A KVKK Guide for Public Institutions

The Personal Data Protection Authority has published a compliance guide clarifying the position of public institutions, public bodies and professional organisations of a public character under Law No. 6698. The FIOR note draws out the three structural points for the public sector.

In the public sector the controller is not a department head or the IT unit, but the legal person of the institution itself. Explicit consent is not the rule but a last resort: seeking consent where a statutory basis already exists is an abuse of right. The sanction is not an administrative fine but disciplinary measures, and it reaches not only the person who carried out the act but those responsible for technical and organisational measures.

From 1 June 2024, transfers abroad follow three steps: an adequacy decision, appropriate safeguards, and exceptional cases. A breach must be notified to the Board within 72 hours of becoming aware of it.

Institutions that back this frame with an inventory, notices, security measures and a breach-response plan strengthen both legal compliance and public trust. Our summary of the guide is below.