Protection of Personal Data in Attorneys’ Activities: The 2026 KVKK Guide, Professional Secrecy and the Use of Artificial Intelligence

Processing personal data is a natural part of an attorney’s profession; however, the function of defense does not by itself remove the application of Law No. 6698 on the Protection of Personal Data. The 2026 Implementation Guide prepared by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) with contributions from the Union of Turkish Bar Associations (Türkiye Barolar Birliği) explains the position of independent attorneys, law practice entities (avukatlık ortaklığı), attorneys acting under delegation (tevkil) and office staff, and addresses the conditions for data processing, professional secrecy, obtaining evidence, the duty to inform, registration with the Registry of Data Controllers (VERBİS), retention and destruction, data breaches and the transfer of files to generative artificial intelligence tools. The central issue is that the necessary personal data be accessed lawfully and that such data be used only for the purpose of seeking legal remedies, proportionately and securely.

When was the Guide published, what is its purpose and how should it be assessed legally?

The Personal Data Protection Authority (KVKK) announced to the public the Implementation Guide on the Protection of Personal Data in the Professional Activities of Attorneys, prepared with the benefit of the views and contributions of the Union of Turkish Bar Associations (TBB). The publication details of the work, issued as KVKK Publications No. 115, bear the date July 2026; the launch program, on the other hand, was announced on September 22, 2026. These two dates are different stages: the printing/publication details of the Guide and the process of its presentation to the public.

The Guide is not merely a document telling attorneys how to store client files. It discusses the balance between the right of defense and the right to request the protection of personal data, and examines together the scope of data subjects, the distinction between data controller and data processor, the legal conditions for processing, domestic and cross-border transfers, artificial intelligence, data security and practical examples.

The Guide is not a law or a regulation. The sources of binding obligations are, first and foremost, the Constitution, Law No. 6698, Attorneyship Law No. 1136 (Avukatlık Kanunu), the relevant procedural laws, secondary legislation and applicable Board decisions. The Guide’s interpretations and good-practice recommendations are an important institutional source showing how these norms may be reflected in professional activities. On its own, it does not create a new exception, sanction or general permission. This distinction must always be preserved when any recommendation of the Guide is used in a specific file.

Full text of the Guide: KVKK official PDF publication. The Authority’s official announcement also summarizes its scope.

Are attorneys’ litigation activities entirely exempt from the KVKK?

No. The fact that an attorney submits evidence to a court does not mean that every data processing activity carried out by the attorney falls outside Law No. 6698. Article 28(1)(d) of Law No. 6698 regulates a full exemption for the processing of personal data in connection with investigation, prosecution, trial or enforcement proceedings by judicial authorities or enforcement authorities. Here, both the nature of the operation and the authority carrying it out matter.

In the decision of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) dated January 14, 2020, No. 2020/26, it was held that the professional activity conducted by an attorney cannot be equated with an operation carried out by a judicial authority. For this reason, where an attorney obtains evidence for the courts, conducts research on a third party, drafts a petition or handles an enforcement file, the general principles of the law and the applicable obligations must also be taken into account.

The reverse is not true either: the KVKK cannot be interpreted as a rule that abstractly prohibits the defense from accessing necessary evidence. In a specific dispute, the legitimate purpose of seeking legal remedies, statutory powers to request information and documents, the necessity of the evidence, the method by which the data was obtained and the use of a minimum amount of data will be assessed together. Between the right of defense and data protection there is no automatic relationship of precedence, but a review of lawfulness and proportionality.

Whose data, and which data, is processed in attorneys’ activities?

In an attorney’s activities, the data subject is not only the client. Prospective clients, those requesting legal advice, the opposing party, debtors, witnesses, employees, family members, company representatives, court-appointed experts and other natural persons named in documents may also be personal data subjects. Handing a file over to an attorney does not grant an unlimited right to process, for any purpose, all third-party data contained in the file.

In an employment law file, personnel files, payroll records, Social Security Institution (SGK) records, absence data and workplace correspondence; in a criminal file, records of convictions and security measures; in family law, information about children, health, communications within the family and financial status; in an inheritance file, population and real property records may be processed. Depending on the nature of the legal assistance, special categories of personal data such as trade union membership, health, biometric or genetic information may also be present in the file.

