Calculators
KVKK Administrative Fine Lookup (2026)
Article 18 of the Personal Data Protection Act (Law No. 6698) sets administrative fines for certain violations by data controllers. Select a violation type below to see the 2026 fine range, updated by the annual revaluation rate.
- Kanuni dayanak
- KVKK m.12, m.18/1-b
- Alt sınır (2026)
- ₺256.357,00
- Üst sınır (2026)
- ₺17.092.242,00
Kişisel verilerin hukuka aykırı işlenmesini ve verilere hukuka aykırı erişimi önlemek, muhafazasını sağlamak için gerekli teknik/idari tedbirleri almamak (KVKK m.12, m.18/1-b).
Bu tutarlar 2026 yılı için yeniden değerleme oranıyla güncellenmiş kanuni sınırlardır. Kişisel Verileri Koruma Kurulu, somut olayda ihlalin ağırlığı, kusur, tekrar durumu gibi unsurları değerlendirerek bu aralık içinde kesin cezayı belirler — burada gösterilen bir tahmin veya garanti değildir. Aynı eylem birden fazla ihlal türüne girebilir; bu durumda Kurul her biri için ayrı ceza uygulayabilir.
How Are KVKK Fines Determined?
Law No. 6698 sets a fixed minimum and maximum for each violation type; the Personal Data Protection Board determines the exact fine within that range, weighing the severity and duration of the violation, the degree of fault, and any repetition. The limits are updated annually by the revaluation rate under the Tax Procedure Act.
Can More Than One Fine Apply to the Same Incident?
Yes. A single data breach can constitute both a breach of the duty to inform and a breach of data security obligations; the Board may then impose a separate fine for each violation type, so the combined total can exceed any single category's maximum.
Can a Fine Be Challenged?
An action to annul the Board's decision may be filed with the administrative court within 60 days of notification. The court reviews the reasoning, proportionality, and the way the fine amount was calculated.
Source Legislation
The links below go to the official, current text of the law on the Turkish Presidency's Legislation Information System.
Last updated: September 11, 2026
Frequently Asked Questions
Do KVKK fines change every year?
Yes, the limits are updated annually based on the previous year's revaluation rate; the figures on this page apply for 2026.
Is the fine imposed on the company or the manager personally?
The administrative fine is imposed on the data controller — the legal or natural person responsible; a manager's personal liability is a separate legal question.
Is there a lower fine range for small businesses?
No, the law does not set a separate minimum by business size, though the Board may consider scale as a factor in setting the exact amount.
Can a warning be given instead of a fine?
For some first-time, minor violations, the Board may grant a period to remedy the breach instead of imposing a fine; this depends on the Board's assessment of the specific case.
Is VERBİS registration mandatory for everyone?
No; certain data controllers are exempt from VERBİS registration based on criteria set by the Board, such as annual employee count, balance sheet size, or main field of activity.