KVKK (Turkish data protection law)
Definition
KVKK is short for Türkiye's Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu). In everyday use it also refers to the Personal Data Protection Authority that enforces it.
On this page
What does KVKK mean for a clinic?
Law No. 6698 was published in the Official Gazette on 7 April 2016. A prospective patient's name, phone number, e-mail address and photos are personal data; their health information is special category personal data, subject to stricter rules. The clinic decides why and how this data is processed, which makes it the data controller.
The law mainly asks a controller to inform people when collecting their data, to base processing on one of the conditions in the law (explicit consent where needed), to keep data secure and for no longer than necessary, to resolve people's applications free of charge within thirty days at the latest, and to register with VERBİS unless exempt.
Law No. 7499 of 2 March 2024 changed the conditions for processing special category data and the rules on transfers abroad, with effect from 1 June 2024.
The main rights of the individual
- To learn whether their data is processed and ask for information about it
- To learn the purpose of processing and the third parties the data goes to
- To have incomplete or inaccurate data corrected
- To have data erased or destroyed where the conditions are met
- To claim compensation for damage caused by unlawful processing
Sources
- Law No. 6698 on the Protection of Personal Data (Turkish text) — Mevzuat Bilgi Sistemi, Official Gazette, 7 April 2016
Related reading
30-day free trial
Try Klinikbook with your own team
Every feature is open for 30 days, and no card is needed to start.