With the announcement published by the Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority), the minimum and maximum amounts of administrative fines applicable under the Personal Data Protection Law No. 6698 (KVKK) have been updated based on the revaluation rate for 2026. The revised amounts entered into force as of 1 January 2026.
Within this scope, the administrative fines that may be imposed on data controllers and data processors have been determined as follows:
-Failure to fulfil the obligation to inform (privacy notice obligation):
TRY 85,437 – TRY 1,709,200
-Breach of obligations regarding the security of personal data:
TRY 256,357 – TRY 17,092,242
-Failure to comply with decisions of the Personal Data Protection Board:
TRY 427,263 – TRY 17,092,242
-Non-compliance with the obligation to register with and notify VERBİS (Data Controllers’ Registry):
TRY 341,809 – TRY 17,092,242
-Breach of the notification obligation regarding standard contractual clauses:
TRY 90,308 – TRY 1,806,177
With this update, it is of particular importance for natural and legal persons engaged in personal data processing activities to review their obligations under the KVKK and to strengthen their compliance processes.
