Data Protection & Cybercrime Lawyer in Istanbul, Turkey

An IT lawyer in Turkey advises on KVKK (data protection) compliance, responds to data breaches and regulatory notifications, brings or defends cybercrime complaints, and pursues the removal of unlawful online content. For a foreign or multinational business, a data protection lawyer in Istanbul also typically advises on how KVKK compliance interacts with the company's obligations under other jurisdictions' data protection laws, such as the GDPR.

Individuals usually come to an internet lawyer in Istanbul with a specific problem: a defamatory post or review on a Turkish site, private photos shared without consent, a hacked social media or e-mail account, money lost to an online scam, a bank or crypto account frozen during a fraud investigation, or a dispute with an online seller. Many of these files have both a criminal side, a complaint to the prosecutor, and a civil side, a court action for removal or compensation, and the two can run in parallel.

The answer depends on what the content is. Where a post, photo or video violates private life, a fast administrative and judicial route still exists under Article 9/A of Law No. 5651, explained in the next section. Where the problem is defamation, insult, false allegations or an unfair article that harms a person's reputation, the former fast-track route under Article 9 of the same Law is no longer available. The routes that remain are a request to the website or platform, a civil action under the Turkish Civil Code with an interim injunction, and a criminal complaint.

Where online content violates private life, for example intimate images, private messages or personal details published without consent, Article 9/A of Law No. 5651 allows the person concerned to apply directly to the Cyber Security Presidency and ask for access to the content to be blocked. Until Law No. 7590 of July 2026, these applications were made to the Information and Communication Technologies Authority (BTK).

The privacy route blocks access from Turkey; it does not decide compensation or punishment. A criminal complaint for violation of privacy, and a civil action for damages, can run alongside it.

Law No. 5651 places special duties on social network providers, defined as those that allow users to create, view or share content such as text, images, sound and location for social interaction (Article 2). Most of these duties apply to providers with more than one million daily accesses from Turkey and are set out in Additional Article 4.

Insult (hakaret) is punishable by three months to two years' imprisonment or a judicial fine, including where it is committed through a written, voice or video message addressed to the victim (TCK Article 125). Where it is committed publicly, for example in a post open to everyone, the penalty is increased by one sixth. Except for insult against a public official because of his or her duty, insult is prosecuted only on the victim's complaint (Article 131).

The complaint has to be filed within six months of learning of the act and the offender and, for insult, in any case within two years of the act (TCK Article 73). Insult is excluded from victim-offender conciliation (CMK Article 253/3) and, except for insult against a public official because of his or her duty, falls within advance payment (önödeme): if the suspect pays the amount notified by the prosecutor, no public prosecution is brought (TCK Article 75). The criminal route therefore does not by itself remove the post; the civil route described above is used for that.

For a foreigner living abroad who is targeted on a Turkish website, two questions arise: whether a Turkish court can hear the case, and which country's law it applies. The international jurisdiction of Turkish courts is determined by the domestic venue rules (Law No. 5718 on International Private and Procedural Law, known as MÖHUK, Article 40). For torts, the court of the place where the act was committed, where the damage occurred or may occur, or where the injured person is domiciled is competent (HMK Article 16), and personality-rights actions can also be filed at the defendant's domicile (TMK Article 25).

On applicable law, claims arising from violations of personality rights through the press, radio, television, the internet or other mass media are governed, at the injured person's choice, by the law of the injured person's habitual residence or the law of the country where the damage occurred, in both cases if the wrongdoer could have known that the damage would occur there, or by the law of the country of the wrongdoer's place of business or habitual residence (MÖHUK Article 35). The same rule applies to claims arising from violations of personality through the processing of personal data (Article 35/3).

KVKK applies to natural persons whose personal data is processed and to the natural and legal persons who process that data wholly or partly by automated means, or by non-automated means as part of a filing system (Article 2). Unlike the GDPR, the law does not contain a separate article on territorial reach. Whether a foreign company's processing falls under KVKK is therefore assessed on the facts, for example where it collects data from people in Turkey, has customers or employees in Turkey, or receives data from a Turkish group company. The secondary legislation on the data controllers' registry expressly provides for data controllers not established in Turkey.

KVKK protects only natural persons: personal data means any information relating to an identified or identifiable natural person (Article 3). Company information as such is not personal data, but the names and contact details of employees and contact persons are. Questions of group structure and intra-group agreements are also covered on our corporate law page.

In practice, KVKK compliance means knowing what personal data is held, informing the people concerned, having a legal basis for each processing activity, keeping the data secure and, unless exempt, registering with the Data Controllers' Registry (VERBİS). Data that was lawfully processed has to be deleted, destroyed or anonymised once the reasons for processing no longer exist, either on the controller's own initiative or at the data subject's request (Article 7). Employee data is a frequent source of disputes, and its employment side is covered on our labour law page.

Under Article 16 of KVKK, natural and legal persons who process personal data register with the Data Controllers' Registry before they start processing, unless the Board has exempted them on objective criteria such as the nature and number of the data, whether processing arises from law, or transfers to third parties. The registration states the identity and address of the controller and any representative, the purposes of processing, the groups of data subjects and data categories, the recipients, data planned to be transferred abroad, the security measures taken and the maximum retention period; changes are notified immediately (Article 16/3 and 16/4).

The exemptions are set by Board decisions, not by the law itself. Among other exemptions, under Board Decision No. 2018/87 as amended by Decision No. 2025/1572 published in the Official Gazette on 1 October 2025, controllers with fewer than 50 employees a year and an annual balance-sheet total below 100 million Turkish lira are exempt if their main activity is not processing special categories of data; where the main activity is processing special categories of data, the exemption applies only below 10 employees and a balance-sheet total of 10 million Turkish lira. Failing to register when required is a separate ground for an administrative fine (Article 18/1-ç).

Article 9 of KVKK on transfers abroad was rewritten by Law No. 7499 and has applied since 1 June 2024; the old rule could still be used alongside the new one until 1 September 2024 (Provisional Article 3). The new system has three layers. First, data can be transferred where one of the processing conditions in Articles 5 or 6 exists and the Board has issued an adequacy decision for the country, sectors within it or the international organisation (Article 9/1). Adequacy decisions are published in the Official Gazette and reviewed at least every four years.

Second, without an adequacy decision, data can be transferred where a processing condition exists, the data subject can exercise his or her rights and has effective remedies in the destination country, and one of the appropriate safeguards is provided: an agreement between public bodies approved by the Board, binding corporate rules approved by the Board, a standard contract announced by the Board, or a written undertaking with the Board's permission (Article 9/4). These rules apply to data controllers and to data processors.

KVKK was modelled on European data protection law, so an international company with a GDPR programme already has much of the structure in place. In broad terms, the main differences are these: KVKK contains no separate territorial-scope article; a public registry of data controllers (VERBİS) exists, with exemptions set by Board decisions; a data subject can complain to the Board only after first applying to the data controller (Article 14/2); and the controller answers requests within 30 days (Article 13/2).

Breach notification to individuals is not limited by a high-risk threshold in the text of KVKK (Article 12/5), and the 72-hour period for notifying the Board comes from a Board decision rather than from the law. Cross-border transfers follow the Turkish list of safeguards, including the Board's own standard contract and its notification within five business days. Administrative fines are set in Turkish lira within ranges in the law, increased every year by the revaluation rate, rather than as a percentage of turnover.

Everyone can apply to a data controller and exercise the rights listed in Article 11 of KVKK: to learn whether personal data about him or her is processed; to request information if it is; to learn the purpose of processing and whether data is used accordingly; to know the third parties in Turkey or abroad to whom data is transferred; to request correction of incomplete or inaccurate data; to request deletion or destruction under the conditions in Article 7; to request that corrections and deletions be notified to the third parties who received the data; to object to an adverse result produced exclusively by automated analysis; and to claim compensation for damage caused by unlawful processing.

Those whose personality rights are violated also keep their right to compensation under the general provisions (Article 14/3), which links data protection disputes to the civil-court route described above.

The KVKK procedure has two stages, and the second cannot be skipped: a complaint to the Board cannot be made before the application to the data controller has been made (Article 14/2).

Article 12/5 of KVKK provides that, where processed personal data is obtained by others through unlawful means, the data controller notifies the person concerned and the Board as soon as possible, and the Board can announce the breach on its website or by another method if necessary. The law itself does not mention 72 hours. The 72-hour period comes from the Board's Decision No. 2019/10 of 24 January 2019 on the procedures for breach notification.

Article 18 of KVKK provides administrative fines for failing to meet the duty to inform (Article 10), failing to meet data security obligations (Article 12), failing to comply with Board decisions (Article 15), breaching the registry obligations (Article 16) and failing to notify a standard contract (Article 9/5). The Board sets the amount within the range for each category, and the ranges are increased every year by the revaluation rate (Misdemeanours Law No. 5326, Article 17/7); the current figures can be checked with our KVKK fine lookup. Where the violation occurs within a public body or a professional organisation with public-body status, disciplinary proceedings are taken against the officials concerned on the Board's notification (Article 18/4).

Since 1 June 2024, administrative fines imposed by the Board are challenged before the administrative courts (Article 18/3, added by Law No. 7499). The general period for an administrative lawsuit is sixty days from written notification (Administrative Procedure Law, İYUK, Article 7). Applications that were already pending before criminal judgeships of peace on 1 June 2024 continued to be heard there (Provisional Article 3). The old rule of a fifteen-day objection to the criminal judgeship of peace therefore no longer applies to new KVKK fines.

Yes. KVKK refers criminal liability to Articles 135 to 140 of the Turkish Penal Code (KVKK Article 17). Unlawfully recording personal data is punishable by one to three years' imprisonment, increased by half where the data concerns political, philosophical or religious views, racial origin, sexual life, health or trade-union connections (TCK Article 135). Unlawfully giving personal data to another person, spreading it or obtaining it is punishable by two to four years (Article 136). Failing to destroy data in the system after the legal periods have expired is punishable by one to two years (Article 138), and KVKK applies this offence to those who do not delete or anonymise data as required (KVKK Article 17/2).

Violating a person's private life is punishable by one to three years, doubled where it is done by recording images or sounds, and unlawfully disclosing images or sounds of a person's private life is punishable by two to five years (TCK Article 134). These penalties increase by half where the offence is committed by a public official abusing his or her authority or by using the advantages of a profession (Article 137). Violation of privacy under Article 134 is prosecuted on complaint, while the data offences in Articles 135, 136 and 138 are prosecuted ex officio (Article 139).

Taking over someone's social media, e-mail or cloud account without permission is usually examined as unlawful access to an information system. Where the account is then used to ask the person's contacts for money, qualified fraud through information systems can also arise. Legal support is provided both to victims and, as defence, to suspects and defendants in such files; in both roles, the way the digital evidence was collected and kept is often central.

Fraud committed by using information systems, banks or credit institutions as a tool, or by a person presenting himself or herself as a public official or as an employee of a bank, insurance company or credit institution, is qualified fraud punishable by three to ten years' imprisonment and a judicial fine of up to 5,000 days (TCK Article 158/1-f and l). In these cases the minimum prison term is four years and the judicial fine cannot be less than twice the benefit obtained (Article 158/1, last sentence). The penalty increases by half where three or more people act together and doubles where the offence is committed within a criminal organisation (Article 158/3). Theft committed by using information systems, such as moving money out of someone's online banking, is qualified theft punishable by five to ten years (Article 142/2-e).

A complaint can be made to the chief public prosecutor's office or to the police, in writing or orally to be recorded (CMK Article 158/1 and 158/5). For offences committed by using information systems, banks or credit institutions, or bank or credit cards, the courts of the victim's place of residence are also competent (CMK Article 12/6). The wider criminal procedure is explained on our criminal law page.

Since Law No. 7571 of 24 December 2025, where there is reasonable suspicion of theft through information systems, fraud through information systems or banks, fraud by impersonating officials or bank staff, or misuse of bank cards, a bank, payment service provider or crypto-asset service provider can suspend any account used in the offence for up to 48 hours (CMK Article 128/A(1)). The suspension and the account movements are reported immediately to the chief public prosecutor's office, and the account holder is also informed. The account holder can apply to the prosecutor to lift the suspension, and the prosecutor decides within 24 hours (Article 128/A(2)).

During the suspension, the proceeds of the offence in the account can be seized by a judge's decision or, where delay would be harmful, by the prosecutor's written order; a seizure without a judge's decision is submitted for approval within 24 hours, and if the judge does not decide within 48 hours the seizure is lifted automatically (Article 128/A(4)). Proceeds found to belong to the victim are returned during the investigation or trial (Article 128/A(5)). Separately, the Financial Crimes Investigation Board (MASAK) can suspend transactions suspected of money laundering or terrorist financing for seven business days on the Minister's authority (Law No. 5549, Article 19/A), and a judge can order the seizure of assets for listed offences under CMK Article 128.

An objection to a judge's seizure decision is filed within two weeks of learning of it (CMK Article 268). The practical side for foreigners is covered in Bank Account Frozen in Turkey.

Law No. 7518 of 26 June 2024 brought crypto-asset service providers under the Capital Markets Law No. 6362. A crypto-asset service provider needs the permission of the Capital Markets Board (SPK) to be established and to operate (Article 35/B). Contract terms that remove or limit the provider's liability towards its customers are invalid, and platforms set up internal mechanisms to resolve customers' objections and complaints (Article 35/C(1)). Disputes between platforms and their customers are subject to the general provisions, a licence from the Board does not mean that transactions are under public assurance, and crypto assets are not covered by the investor compensation scheme (Article 35/C(4)).

A foreign platform's activities directed at people resident in Turkey, for example through a workplace in Turkey, a Turkish-language website or promotion in Turkey, count as unauthorised crypto-asset service provision (Article 99/A(1)), and the Board can order removal or access blocking of related online content (Article 99/A(3)). Operating as a crypto-asset service provider without permission is punishable by three to five years' imprisonment and a judicial fine of 5,000 to 10,000 days (Article 109/A). Peer-to-peer crypto trades that lead to bank account freezes are explained in Crypto P2P Trades and Frozen Bank Accounts in Turkey.

In online sales to consumers, the seller informs the consumer before the contract on the matters set out in the regulation, and the burden of proving that this was done lies with the seller (Consumer Protection Law No. 6502, Article 48/2). Except for goods prepared to the consumer's specifications, the seller delivers within the promised time and in any event within thirty days, failing which the consumer can terminate the contract (Article 48/3). Marketplaces that act as intermediaries are jointly liable with the seller for pre-contractual information, its confirmation and proof (Article 48/6-a).

Consumer disputes below an amount updated every year go to consumer arbitration committees (tüketici hakem heyeti), where an application is compulsory (Article 68). Above that amount, they go to the consumer courts, and mediation is a precondition before filing (Article 73/A). Consumer rights in general are covered on our consumer law page; disputes between businesses, such as a seller's dispute with a marketplace, fall under commercial law.

For content that gives sufficient suspicion of certain listed offences, such as encouraging suicide, child sexual abuse, facilitating drug use, obscenity, prostitution, providing a place for gambling and illegal betting, a judge (or the court at trial) orders removal of the content or access blocking. In urgent cases the prosecutor can order it, subject to a judge's approval within 24 hours. These decisions are implemented within four hours at the latest (Law No. 5651, Article 8). A blocking decision given as a protective measure can be challenged by objection under the Code of Criminal Procedure (Article 8/2).

Other bodies also order blocks under their own laws, for example the Capital Markets Board for unauthorised crypto or investment services (Law No. 6362, Article 99/A). The route to challenge a block therefore depends on who ordered it and on what basis; decisions of administrative bodies are generally challenged before the administrative courts.

Under the Code of Civil Procedure, data in electronic form, photographs, images and sound recordings are documents capable of proving facts (HMK Article 199). Screenshots that show the URL, date, time and the profile or account name, together with saved links and original files, are the usual starting point. Evidence obtained unlawfully cannot be taken into account by a civil court (HMK Article 189/2), and in criminal cases the accusation can be proven only with lawfully obtained evidence (CMK Article 217/2). Evidence gathered by secretly recording private conversations or by entering someone else's account can therefore be excluded, and gathering it that way can itself be an offence.

In criminal investigations, computers, programs and files can be searched and copied only on a judge's decision, or on the prosecutor's order where delay would be harmful, with that order submitted to a judge within 24 hours. When devices are seized, all data is backed up and a copy of the backup is given to the suspect or the lawyer (CMK Article 134). Hosting providers keep traffic data, such as IP records, for a period set by regulation of not less than one and not more than two years (Law No. 5651, Article 5/3).

A victim does not have to be in Turkey to start a criminal file. A complaint is filed with the chief public prosecutor's office or the police, and can be made through a Turkish lawyer acting under a power of attorney (CMK Article 158). For offences committed abroad that have to be prosecuted in Turkey, a complaint can also be made at Turkish embassies and consulates (Article 158/3). A power of attorney is usually issued at a Turkish consulate or before a local notary with an apostille and a sworn translation, depending on the country.

A foreigner can also be on the other side of an online file, as a suspect. In that case the file can lead to police questioning, a travel ban or effects on a residence permit; see Arrested in Turkey as a Foreigner, Exit Ban in Turkey and our foreigners law page.

Some steps have statutory deadlines measured in hours, such as the 24-hour and 48-hour periods in the privacy route and the 48-hour bank suspension. Other steps have no fixed duration: a KVKK complaint, a criminal investigation into an anonymous account or a civil action for removal and compensation can take months or longer, depending on the court, expert examinations and whether information has to be obtained from platforms abroad. It depends on the file, and no realistic estimate can be given before the documents are reviewed. Once a court gives judgment, the periods for appeal run from service of the reasoned decision, and the appeal deadline calculator gives a first estimate of the last day.

Costs typically include court fees and expenses, expert fees in civil cases, notary or translation costs, and the lawyer's fee. Lawyers' fees in Turkey are subject to the minimum fee tariff prepared by the Union of Turkish Bar Associations, and fees below the tariff are not allowed (Attorneyship Law No. 1136, Articles 164 and 168). The fee is agreed in writing before work begins.

The Personal Data Protection Authority is based in Ankara (KVKK Article 19/3), and the Access Providers' Union that implements blocking decisions also has its seat in Ankara (Law No. 5651, Article 6/A). Since 1 June 2024, KVKK fines are challenged before the administrative courts within sixty days of notification (KVKK Article 18/3; İYUK Article 7); as a general rule, the competent administrative court is the one where the authority that made the decision is located (İYUK Article 32), which for the Board means Ankara. Cybercrime cases are heard where the offence was committed (Article 12 of the Code of Criminal Procedure), and for offences committed through information systems, banks or cards the courts of the victim's residence are also competent.

Our office is in Istanbul. As a data protection lawyer in Istanbul, the office follows files before the authorities and courts in Ankara through UYAP, the national e-filing system, and attends hearings there as needed. A data protection lawyer in Turkey registered with a Turkish bar can act in every city, so there is no need to find a separate lawyer in Ankara for each step. The range of KVKK fines can be checked with our KVKK fine lookup.