Internet and data protection law

Overview: which route, which authority?

Online content can raise three separate legal questions: it may infringe personality rights or the privacy of private life, it may concern the processing of personal data, or it may be a criminal offence. Each has its own route, decision-maker and time limit.

Content removal and access blocking

Terms. Law 5651 (the Law on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, “Law 5651”) distinguishes two outcomes. Removal of content (içeriğin yayından çıkarılması) means the content provider or host takes it off the servers. Blocking access (erişimin engellenmesi) means access to a domain name, IP address or single item of content (URL) is closed while the content stays where it is (art. 2(1)(o), (ö)). The content provider produces or supplies the content; the host provider (yer sağlayıcı) operates the system that stores it; the access provider gives users internet access; a social network provider lets users create and share content (art. 2(1)(e), (f), (m), (s)). A content provider is responsible for everything it makes available (art. 4(1)). Hosts and access providers need not check content in advance (art. 5(1), 6(2)).

The annulment of art. 9. Art. 9 of Law 5651 allowed a criminal judgeship of peace (sulh ceza hâkimliği) to order the removal or blocking of content for infringing personality rights. The Constitutional Court annulled it by its decision of 11 October 2023 (E.2020/76, K.2023/172). The decision was published in Resmî Gazete No. 32425 of 10 January 2024, and the annulment took effect nine months later, on 10 October 2024. The Court said that judgeships decided without an adversarial hearing, gave general reasons and could block access indefinitely, which it treated as a heavy interference with freedom of expression and of the press (Constitutional Court press release).

In the consolidated text on mevzuat.gov.tr (November 2026), art. 9 appears only with the annulment note and no replacement provision is shown. Laws 7578 and 7590 of 2026, which amended Law 5651, did not touch it. References to art. 9 remain elsewhere in the Law (art. 5(2); additional art. 4(9)). An application to a criminal judgeship of peace relying on art. 9 therefore has no basis in the Law today, and practice since the annulment has not yet settled. What follows is what the text of the Law supports.

Notice: content, host and social network providers. The Law defines a “warning method” (uyarı yöntemi): a person who claims that their rights are infringed notifies the content provider first and, if there is no result within a reasonable time, the host through its contact addresses (art. 2(1)(r)). A host must remove unlawful content once notified under arts 8 and 9 (art. 5(2)); since art. 9 was annulled, how that provision works for personality-rights claims is unclear. A social network provider with more than a million daily users from Türkiye must answer applications from people within 48 hours, positively or negatively, and give reasons for a refusal (additional art. 4(3)). Since 1 November 2026 that duty is no longer confined to content under arts 9 and 9/A; Law 7578 art. 22 deleted that wording. There is as yet no practice on which applications the new text covers.

Privacy of private life: the Cybersecurity Presidency and a judge (art. 9/A). This applies only to a violation of the privacy of private life; attacks on honour or reputation fall outside it. Until 31 July 2026 the authority was the Information and Communication Technologies Authority (BTK); Law 7590 transferred the function to the Cybersecurity Presidency.

1. Prepare the application. It must contain the exact web address (URL) of the publication, an explanation of how the right is violated and information proving your identity. An application with gaps is not processed (art. 9/A(2)).
2. Apply to the Presidency. You apply directly (art. 9/A(1)). It notifies the Access Providers’ Association (Erişim Sağlayıcıları Birliği) immediately, and access providers apply the measure at once and within four hours at most (art. 9/A(3)). The measure applies to the specific publication, section, picture or video by URL (art. 9/A(4)); it does not delete the content from the server.
3. Put the request before the judge within 24 hours. The applicant submits the request to the criminal judge of peace within twenty-four hours of the hour at which the request was made. The judge decides within forty-eight hours at most; otherwise the measure lapses automatically (art. 9/A(5)).
4. Follow the outcome. If the content is removed, the judge’s decision lapses automatically (art. 9/A(7)). Where delay would be harmful, the President of the Presidency may order blocking directly; that decision too goes to the judge within 24 hours, and the judge decides within 48 hours (art. 9/A(8)–(9)). The text expressly gives the right to object to the judge’s decision to the President only (art. 9/A(6)); what route the publisher has needs separate consideration.