The practical consequence of this classification is important: at the opening of a file, keeping a record only for “client data” is often not sufficient. It should be possible to track, by category, which natural persons’ data the operations contain, where the data was obtained, under which legal condition it is processed and to whom it is transferred. In particular, it must be possible to explain later the source of data obtained from third parties.

Is the attorney a data controller or a data processor? Status arises from actual activity, not from the title of the contract

Under Article 3 of Law No. 6698, a data controller is the natural or legal person who determines the purposes and means of processing personal data. A data processor, by contrast, is a separate natural or legal person who processes data on behalf of the data controller on the basis of the authority granted by the data controller. The establishment of a representation relationship does not, on its own, make the attorney a data processor.

The fact that the attorney decides, within his or her professional independence, which evidence will be needed, which document will be submitted to the case file, the scope of legal research and the manner of storage is, as a rule, a strong indicator pointing toward data controller status. Nevertheless, in an organization in which the attorney performs limited operations under detailed and specific instructions, without the ability to determine the purposes and methods of data processing, data processor status may also come into question. Each group of operations must be characterized separately.

In the decision of the Personal Data Protection Board dated March 22, 2023, No. 2023/437, it was accepted that, although the contract between a law practice entity and a company described the entity as a “data processor,” the entity was a data controller because it decided freely on the relevant data processing activity. By contrast, the decision dated February 9, 2021, No. 2021/115 shows that, in certain bank debt-collection operations, the attorney may be regarded as a data processor acting within the framework of the client bank’s instructions. These do not establish a single, unchangeable classification for all legal work.

Attorneys working together, law practice entities and attorneys acting under delegation

The mere fact that independent attorneys sharing the same office use the physical premises together does not mean that they are joint data controllers for all client files. Each attorney may have his or her own clients and own processing purposes. By contrast, a law practice entity with legal personality may be the data controller for file operations conducted on behalf of the entity; in that case, it cannot be said that each member is separately and automatically a data controller for the same operation.

Where another attorney authorized by the delegating attorney for a specific hearing, attachment or on-site examination acts on instructions within the limits of the assigned work, it is possible for that attorney to be regarded as a data processor. The Guide specifically addresses this possibility; however, a new classification must be made for different operations in which the attorney acting under delegation independently determines other purposes or fulfills his or her own professional obligations.

Salaried attorneys, trainees and support staff

Attorneys, trainees, secretaries, clerks and administrative staff working within the organization of the employing attorney or the law practice entity, with the purposes and methods determined by it, are as a rule not a separate “data processor.” These persons carry out operations within the data controller’s organization, within the limits of their access permissions. The Guide also explains the special situation in which a salaried attorney may separately be a data controller in a file that he or she independently undertakes, for example a mandatory defense counsel file.

The table below shows the general approach; it should be checked against the specific process and the legal organizational documents.

Legal condition for data processing: explicit consent is not required in every file, nor can all data be used freely

Article 5 of Law No. 6698 and, with respect to special categories of data, Article 6 set out the legal conditions for data processing. In the context of an attorney providing legal services, the conclusion or performance of a contract, cases expressly provided for by law, the fulfillment of a legal obligation and necessity for the establishment, exercise or protection of a right are frequently encountered grounds. The appropriate condition must be determined for each data category, group of persons and processing purpose.

Explicit consent is not a general authorization ranking above all other conditions. The Guide draws attention to practices that it may find misleading, in which a standard explicit consent form is used alongside the attorney engagement agreement even though another processing condition already exists. Making legal services conditional on mandatory explicit consent for operations that do not in fact require consent may cause problems. By contrast, in a separate operation for which no legal condition other than consent exists, valid, freely given and specific explicit consent may be required.

Processing the client’s identity and contact data for a specific case is not the same operation as publishing the client’s photograph in the office’s advertising or transferring the dispute file to a data set for training purposes. In the second group, the purpose, the legal condition for data processing, confidentiality and professional rules must also be assessed. The fact that the client has opened a file does not mean that he or she has given prior permission for every kind of new use.

Additional safeguards for special categories of personal data

For information such as trade union membership, health, criminal convictions and security measures, and biometric and genetic data, the current conditions in Article 6 and the Board’s decisions on adequate measures must be applied together. During legal representation, necessity for the establishment, exercise or protection of a right may, in a specific case, also constitute a legal processing condition for special categories of data. However, the existence of a data processing condition does not make the collection of unnecessary data or unauthorized access lawful.

