Companies operating in Türkiye must comply with Turkish Personal Data Protection Law No. 6698, commonly known as the KVKK. This applies not only to companies established in Türkiye, but may also affect foreign businesses that process the personal data of employees, customers, users or business partners in connection with their Turkish operations. HARVEY ARASAN has […]
Public Event Footage and Privacy: A Look from Turkey
In the summer of 2025, data protection became a hot topic at public events. Concerts, festivals, and sports games sparked debate about what happens to images and videos of people in the crowd. The issue has drawn global attention, especially under the rules of the GDPR in Europe. Most international lawyers agree that the GDPR […]
Turkish Constitutional Court Confirms Right to Protection of Personal Data and Imposes Positive Obligations on the State
In a recent ruling, Turkey’s Constitutional Court clarified the scope of constitutional protection for personal data. On 20 March 2025, the Court issued an important decision (Application No. 2020/15944), confirming that the right to protection of personal data, set out in Article 20 of the Turkish Constitution as part of the right to respect for […]
New Cybersecurity Management Obligations and Liabilities under NIS2 Directive
The Directive (EU) 2022/2555 on measures for a common level of cybersecurity across the Union (the “NIS2 Directive“) was published in December 2022 and entered into force on 16 January 2023. It repealed the previous Directive (EU) 2016/1148 on measures for a high common level of security of network and information systems across the Union, […]
Artificial Intelligence-Based Services and Security of Company Data
While we talk about the many benefits of AI technology, we should not ignore the data protection and privacy concerns raised by services that use this technology. After all, artificial intelligence is a technology that feeds on the data provided by users and constantly trains itself. Chatbots, which are very popular nowadays, use the content […]
New Adequacy Decision for EU-US Data Privacy Framework
The European Commission has adopted an adequacy decision for the European Union – United States (EU-US Data Privacy Framework (DPF). Within the framework of this adequacy decision; starting from July 10, 2023, personal data will be freely and securely transferred between the European Union and participating United States companies. Background of the decision Since 2021, […]
