KVKK Data Requests in Turkey: An English Guide for Foreign Residents

Can a foreign resident make a KVKK data request in Turkey?

Yes. Personal-data rights are not restricted to Turkish citizens. The ordinary statutory route begins with a properly addressed request to the data controller. The controller has at most thirty days to answer. A complaint to the Personal Data Protection Board is a separate stage with its own deadlines. An English customer-support conversation is not necessarily a valid statutory application: the applicable request communiqué requires the application to be in Turkish.

This guide explains how to prepare the first application and preserve evidence for a later complaint. It does not promise that every record must be disclosed or deleted. The processing, statutory exceptions and other legal obligations remain relevant. Our English legal services homepage explains how Turkish-law matters are coordinated from our Mersin office.

The application route at a glance

1. Identify the legal person responsible for processing

A familiar brand name is a starting point, not always the controller’s legal identity. Examine the privacy notice, contract, invoice and relevant service screen. A shopping platform, an independent seller and a delivery company can hold different information for different purposes. Sending every question to the platform can leave the actual issue unanswered.

Record which organisation collected the information and which organisation appears to use it now. Someone querying an inaccurate hospital contact record should distinguish the hospital operator from an appointment intermediary. An employee querying payroll information should identify the employing entity instead of assuming the group’s international parent handles every local record.

The Authority’s explanation of the obligation to inform identifies the controller, purposes, recipients, legal basis and rights as core notice information. Use the notice to formulate questions, while preserving the version displayed when the service was used. A newly updated notice does not automatically explain an earlier event.

Where responsibility remains unclear, explain the transaction and ask the recipient to clarify its role. Do not invent a registration number or address to make an application appear complete. A wrong entity creates avoidable correspondence and uncertainty about whether the necessary first-stage request reached the appropriate controller.

2. Select the right that matches the problem

Article 11 of Law No. 6698 addresses information about processing and its purpose, recipients, correction, conditional erasure or destruction, notification of relevant remedial actions to recipients, objections to adverse results produced exclusively through automated analysis, and damage caused by unlawful processing. These rights should not be treated as interchangeable labels.

An incorrect telephone number calls for a precise correction request. Unexplained disclosure calls for information about recipients and the relevant basis. A removal demand should identify the data and explain why continued processing is challenged. State the practical problem before attaching lengthy quotations from legislation.

Asking about your personal data is different from demanding every internal document held by a company. A record can contain another person’s information, protected material or information governed by another procedure. Frame the data issue accurately and address any claimed restriction instead of promising unrestricted disclosure in advance.

Identify the request’s limits. Asking a controller to explain a booking account does not automatically authorise a representative to obtain unrelated medical records or a family member’s finances. Where several people are affected, separate their identities, authority and requested remedies from the start.

3. Prepare the statutory application in Turkish

The request communiqué, Articles 4 and 5, requires Turkish and specifies accepted methods. A company’s willingness to answer routine messages in English does not remove that requirement. Prepare a Turkish application faithfully expressing the request and retain an English working copy so you understand the submission.

Translation matters particularly for distinctions between correction, deletion, explanation and an allegation of unlawful disclosure. A translated instruction to delete an account is materially different from a request to correct one field. Review dates, names, identifiers and attachments as carefully as legal terminology.

Do not describe an English email as a completed statutory application merely because an automated acknowledgement arrived. Content, language, method and recipient must be examined together. Where an earlier message was defective, assess a compliant application and its effect on the chronology rather than assuming the first email’s date controls.

4. Identify yourself without distributing unnecessary sensitive documents

The communiqué expressly addresses foreigners: nationality and a passport number or available identity number form part of the identification particulars. The application must identify the applicant, demand and notification address, together with other relevant contact particulars where available. A written application requires a signature.

Identity checks serve an important purpose: a controller should not disclose account information to an unverified stranger. Nevertheless, consider requests for additional documents carefully. Ask what is needed to establish identity and how it will be transmitted securely. Do not publish passport scans in reviews or send an entire identity bundle to an unofficial social-media account.

Where a name has several transliterations, explain the variants and connect them to the account. Include a customer, booking or employee reference when it helps locate records. That connection is more useful than sending every document accumulated during years in Turkey.

