According to Article 18 of the Personal Data Protection Law No. 6698 ('Law'), data controllers who fail to fulfill their obligations arising from the law shall be subject to administrative fines ranging from 5,000.00 TL to 1,000,000.00 TL.
These amounts specified in the Law are increased annually according to the revaluation rate. We share the current fines in the table based on the rates projected for 2025 and in accordance with the announcement of the Personal Data Protection Authority.
| Article | Relevant Legal Provision | Penalty Amount |
|---|---|---|
| Failure to Fulfill Information Obligation | KVKK md.18/1-a,10 | 85.437 TL - 1.709.200 TL |
| Failure to Fulfill Data Security Obligations | KVKK md.18/1-b,12 | 256.357 TL - 17.092.242 TL |
| Failure to Comply with Board Decisions | KVKK md.18/1-c,15 | 427.263 TL - 17.092.242 TL |
| Violation of VERBIS Registration and Notification Obligation | KVKK md.18/1-ç,16 | 341.809 TL - 17.092.242 TL |
| Failure to Notify the Institution of Standard Contracts within 5 Business Days | KVKK md.18/1-d,9 | 90.308 TL - 1.806.177 TL |