Data Subject Access Requests in Turkey: Handling KVKK Requests Within 30 Days, Step by Step

A data subject access request in Turkey is an application in which an employee, applicant or customer exercises their Article 11 rights under the Personal Data Protection Law (KVKK). The controller must conclude it free of charge within 30 days, which requires a defined intake channel, an identity check and a workflow that gathers the person's data from every system.

How a request actually reaches your organisation

A former employee writes to the general inbox asking what records you still hold. A customer asks to be removed from a mailing list and to have their details deleted. A visitor asks for the CCTV footage recorded at reception. The message lands with the front desk, a sales rep or HR, and nobody recognises it as a legal request with a deadline attached.

That is where the trouble starts. The 30 days run from the date the request reaches the organisation, not from the date it reaches the right desk. Under the communiqué on applications to the data controller (Turkish), a written request is dated from when the document is served on the controller, and a request made by other means from when it reaches the controller.

Meanwhile, a person's data is scattered across the ERP, CRM, payroll, attendance logs, mailboxes, shared-drive spreadsheets and backups. A team that does not know where to look sends an incomplete or late answer.

For readers outside Turkey, a quick orientation. KVKK (Law No. 6698) is Turkey's general data protection law, broadly modelled on the EU's pre-GDPR framework, and it is enforced by the Personal Data Protection Authority and its decision-making Board. This article covers the operational side of answering requests; the wider programme is in our KVKK compliance roadmap, and the policy behind deletion is in our guide to data retention and disposal.

What an unanswered request costs

An individual whose request goes nowhere complains to the Board, and the Authority's own figures show this route is well used:

In 2025, 689 of the notices and complaints filed with Türkiye's Personal Data Protection Authority, about 6%, concerned data controllers failing to fulfil data subject requests; a further 551 concerned failure to erase, destroy or anonymise data, and 53 concerned the right to be forgotten. (KVKK Annual Activity Report 2025)

Of the 12,512 notices and complaints received in 2025, 7,677 (64%) were rejected on procedural grounds; the report notes that individuals must first apply to the data controller before they can exercise their rights through the Board (KVKK Annual Activity Report 2025). An admissible complaint therefore often comes with your reply in the file, so write every reply assuming the Board may read it.

Individuals also know how to check up on you. According to the KVKK Annual Activity Report 2025, public queries of VERBIS, the registry of data controllers, reached a cumulative 1,985,918 by 31 December 2025. A requester can compare your registry filing with your reply, so your VERBIS registration and your answer need to describe the same categories of data and recipients.

The deadline itself is not negotiable. Under Article 13 of the Personal Data Protection Law, the controller must conclude the request as soon as possible and within 30 days at the latest, free of charge unless the action involves an additional cost under the Board's fee schedule. If the request is refused, the answer is inadequate or no answer arrives in time, the individual may complain to the Board under Article 14, within 30 days of learning of the reply and in any case within 60 days of the request date.

Data subject rights under KVKK: what people can ask for

Article 11 lists nine rights. Some are met with a clear summary, others require changes in live systems; the table helps whoever triages a request route it to the right owner.

The recipients question catches many organisations unprepared. If you use a service provider abroad, your answer must be consistent with Turkey's rules on cross-border data transfers. Requests for camera footage need other people blurred or masked; our article on CCTV recording and KVKK covers the specifics.

Handling a data subject access request in Turkey: 7 steps in 30 days

Tying requests to a process rather than to individuals protects the deadline. This workflow is simple enough for a mid-sized company without a dedicated privacy team:

1. Define and publish your intake channels. Under the communiqué, a request may be made in writing or through registered electronic mail (KEP, Turkey's legally binding email service), a secure electronic signature, a mobile signature, an email address the person previously gave you and which is on your records, or software or an app built for the purpose. List the channels in your privacy notice, and if you have a KEP address, monitor it for requests too.
2. Log every request on the day it arrives. Record the date, channel, type of request and owner. Write a short internal instruction so that anything reaching the general inbox, reception or HR is routed into that log.
3. Verify identity, proportionately. Sending a reply to the wrong person discloses personal data to someone unauthorised and can turn into a data breach. Article 5 of the communiqué requires a request to state the person's full name (and signature, if made in writing), Turkish ID number (or, for foreign nationals, nationality and passport number or ID number where available), residential or business address for service, any email, phone and fax number for notifications, and the subject of the request; match these against your records. Demanding a full copy of an ID card is usually more than necessary.
4. Clarify the scope. With a broad request such as "delete everything you have on me", ask which relationship is meant: customer, former employee or applicant. Resolving ambiguity early cuts down the search effort.
5. Collect the data from each system. Assign an owner to every system in the personal data inventory and have them attach a dated search result to the log. Mailboxes and shared folders are the places most often missed; our piece on email archiving and data protection shows how a structured archive makes that search manageable.
6. Decide and draft the reply. If you accept, say exactly what you did; if you refuse, give the legal ground. The communiqué requires the reply to include the controller's details, the requester's identity and contact details, the subject of the request and the controller's explanation. Use templates, but fill them in for each case.
7. Keep the evidence and measure. Keep the request, correspondence, search results and proof of dispatch in one file. Once a month, review average response time, overdue cases and the rights most often exercised.

Erasure requests raise a separate question about backups. Deleting a single record from a backup is often impossible; in that case the reply should explain that the backup is kept out of use and will be destroyed when its retention period ends. If that rule is not written into your retention policy and backup procedure, the same debate starts over with every erasure request.

Common mistakes: a pre-send checklist

Before anything goes out, check the following:

• Deadline: was the start date logged as the day the request arrived, and is day 30 still ahead?
• Coverage: were all systems in the inventory searched, including mailboxes and shared drives?
• Third-party data: does the reply expose colleagues, other customers or bystanders in footage?
• Consistency: does it state the same purposes and recipients as your privacy notice and VERBIS filing?
• Reasons: where you refuse or partly accept, is the legal ground explicit?
• Secure delivery: is the reply going through a verified channel, encrypted where needed?

Without a workflow, the biggest risk is a request disappearing into one person's inbox. On the data side the problem is usually governance: if nobody owns a dataset, nobody searches it. We cover that ownership model in our data governance framework guide.

How we handle this at Digital Bridge

We start with discovery. Together we map recent requests, current channels and every system that holds personal data; where the inventory has gaps, we close them first as part of our data protection compliance work. The output is a responsibility matrix showing who searches which system for each type of request, plus reply templates.

Next comes a pilot. We rerun one or two past requests through the new workflow and measure time taken and gaps found. To keep each case with its attachments and full action history, we set up a document management system, so the file, the deadline counter and proof of the reply sit in one place. Our guide to the paperless office explains why correspondence scattered across paper and email goes missing.

Mailboxes and file archives are the two places searches most often miss. SmartFiles business file management scans readable documents for values such as national ID numbers, IBANs, phone numbers and email addresses, showing which folders hold personal data, while SmartMail business email searches every folder of a mailbox at once. Where the request comes from an employee, the Smart360 organisation panel has a documented KVKK deletion step, and a person deleted in Smart360 also has their name and personal details removed from SmartPass and their card cancelled.

Then integration. If you need a request form with an identity step on your website, we build it as custom web software, and we prepare person-level searches across your ERP, CRM and HR systems. Our cyber security team works on the same project to cover secure delivery, access rights and audit logs; our SME cyber security checklist is a good starting point for the baseline controls. If a request turns into a suspected breach, we connect it to the plan in our 72-hour breach notification guide.

You can find related articles on our Cyber Security & Compliance topic page.

Next step

Think about the requests you received in the last three months: which channel did they arrive through, who answered and how many days did each take? If those answers are unclear, the process depends on individuals rather than on a system. Get in touch and we will review your current request workflow and data inventory with you, then prepare a roadmap and a written proposal.