A lawyer making the application needs the appropriate evidence of authority. A message calling someone “my adviser” is not always sufficient for disclosure. The scope of a power of attorney prepared abroad should reflect the application and any subsequent complaint.

5. Draft demands that can be answered point by point

Use a short chronology followed by numbered demands. Identify your relationship with the controller, the relevant service dates, data involved and event prompting the request. Separate observations from conclusions you want investigated. Receiving an unexpected message is an observation; asserting that an employee sold a customer list requires evidence.

For information, identify the transaction and the processing concern. For correction, state the existing entry, accurate replacement and supporting document. For deletion, identify the record and explain why the purpose or asserted basis is no longer accepted. These distinctions make the expected response clearer.

Do not combine unrelated demands into one paragraph. A hospital billing disagreement, a negligence allegation and a request to correct an email address present different issues. Separating them helps prevent a data application becoming lost inside a general customer-service complaint.

State the preferred secure response channel and any immediate concern about continuing disclosure. Preserve the final application exactly as sent, including its attachment index. An editable draft alone makes it harder to demonstrate which version the recipient received when later correspondence becomes contentious.

6. Preserve proof of the application and its delivery

The application date is the date of receipt, not simply the day you draft or post it. Under Article 5(4)–(5) of the request communiqué, a written request is dated when it is served on the controller or its representative; for other accepted methods, use the date it reaches the controller. Keep that delivery record with your deadline notes.

Accepted methods include written applications and specified electronic channels, including registered electronic mail, qualifying signatures, an email address previously recorded in the controller’s system and a purpose-designed application system. The Authority’s procedural notice emphasises compliant submission and delivery evidence.

For post, keep the signed document, attachment index, posting record and delivery information together. A receipt for an envelope is more useful when connected to the particular application and recipient. For electronic submission, preserve the message, attachments and reliable acknowledgement.

A screenshot of a send button does not establish every element of delivery. A ticket number does not prove that all attachments uploaded successfully. Examine the record generated by the chosen channel and retain messages explaining technical failures.

Keep replies in their original form. A translated extract can omit the date, sender or qualifications needed to assess the response. Translation assists understanding; the original supports the application and complaint chronology. Preserve both rather than treating either as a substitute for the other.

7. Evaluate the substance of the reply

Compare the reply with your actual demands. A simple table can show each request, the answer, documents supplied and any unresolved issue. A generic statement about legal compliance does not explain a particular account event. Conversely, refusal is not necessarily inadequate when the response identifies an applicable reason.

Read retention arguments carefully. Ask which records must be kept, for which obligation, for how long and whether the disputed use differs from retention itself. A requirement to preserve an invoice should not be casually equated with permission to use every associated detail for every purpose.

The Authority’s guidance on answering applications addresses reasoned responses and implementation of accepted demands. Where a correction is accepted, check what changed and whether the practical problem was addressed. Avoid asking for unrelated material merely to prolong correspondence.

Record when the answer was learned or received and assess unresolved concerns promptly. Repeated informal follow-up messages should not be assumed to restart the time for taking the next formal step. Keep a separate deadline record outside the customer-support email thread.

8. Distinguish the response period from complaint deadlines

The controller must conclude the application within thirty days at the latest. Article 14 subjects a complaint to thirty days from learning the response and, in any event, sixty days from the initial application. The Authority’s procedural notice distinguishes timely response, late response and silence.

With a response received within the initial thirty days, do not simply wait until day sixty. The thirty-day period from learning the answer must also be respected. Where no answer arrives, the controller’s response period must expire before complaining about silence, while the sixty-day outer limit remains important.

An answer arriving after the controller’s thirty-day period does not create an unlimited fresh timetable. The Authority identifies the sixty-day period from the initial application for that situation. Preserve the actual dates instead of relying on the month printed on a translated letter.

A working chronology should identify compliant delivery, the response, when it was learned and the proposed complaint date. Calculations must be checked against the actual file and applicable rules. A holiday abroad, continuing negotiations or a request for clarification should never be assumed automatically to suspend the period.

9. Build a coherent complaint file

The application, delivery proof and any answer form the procedural core. Add a short chronology, the relevant notice, evidence of the disputed event and representation documents where a lawyer acts. State the remaining personal-data concern and the action requested within the Board’s remit.

