercising them has a defined sequence, and skipping it means your complaint is rejected on procedural grounds.
What Rights Do You Have?
Article 11 gives everyone the right to apply to the data controller and:
- learn whether their personal data is being processed
- if it is, request information about it
- learn the purpose of processing and whether it is being used consistently with that purpose
- know the third parties to whom the data has been transferred, in Turkey or abroad
- require rectification where the data is incomplete or inaccurate
- require erasure or destruction within the conditions the Act lays down
- require that rectification, erasure and destruction be notified to the third parties to whom the data was transferred
- object to an adverse outcome produced by automated analysis
- claim compensation for loss caused by unlawful processing
The Sequence of Applications
This is the rule most often overlooked. Articles 13 and 14 set out a clear order.
1. Apply to the data controller. Send your request in writing or by the methods the Board has designated. The controller must deal with it within thirty days.
2. Complain to the Board. If the application is refused, answered inadequately or not answered in time, you may complain to the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the application.
Complaints made directly to the Board are not taken up, because the prior application is missing. So keep a record of the application you make to the controller.
To identify the controller, look at the company's privacy notice or the entries in the data controllers' registry.
| Step | Where | Time |
|---|---|---|
| 1. Application | To the data controller, in writing | The controller answers within 30 days |
| 2. Complaint | The Personal Data Protection Board | 30 days from the answer; in any event 60 days from the application |
| 3. Damages claim | Civil court of first instance | May be brought independently of the complaint |
| Unsolicited commercial messages | The Ministry of Trade's message management system | A separate complaint route |
A complaint to the Board does not prevent a damages claim; the two can run together.
Unsolicited Marketing Messages
The commonest situation is commercial electronic messages, where two separate statutes apply: Law no. 6698 as regards the processing of the data, and the Electronic Commerce Act (Law no. 6563) as regards sending the message.
What to do:
- Use the opt-out in the message, and keep a record that you did.
- Register your objection through the national message management system, which lets you refuse messages from all senders at once.
- Apply to the data controller under Article 11, asking where your data came from and requiring its erasure.
- Complain to the Ministry of Trade if messages continue — sending without consent attracts an administrative fine.
- Complain to the Board as regards the unlawful processing itself.
Consent matters: a commercial message may be sent only with prior consent, and the burden of proving that consent lies on the sender.
Claiming Damages
A complaint to the Board can lead to an administrative fine on the controller, but it does not compensate you. For that, a separate claim must be brought in the civil courts.
What can be claimed: pecuniary loss actually suffered, and non-pecuniary damages for infringement of personality rights — the disclosure of health information or a data breach exposing identity details, for instance.
What helps: the Board's decision, if one has been made, is strong evidence in the civil case. So complaining first and suing afterwards is often the better sequence.
The Criminal Dimension
Serious cases have a criminal aspect. The Criminal Code punishes unlawfully recording personal data (Article 135), unlawfully giving, disseminating or obtaining it (Article 136), and failing to destroy data that must be destroyed (Article 138).
These offences are prosecuted of the authorities' own motion, and a criminal complaint may be made alongside the administrative and civil routes.
A complaint made straight to the Board is rejected for want of the prior application. Send your request to the data controller first, keep proof that you did, and count the thirty days from their answer — and the sixty days from your application — before complaining.
Frequently Asked Questions
Where do I complain first?
To the data controller, not the Board. The controller must deal with your application within thirty days; only then can you complain to the Board.
How long do I have to complain to the Board?
Thirty days from learning of the controller's answer, and in any event sixty days from your application.
What can I ask the controller to do?
Tell you whether your data is processed and why, identify the third parties it was transferred to, rectify inaccurate data, erase or destroy it, notify those steps to third parties, and compensate any loss.
How do I stop unsolicited marketing messages?
Use the opt-out in the message, register your objection through the national message management system, ask the controller where your data came from and require erasure, and complain to the Ministry of Trade if they continue.
Can I claim damages?
Yes, in the civil courts, independently of the complaint. A decision of the Board is strong evidence in that claim, so complaining first is often the better sequence.