KVKK applies to all organisations processing personal data of data subjects in Turkey. Insofar KVKK reaches out globally and regulates all processing activities related to Turkish individuals.
Exempted from the applicability of KVKK are only:
- household activities;
- official statistics with anonymised data;
- artistical, historical, literary or scientific purpose if national defence, national security, public security, public order, economic security are not violated;
- preventive, protective and intelligence activities by public bodies which are assigned by law to protect the above-mentioned public goods;
- processing by judicial or execution authorities with regard to investigation, prosecution, judicial and execution proceedings.
All other processing activities by foreign organisations are therefore subject to KVKK and need to comply with it, especially with the obligation to appoint a Data Controller Representative and to register with Data Controllers' Registry Information System (VERBIS).