Personality rights: the civil court of first instance. A person whose personality right is unlawfully attacked may ask the judge for protection against those responsible (TMK art. 24). The claimant may ask the judge to prevent a threatened attack, to end a continuing one, to declare an attack unlawful if its effects continue, and to have a correction or the judgment communicated to third parties or published; claims for material and non-material damages and for handing over profits made through the unlawful attack are reserved (art. 25). Instead of, or in addition to, non-material damages, the judge may issue a judgment condemning the attack and order its publication (TBK art. 58).

1. Preserve the evidence. Web addresses, time-stamped screenshots, the account or publisher details and proof of any notices may be impossible to obtain later.
2. Identify the court. Unless a rule says otherwise, the court of first instance with general civil jurisdiction (asliye hukuk mahkemesi) has jurisdiction (HMK art. 2). The claimant may sue in the court of their own domicile or the defendant’s (TMK art. 25(5)); for torts, the court of the place where the act was committed or the damage occurred is also competent (HMK art. 16).
3. Ask for an interim injunction. Where delay is feared to cause serious harm, the court may order any measure that prevents it, including that something be done or not done (HMK art. 389, 391(1)). Before the action is filed, the request goes to the court competent on the merits; the applicant must show a probable case, and where protection is urgent the court may decide without hearing the other side (art. 390). The applicant gives security against loss to the other side if they turn out to be wrong; the court may dispense with it, giving reasons (art. 392).
4. Watch the time limits. If enforcement of the injunction is not requested within one week of its delivery or notification, it lapses automatically (art. 393(1)). If it was granted before the action, the action on the merits must be filed within two weeks of the request for enforcement (art. 397(1)). The other side may object within one week (art. 394(2)).

The Access Providers’ Association exists to implement decisions on removing or blocking all content outside arts 8 and 8/A (art. 6/A(1)). How civil court orders are implemented through it, and against foreign platforms, has not settled since art. 9 was annulled.

Platform liability and damages. Where a court has found content unlawful and the decision is notified to a social network provider, the provider that does not remove the content or block access within 24 hours is liable for the resulting damage; the person need not first sue the content provider (additional art. 4(14)). A damages claim is time-barred two years after the claimant learns of the damage and the person liable, and in any case ten years after the act; if criminal law provides a longer period, that applies (TBK art. 72).

Orders of public authorities (arts 8 and 8/A). These are not measures a private person applies for, but they are the orders most often met in practice. Art. 8 covers certain offences in the Penal Code (encouraging suicide, sexual abuse of children, facilitating drug use, supplying substances dangerous to health, obscenity, prostitution, providing a place and means for gambling) and some in special laws, where there is sufficient suspicion (art. 8(1)). A judge decides during the investigation and a court during the trial; if delay would be harmful, the public prosecutor may also decide, but must put the decision before the judge within 24 hours, and the judge decides within 24 hours at most (art. 8(2)). Art. 8/A permits the judge, or where delay is harmful the President of the Cybersecurity Presidency at the request of the Presidency of the Republic or the relevant ministries, to act to protect the right to life, safety of persons and property, national security, public order, crime prevention or public health; the President submits the decision to a criminal judge of peace within 24 hours, and the decision lapses unless the judge announces a decision within 48 hours (art. 8/A(1)–(2)). Both articles require implementation at once and within four hours at most (art. 8(5); 8/A(1)). The same 2023 decision also annulled some wording of art. 8 (art. 8(4) and (11)).

Objection and the Constitutional Court. A content-removal or blocking decision given as a protective measure may be challenged under the Code of Criminal Procedure (Law 5651 art. 8(2)). The objection is made within two weeks of learning of the decision, by a petition to the authority that gave it (CMK art. 268(1)); art. 268(3) names the authority that examines it. An objection does not by itself suspend enforcement (art. 269(1)). After all remedies are exhausted, an individual application to the Constitutional Court may be made within thirty days, alleging that a public authority violated a right secured by the Constitution; the application is subject to a fee (Law 6216 art. 45(2), 47(2), 47(5)).