In the Board’s decision dated September 16, 2021, No. 2021/925, the connection of information on another employee’s trade union membership with the subject matter of the case and the need for proof was assessed in a reinstatement action based on an allegation of termination on trade-union grounds. The conclusion is not that trade union data may be disclosed without limit in all cases, but that relevant and necessary evidence may be used in the context of a legal proceeding.

Attorney professional secrecy and the data protection obligation complement each other

Article 36 of the Attorneyship Law regulates attorneys’ professional duty of confidentiality concerning the disclosure of matters entrusted to them or learned by them by reason of their profession. This obligation is a fundamental element of the trust between attorney and client. Personal data legislation, on the other hand, covers not only information that constitutes a secret, but also the lawful obtaining, use, transfer, storage and destruction of data relating to an identifiable natural person.

The fact that data is found in a public register or has been learned from another source does not allow its unlimited use for any purpose. Similarly, a client’s wish that a document be submitted to the court does not confer authority to reproduce, unnecessarily, unrelated health, family or financial information contained in the document. While professional secrecy forms the ethical and professional basis of data security, the KVKK additionally subjects the purposes and means of processing to a review of lawfulness.

Information sharing within the office must also be limited to this extent. Ensuring that only the relevant team has access to the details of a criminal investigation; that staff payroll records, payment information and client communications are seen only in authorized roles; and that unnecessary disclosure of documents is avoided in workrooms, meetings or screen sharing are practical consequences of this obligation.

Gathering evidence and information: Article 2 of the Attorneyship Law does not grant unlimited access to data

Article 2 of the Attorneyship Law regulates the obligations of the listed public institutions and private institutions, subject to special provisions in the laws, to assist the attorney in performing his or her duties and to make the necessary information and documents available for examination. Obtaining copies of documents may, however, depend on statutory conditions such as the presentation of a power of attorney. Just as it is not correct for the relevant institution to refuse every request on data protection grounds, it cannot be considered lawful for the attorney to request an entire data set unrelated to the specific file.

In a request for information and documents, the file to which the request relates, the assignment and the necessity must be clearly explained. If an action is to be filed, it should be examined which information the claim and the burden of proof require; if collection and attachment proceedings are being conducted in enforcement, which inquiry the relevant legislation makes possible; and, where a health file is concerned, what the special regulations require. The Guide cites the decision of the First Chamber of the Council of State (Danıştay 1. Dairesi) dated April 10, 2002, E. 2002/26, K. 2002/52 in connection with the “necessity” criterion in requests for information. Without the full text of this decision having been separately obtained, no broad conclusions or long quotations concerning it have been included in this article.

UYAP, TAKPAS, official registers and third-party data

Inquiries via UYAP and TAKPAS are subject not merely to the system being technically accessible, but to the limits of the operations and powers recognized by the relevant legislation. The fact that an inquiry concerning a debtor’s assets may be made in an enforcement file does not, by itself, justify copying the result of the inquiry to another file, a marketing pool or a personal archive. Likewise, when obtaining population, health or bank records, the special legislation of the relevant institution and the power to make the legal request must be reviewed.

In the Board’s principle decision dated October 18, 2019, No. 2019/308, the use of programs through which citizens’ identity and contact information can be queried on the basis of unlawfully obtained data was identified as a clear area of risk. The use of such services may, in addition to an administrative sanction, lead to consequences that may become the subject of a criminal investigation. Being “easily accessible” or a “paid service” does not make such a program a legitimate data source.

Proportionality when submitting data in petitions, court files and enforcement proceedings

Submitting evidence or a document to a judicial authority constitutes a transfer of personal data and, in most cases, also a separate processing of it. Even where the production of a document required by the defense is legally possible, the relevance of the disclosed fields to the subject matter of the case, the manner in which the document was obtained and the reduction of attachments containing unnecessary data must be assessed. The access authority of the judicial authority is not the same as the risk of access by the opposing party or the public.

