KVKK (Kişisel Verilerin Korunması Kanunu)

KVKK, Kişisel Verilerin Korunması Kanunu, the Law on the Protection of Personal Data, is Türkiye's general data-protection law, and the same kind of law the EU's GDPR is: it governs how any organization operating in Türkiye may collect, store, use, and share personal data, with real enforcement power behind it. It's also the acronym commonly used, in practice, for both the law itself and the authority that enforces it (Kişisel Verileri Koruma Kurumu, the Personal Data Protection Authority).

Passed in 2016, KVKK requires a lawful basis for processing personal data, imposes stricter rules on "special category" data (biometric data used to identify a person sits squarely here, exactly as it does under GDPR Article 9), and grants individuals rights over their own data, access, correction, and erasure among them. Its enforcement teeth are administrative fines the Kurul can levy directly against a non-compliant data controller.

The clearest real-world illustration: the hotel pincer

KVKK's practical bite shows up clearly in Türkiye's hotel-registration requirement. Turkish hotels are legally required to report every guest's identity to the police/gendarmerie notification system (see KBS), but the Kurul has separately ruled that a hotel photocopying and retaining a guest's full ID document or passport, as a routine practice, is excessive data collection under KVKK's data-minimization principle. The two obligations pull in opposite directions at the same front desk: submit the required data fields, but do not hoard the underlying document. The common workaround, photocopy it anyway, file it in a drawer "just in case", is itself a KVKK liability, not a safe default.

Who actually built this

The Turkish Grand National Assembly passed Law No. 6698 in 2016, closely following the structure of the EU's data-protection framework that predated GDPR. The Kişisel Verileri Koruma Kurumu and its board enforce it, publishing binding decisions the same way an EU national Data Protection Authority does. None of this is a Solidus design.

Solidus today

KVKK applies to Solidus's own KYC pipeline right now, because that pipeline processes exactly the kind of data KVKK takes seriously, ID documents and biometric liveness captures, from Turkish residents. What hasn't happened: no VERBİS registration, no published KVKK compliance documentation, and no independent audit confirming any of it. Nothing here is a compliance claim; it's the honest, current gap.

See also

GDPR is the closest EU analogue and the framework KVKK was originally modeled on. KBS is the specific hotel-registration obligation that makes KVKK's document-retention rule concrete rather than abstract. Data Minimisation is the general principle behind the "submit the data, don't hoard the document" tension above. TCKN and KYC are the identifiers and processes that generate the personal data KVKK governs.