Article 18 of the Personal Data Protection Law No. 6698 (“KVKK”), titled “Misdemeanors,” regulates the administrative fines imposed on those who fail to fulfill their obligations under this law.
The articles of KVKK that regulate obligations subject to administrative penalties are as follows:
- Article 10: “Obligation of the Data Controller to Inform”
- Article 12: “Obligations Regarding Data Security”
- Article 15: “Procedures and Principles for Investigation Upon Complaint or Ex Officio”
- Article 16: “Data Controllers Registry”
- Article 9/5: “Transfer of Personal Data Abroad”
The updated administrative fines applicable to those who fail to fulfill the obligations listed above have been increased at the rate of revaluation and were announced on the Personal Data Protection Authority’s website on January 3, 2025.
Accordingly, the administrative fines applicable for the years 2024-2025 are as follows:
| Legal Basis (KVKK Article) | Description | 2024 Fine Amounts (TRY) | 2025 Fine Amounts (TRY) | ||
| 58,46% | 43,93% | ||||
| 10 | Failure to fulfill the obligation to inform | 47.303 | 946.308 | 68.083 | 1.362.021 |
| 12 | Failure to fulfill data security obligations | 141.934 | 9.463.213 | 204.285 | 13.620.402 |
| 15 | Failure to comply with the Board’s decisions | 236.557 | 9.463.213 | 340.476 | 13.620.402. |
| 16 | Violation of the obligation to register and notify the Data Controllers Registry | 189.245 | 9.463.213 | 272.380 | 13.620.402 |
| 9 | Failure to fulfill the notification obligation stipulated in Article 9, paragraph 5 | 50.000 | 1.000.000 | 71.965 | 1.439.300 |
You can access the table showing the updated amounts of these fines as determined and announced for the years 2017 – 2025 at here.
Best Regards
DKND Law Firm