It may be necessary to process children’s health records in a divorce action; other employees’ trade union information in an employment action; the personal telephone numbers of the opposing company’s officers in a commercial dispute; and private correspondence belonging to third parties in a criminal file. However, the dissemination of parts that do not contribute to proving the specific claim, or their uncontrolled transfer to an environment outside the file, cannot be explained by the legitimate purpose of seeking legal remedies. Where necessary, routes such as asking the court to order the document to be produced, requesting confidentiality or access restrictions, or producing only the relevant pages are assessed according to the characteristics of the file.

Both the proposition that the opposing party’s personal data can never be processed without obtaining explicit consent and the proposition that the attorney may collect all the data on the opposing party that he or she wants are wrong. The sound method is to be able to show, on a file-by-file basis, the right or statutory provision justifying the operation, the necessity of the data and the data source.

The duty to inform should be designed starting from the first contact with the client

Under Article 10 of Law No. 6698 and the Communiqué on the Duty to Inform (Aydınlatma Tebliği), the data subject must be given information about the identity of the data controller, the processing purposes, the recipients and purposes of transfers, the method of collection, the legal ground and the data subject’s rights. Informing is not the same operation as explicit consent. The Board’s principle decision dated February 18, 2026, No. 2026/347 likewise emphasizes that privacy notices and explicit consent texts must be prepared separately, that “consent” must not be requested for informing, and that clear and plain information appropriate to the specific data processing activity must be provided. Where certain exceptions are regulated in the legislation, they must be assessed separately on an event-by-event and operation-by-operation basis; it cannot be assumed that there is a general exception for all of an attorney’s work.

During the first telephone call, web form or email inquiry, at a stage where the legal service has not yet been undertaken, the data collected should be kept limited. Where basic contact and appointment information is sufficient, automatically asking for an identity document, a medical report, criminal case papers or all the private correspondence of the opposing party to be sent may create problems in terms of data minimization. Which documents will be requested, and by which secure method, can be determined separately after the preliminary assessment of the file and the acceptance of the matter.

If the data has been obtained not from the client but from a third-party source, the timing provisions of Article 6 of the Communiqué on the Duty to Inform become important: different situations are regulated, such as the first communication for data to be used to communicate with the data subject, and, at the latest, the first transfer if a transfer is to be made. These timing rules must be examined together with the exceptions, the duty of confidentiality, the specific dispute and the characteristics of the process of seeking legal remedies.

The model that can be applied for an office is layered information: a short and clear notice at the first inquiry; a text specific to the legal review and communication processes before the service is accepted; and the necessary additional information for special-purpose transfers or transfers to additional suppliers. The examples given in the Guide particularly emphasize that personal data should not be collected beyond what is necessary at the first contact.

The exemption from registration in the Registry of Data Controllers does not exempt attorneys from KVKK obligations

The Board’s decision dated April 2, 2018, No. 2018/32 exempted attorneys practicing within the scope of the Attorneyship Law from the obligation to register with the Registry of Data Controllers. This exemption does not remove obligations such as informing, processing in accordance with the general principles, data security, data subject requests, retention and destruction, and breach notification.

The fact that registration with the Registry is not mandatory also does not mean that there is no need for a data inventory within the office. Even if no registration is made in an official register, creating an internal record showing the categories of files, which staff have access, the groups of data subjects, the service providers used, the grounds for retention and the points of transfer is a strong compliance tool. The limits of the registration exemption for law practice entities with legal personality must be assessed separately in light of the relevant decision and the legal nature of the organization; it cannot be said that “all companies are automatically exempt.”

Retention and destruction: not everything is deleted because a file is closed, and indefinite retention is not automatic either

Article 7 of Law No. 6698 regulates the erasure, destruction or anonymization of personal data when the reasons requiring their processing cease to exist. Article 39 of the Attorneyship Law, on the other hand, provides that the attorney is obliged to keep the papers entrusted to him or her for three years from the end of the mandate, and that, where their return has been notified in writing, the obligation ends at the end of three months from the notification. These should not be regarded as a single, unchangeable total archive period for all categories of data processed in a file.

Different regulations may come into play with respect to client receivables, professional liability, tax, accounting, electronic documents and possible disputes. Just as a data subject’s request for destruction does not require the immediate deletion of the entire file, the possibility of a future lawsuit does not justify the indefinite retention of all documents. A retention matrix should determine, by file type and data category, the legal basis, the triggering event, the period, access and the method of destruction.