Use a document index so the reader can find the application, delivery record, reply and event evidence. Dozens of unnamed screenshots are harder to assess. Retain complete originals even when a submission uses selected, relevant extracts.

Do not turn the complaint into a demand for remedies belonging entirely to another authority. Explain any related court proceedings and provide the necessary information. Privacy, repayment and compensation proceedings should have consistent facts, but they do not become one procedure merely because they concern the same transaction.

The Board’s role is distinct from obtaining personal damages. The Authority’s explanation of the complaint right preserves separate remedies for violations of personality rights. A fine imposed on a controller is not automatically paid to the complainant as compensation.

10. Separate deletion, account closure and evidence preservation

Account closure does not resolve every question about information already processed. Withdrawal of consent does not necessarily remove data processed on another applicable legal basis. Article 7 connects erasure or destruction with the cessation of reasons requiring processing, within the applicable framework.

Before demanding deletion of everything, identify evidence needed for another dispute. Retain invoices and payment correspondence for a financial claim. Preserve the original inaccurate entry and supporting correction documents when contesting employment information. Erasing your own records first can make a legitimate concern harder to explain.

For example, correcting information in a tenancy-management account does not itself recover security money. The financial procedure is explained separately in our rental deposit refund guide. Likewise, obtaining payroll information is not the same as recovering unpaid wages in Turkey. Keep remedies distinct even where they share evidence.

11. A hypothetical incorrect-email case

Consider an illustrative foreign resident who discovers that a private healthcare provider is sending appointment notices to an old email address belonging to another person. This is an invented example, not a client story or a reported decision.

The resident records the correct details, saves relevant messages and identifies the operating entity. A Turkish application asks the controller to examine and correct the entry and explain the relevant processing and recipients. The resident avoids publishing health documents online to demonstrate the error.

The application and delivery record are kept. When the provider replies, the resident checks whether the field was corrected and whether the explanation addresses the concern. If material issues remain, the response and initial application dates determine the assessment of the complaint period.

The example illustrates why precise remedies matter. Deleting all medical records is not necessarily the answer to an incorrect contact field and can overlook retention obligations. Conversely, changing a contact detail does not automatically explain information already sent to somebody else.

12. Coordinate the process while living abroad

Prepare reliable contact details for the entire process. A Turkish phone number that stops working after departure can complicate follow-up. Use a secure document channel and retain originals. When foreign documents need formal use, our apostille and certified translation guide explains the separate preparation questions.

Bakırcı & Keskin Law Office operates from its physical offices in Istanbul and Mersin. Personal-data matters involving controllers elsewhere in Turkey are assessed and coordinated from our Istanbul and Mersin offices within the applicable procedure and agreed mandate. English communication supports understanding; formal applications follow the language and form required by Turkish law.

Frequently asked questions

Must I be a Turkish citizen?

No. The request procedure expressly addresses foreign natural persons. The processing, applicable law and relevant exceptions still need examination.

Is an English email sufficient?

Do not assume so. The communiqué requires Turkish and specifies submission methods. Customer-service communication and a statutory application are not necessarily equivalent.

Can I complain immediately to the Board?

The ordinary complaint route requires first applying to the controller. Rejection, inadequate response or expiry of the response period then determines the next step.

Does a late reply restart the whole period?

No. It does not remove the sixty-day outer period measured from the initial application. Keep both application and response dates.

Can a lawyer represent me?

Yes, with appropriate authority and supporting documentation. The representation should identify the records and proceedings within its scope.

Must every invoice be deleted after account closure?

No. Account closure does not override every retention obligation. Identify the records, legal basis, retention reason and disputed use.

Does a Board fine become my compensation?

No. Administrative sanctions and individual compensation claims are different. Damages require their own legal and evidential assessment.

Does messaging the office stop a deadline?

No. An enquiry does not establish representation or preserve a time limit. Identify urgent dates expressly and confirm the agreed action.

Official sources

Personal Data Protection Law No. 6698; request communiqué; and the Authority’s complaint procedure notice. Official English translations assist understanding; Turkish legislation controls. This page is general information and does not guarantee an outcome.