Law No. 6698 Article 5: personal data needs explicit consent unless a listed condition applies, including the controller's legitimate interests (Kisisel Verilerin Korunmasi Kanunu (Personal Data Protection Law) No. 6698, Art. 5(1) and (2)(f), as published on mevzuat.gov.tr (Turkish; KVKK also publishes an English translation as a Word file))
Translation: personal data cannot be processed without the data subject's explicit consent, but may be processed without it if processing is necessary for the data controller's legitimate interests, provided it does not harm the data subject's fundamental rights and freedoms. Unlike Korea and Malaysia, Turkish law has a legitimate-interests condition that can replace consent; the Authority's generative AI guide limits how far a holder can rely on it for a paid licence of records.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“MADDE 5- (1) Kişisel veriler ilgili kişinin açık rızası olmaksızın işlenemez. ... f) İlgili kişinin temel hak ve özgürlüklerine zarar vermemek kaydıyla, veri sorumlusunun meşru menfaatleri için veri işlenmesinin zorunlu olması.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide