Data responsibles violating the Personal Data Protection Law (Personal Data Protection Law) may face an administrative fine of up to 1 million TL. This violation of rights has criminal and civil liability and even administrative fines.

Serious gaps regarding the Personal Data Protection Law Code 6698 are present, which was prepared within the scope of harmonization with the European Union and entered into force after being published in the Official Gazette in April 2016. The liability of data controllers began two years after the publication, namely in April 2018 in accordance with the provisional article of the law. Accordingly, it is decreed that the personal data processed before the publication of the law will be brought into compliance with the provisions of the law within two years, and that the personal data found to be contrary to the provisions of the law will be immediately deleted, destroyed or anonymized. Again, it was decided that the consents obtained in accordance with the law prior to the publication of this law would be considered lawful unless a contrary declaration of intent was made within one year (April 2017).

Consequently, all data processors must provide their own systems and obtain the relevant consents incurrently. But, most of them got delayed.

Currently, administrative fines of up to 1 million TL are waiting for data controllers who commit acts that lead to violations as regulated within the scope of Personal Data Protection Law. This violation of rights brings criminal and civil liability as well as administrative fines. For instance, the owner is also rightfull being indemnified according to general provisions.