Right to be forgotten

Basis. No statute provision carries the name “right to be forgotten”. In its decision of 23 June 2020 (2020/481), the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, “the Board”) said that the right need not be defined separately and can be met under existing provisions: art. 20(3) of the Constitution, KVKK art. 4, 7 and 11, and art. 8 of the Deletion Regulation. Under KVKK art. 7(1), if the reasons requiring processing disappear, personal data is erased, destroyed or anonymised by the controller of its own motion or at the data subject’s request. A request is concluded within thirty days if all the conditions for processing have disappeared; otherwise the controller may refuse with reasons (Regulation art. 7(1), 12).

The Constitutional Court. In N.B.B. (application no. 2013/5653, Plenary, 3 March 2016) the applicant complained that three articles from 1998 and 1999, reporting a fine for drug use, were still accessible online about 14 years later. The case began with an application to a criminal judgeship of peace; art. 9, the provision that allowed content removal for personality rights, has not been in force since 10 October 2024. The Court said the press archive need not be deleted and that removing the personal data that makes the article easy to find, or blocking access, is a less intrusive measure. It found that the articles had lost their currency and news value, that the applicant had no public role and that there was no public interest in keeping them easy to find, and held that art. 17 of the Constitution (honour and reputation) was violated (Constitutional Court press release). The decision names factors; the outcome in any case depends on weighing them.

The Board’s approach. The Board treats search engines as data controllers for requests to remove results shown for searches by name. The order is: apply to the search engine first; if it refuses or does not answer, complain to the Board; going directly to a court is also possible (2020/481). In each case the Board balances the person’s rights against the public’s interest in information, with these principal criteria; the list is not exhaustive and may be updated:

• the person’s role in public life (requests by people with a public role are less likely to succeed; information about private life is more likely to be removed);
• whether the person is a child;
• whether the information is accurate (a person who says it is false is expected to prove it);
• whether it concerns working life or private life;
• whether it is insulting, degrading or defamatory (the Board considers the courts the better route in these cases);
• whether it is special-category data or intimate information such as address, telephone or financial details;
• how current it is and how much time has passed (not an absolute rule);
• whether it creates prejudice or a risk for the person, such as identity theft or stalking;
• whether the person published it themselves;
• whether the original content is journalism;
• whether the information must be published by law;
• the nature and date of any offence it relates to (very old and relatively minor offences are more likely to succeed).

Search result or source page. In decision 2022/1201 (10 November 2022) the Board held that a Resmî Gazete notice from 2000 containing an acquittal should be de-indexed from searches by name, because more than 20 years had passed and publication served no public interest; the decision concerns indexing only and does not cover removal of the source page. In decision 2023/2185 (28 December 2023), on a 2001 news item in a newspaper’s online archive, the Board treated keeping the item in the archive as processing within the freedom-of-expression exemption (KVKK art. 28/1-c) and saw no action to take under the Law to remove it from the archive; it said that a request about visibility in searches by name should first be put to search engines. The same decision reminded the newspaper that applications must be answered on time and with reasons. KVKK art. 28/1-c takes the processing of personal data within freedom of expression outside the Law, provided it does not infringe personality rights or the privacy of private life or constitute an offence.

Steps.

1. Identify the target. Is it a search result or the source page? The data controller and the grounds differ. Record the web addresses (URLs) and the search term.
2. Apply to the search engine first. Apply under KVKK art. 13, by the procedure in the “KVKK complaint” section below, in Turkish. The search engine decides the format of the application and the documents it requires (2020/481).
3. Await the answer. If the request is refused, or no answer comes within 30 days, a complaint can be made to the Board within the deadlines below. A court can also be approached with, or instead of, the complaint; no prior application to the controller is needed to go to court (Board, page on the right to apply).
4. Choose a separate route against the source. To have the article or content removed from its source, the publisher is approached and, if need be, the court (TMK art. 24–25). In one newspaper-archive case the Board relied on the freedom-of-expression exemption (art. 28/1-c).

Limits. The result cannot be predicted: the same criteria produce different outcomes in different cases. This page does not discuss decisions of the Court of Cassation (Yargıtay) or the Council of State (Danıştay). For insulting or defamatory content the Board considers the courts the better route. If the search engine is established abroad, how a Board decision is enforced against it is not covered here; KVKK art. 2 does not define its scope by the controller’s place of establishment.

KVKK complaint: applying to the data controller and complaining to the Board

Rights. Everyone may apply to the data controller (veri sorumlusu) to: learn whether their personal data is processed; request information if it is; learn the purpose and whether it is used accordingly; know the third parties to whom data is transferred; request correction of incomplete or inaccurate data; request erasure or destruction under the conditions of art. 7; request that these actions be notified to third parties; object to a result against them arising from exclusively automated analysis; and claim compensation for damage caused by unlawful processing (KVKK art. 11). The data controller is the natural or legal person who determines the purposes and means of processing (art. 3(1)(ı)).

Who decides? The data controller first (art. 13). If the application is refused, the answer is inadequate, or no answer is given in time, the complaint goes to the Personal Data Protection Board (art. 14). An action against the Board’s acts can be brought in the administrative court.

1. Prepare the application in Turkish. It contains: first name and surname (a signature on a written application); for Turkish citizens the ID number, for foreign nationals nationality and passport number, or ID number if any; the residence or workplace address for service; e-mail, telephone and fax if any; and the subject of the request. Relevant information and documents are attached (Communiqué art. 4(2), 5(2)–(3)).
2. Send it by a recognised method. In writing, or by registered electronic mail (KEP), secure electronic signature, mobile signature, the e-mail address previously notified to the controller and registered in its system, or software or an app built for applications (Communiqué art. 5(1)). For a written application, the date of application is the date the document is served on the controller or its representative; for the other methods it is the date it reaches the controller (art. 5(4)–(5)). Keep proof of sending and receipt.
3. Wait for 30 days. The controller concludes the request as soon as possible and within thirty days at most, without charge; if the action needs a separate cost, the fee in the Board’s tariff may be charged (KVKK art. 13(2)). Under the Communiqué, a written answer of up to ten pages carries no fee, and beyond that the per-page fee in art. 7 applies. The controller accepts the request or refuses it with reasons and gives the answer in writing or electronically (art. 13(3)). If the application arose from the controller’s error, any fee is refunded.
4. Complain to the Board in time. The complaint is made within thirty days of learning the controller’s answer and in any case within sixty days of the date of application (art. 14(1)). The example below shows how the two periods interact.
5. Make the complaint complete. According to the Board’s notice of 30 March 2021, a complaint should contain the name, surname, signature and address; a valid power of attorney if a representative acts; proof that the controller was approached and when; the controller’s answer, if any, and when it was learnt; evidence and documents; a clear subject and request; and whether the matter has also gone to court. A complaint that does not meet the procedural conditions is not examined on its merits.

Worked example (hypothetical). Count days from the date of application (day 0). Holidays and similar details are left out of the example; do not leave it to the last day.

Situation	Last day to complain	Why
Answer learnt on day 10	Day 40	30 days from learning the answer (art. 14(1)); within the 60 days from the application
Answer learnt on day 45	Day 60	30 days from the answer would be day 75, but the limit is in any case 60 days from the application
No answer	Days 31 to 60	A complaint is possible once the 30-day answer period has passed; the last day is day 60

The Board’s examination. The Board examines on a complaint, or of its own motion on learning of an alleged violation; the controller must send the information and documents requested within fifteen days and allow an on-site inspection where needed (art. 15(1), (3)). If the Board does not answer within sixty days of the complaint, the request is deemed rejected (art. 15(4)). If it finds a violation, it orders the unlawful practice to be remedied, and the decision must be carried out without delay and within thirty days of notification at most (art. 15(5)). Where irreparable or hard-to-repair harm would occur and the unlawfulness is clear, the Board may order processing, or transfer abroad, to stop (art. 15(7)). Failure to carry out Board decisions attracts an administrative fine (art. 18(1)(c)); the amounts are not given on this page and the current figure should be taken from the text of the Law.

Court routes. Administrative fines imposed by the Board can be challenged in the administrative courts (art. 18(3)); this took effect on 1 June 2024, and applications pending before criminal judgeships of peace on that date continue there (Law 7499; KVKK provisional art. 3(2)). Because the Law sets no special period for challenging other Board decisions, the 60-day period in İYUK art. 7(1) applies. The right to compensation under the general rules is preserved for those whose personality rights were violated (KVKK art. 14(3)). Anyone who fails to erase data as art. 7 requires is punished under art. 138 of the Penal Code (KVKK art. 17(2)).

Submitting the complaint. The Board runs an online complaint module (sikayet.kvkk.gov.tr), which opened on 9 January 2020; lawyers have been able to submit complaints as proxies since 27 March 2023 (Board notices). A written complaint needs a signature and an address (KVKK art. 15(2) and the Board’s 2021 notice).

If you live abroad, and foreign platforms

• Language of the application. Applications to a data controller are made in Turkish (Communiqué art. 4(2)). A foreign national gives their nationality and passport number (art. 5(2)(b)).
• Representation. A complaint to the Board may be submitted by a lawyer as proxy; where a representative acts, a valid power of attorney is required. For a power of attorney given from abroad, see giving a power of attorney from the UK.
• Foreign social networks. A social network provider based abroad with more than a million daily users from Türkiye must appoint at least one person in Türkiye with authority to deal with notifications, requests and the other obligations under the Law, publish the contact details on its website and notify the Presidency. If the representative is a natural person, they must be resident in Türkiye and a Turkish citizen. Above ten million daily users the representative must have full technical, administrative, legal and financial authority and, if a legal entity, must be a branch set up by the provider as a capital company. The Law provides graduated sanctions for failure, including administrative fines, an advertising ban and reduced bandwidth (Law 5651 additional art. 4(1)–(2)).
• Place of the action. A personality-rights action may be brought in the court of the claimant’s or the defendant’s domicile (TMK art. 25(5)); which rule applies to a claimant domiciled abroad depends on the facts.
• Constitutional Court. An individual application may be made directly or through the courts or the Turkish missions abroad (Law 6216 art. 47(1)).

Criminal complaints for cybercrimes

Unlawful access to an information system, hindering or disrupting its operation, altering or destroying data, and misuse of bank or credit cards are offences under the Penal Code (art. 243–245). Unlawfully recording personal data, giving it to another or obtaining it are covered by art. 135–136 (KVKK art. 17(1)). A criminal complaint is made to the public prosecutor’s office. The offences, their penalties, whether a complaint or reconciliation is available, and how an investigation proceeds are set out in the IT offences section of the criminal law page and are not repeated here.

Deadlines in one place

Mistakes that cost people their options

• Applying to a criminal judgeship of peace under art. 9. The article has not been in force since 10 October 2024; for personality rights outside private life the civil court route applies (TMK art. 24–25).
• Missing the 24 hours under art. 9/A. The application goes to the Presidency, but putting the request before the judge falls on the applicant, and the process does not complete without it (art. 9/A(5)).
• Complaining to the Board without applying to the controller. The route must be exhausted first (KVKK art. 14(2)).
• Forgetting one of the 30 and 60 days. If 30 days have passed since the answer, or 60 days since the application, the complaint period has ended (art. 14(1)).
• Applying in a foreign language, or leaving out identity or address. The Communiqué requires the application to be in Turkish (art. 4(2)) and to give identity and an address for service (art. 5(2)); an incomplete complaint may not be examined on its merits.
• Confusing a search result with the source page. Removing a search result does not delete the page; in one newspaper-archive case the Board saw no action to take under the Law to remove it from the source (2023/2185; KVKK art. 28/1-c).

Documents to prepare

• Identity document; a passport for foreign nationals; a valid power of attorney if a representative acts.
• The exact web addresses (URLs) of the content, time-stamped screenshots and the search term used.
• Details of the account or site that published the content, and proof of any notices to the publisher.
• For a privacy violation, a written explanation of how the right was violated.
• A copy of the KVKK application, proof of sending and receipt (KEP receipt, postal record), the controller’s answer and the date you learnt it.
• An address for service; e-mail and telephone if any.
• Documents showing the harm the content has caused.
• Earlier applications and decisions from courts, judgeships or the Board.