If a data subject’s erasure request is to be refused in whole or in part for a lawful reason, the grounds for the refusal and the legal ground on which, and the framework within which, the data is kept must be clearly explained. The preservation of the original form of evidence in a dispute concerning a document can be distinguished from the deletion of copies of communications that are no longer necessary.

Data subject requests, the response period and the limit of professional secrecy

The client, the opposing party or another relevant natural person may apply to the data controller in the proper manner to exercise his or her rights under Article 11 of Law No. 6698. The data controller must conclude requests as soon as possible and within 30 days at the latest. The complaint process is additionally subject to the procedural and time-limit provisions of the law.

In assessing a request, identity verification, the applicant’s right to make a request concerning his or her own data, the scope of the request, statutory exceptions, professional secrecy and the rights of other persons must be assessed together. For example, a debtor may ask which of his or her personal data, from which source, were obtained in the enforcement proceedings conducted against him or her; it is important to be able to show with records that the data was obtained from the client, an official register or the enforcement file. However, a request must not turn into an unlimited disclosure of the client’s strategy, the secrets of third parties or other data that must be protected.

For this reason, it is advisable for every law office to have a workflow that receives data subject requests, verifies them, forwards them to the attorney responsible for the file, tracks the statutory period and records the response. Keeping the contact addresses on the website and in the bar register up to date is important for requests to be concluded effectively.

Cross-border data transfers: the use of foreign cloud and email services must be examined separately

The system of Article 9 of Law No. 6698, as amended in 2024, requires appropriate cross-border transfer mechanisms to be examined one by one. In cases where there is no special provision in the law or in an applicable international agreement, an adequacy decision together with the relevant data processing condition; where there is none, appropriate safeguards; and where these cannot be provided either, only limited cases of incidental transfer may come into question. Daily and systematic use of the cloud cannot automatically be regarded as “incidental” merely by asserting that user consent has been obtained.

The processing of data through a foreign file storage service, an email infrastructure operating abroad, a video conferencing provider, an automatic transcription system, a foreign customer relationship management platform or a third-party support service may, depending on the data flow, constitute a cross-border transfer. The name or marketing description of the service provider is not sufficient on its own; where the data is processed, sub-service providers, access permissions, the retention policy and contractual safeguards must be examined together.

In a law office working in Turkish, English, German and Russian, translation and document sharing with foreign specialists must also be addressed within this framework. The mere fact that a text is in a foreign language does not mean a transfer abroad; what is decisive is the technical and organizational data flow. Likewise, a transfer to a provider in Türkiye also requires an assessment of legal conditions and proportionality within the framework of Article 8 of Law No. 6698.

Uploading a case file to artificial intelligence is not merely a research operation

One of the most important sections of the Guide for current practice is its examination of the uploading of documents containing personal data to generative artificial intelligence tools as a separate data processing activity and a possible transfer. Transferring a case file, WhatsApp correspondence, an identity document, an expert report, a health record or a hearing record to ChatGPT, Claude, Gemini or another system may give rise to a domestic or cross-border data transfer depending on the service provider’s infrastructure.

For this reason, before an artificial intelligence tool is selected, the terms of service, the place of data processing and storage, sub-service providers, logging/access permissions, preferences on use for training or other purposes, the institution’s legal transfer conditions and, where necessary, how destruction/access requests are handled must be examined on the basis of the specific product and contract. The presence of a security feature in a tool does not mean that the data transfer is lawful; likewise, the fact that a product is artificial intelligence does not by itself prohibit all use of it.

A practicable artificial intelligence check for law offices

• The purpose of the work and whether the use of artificial intelligence is actually necessary should be determined on a file-by-file basis.
• Where possible, data that makes a person identifiable, including direct and indirect identifiers, should be removed; it should not be forgotten that deleting names alone does not in every case achieve anonymization.
• The types of data processed by the application used, who can access them and in which countries processing takes place should be documented.
• Legal interpretations, norms, decisions, quotations and file summaries produced by the generative tool should be subjected to independent review by a legal professional.
• For staff, which classes of data may be used in which service, in which situations written permission or specialist review is required, and prohibited uses should be set out in a separate institutional policy.
• The method for cutting off access, stopping the operation, keeping records and moving on to the notification assessment in the event of a suspected breach should be defined in advance.

These checks are practical recommendations; they should not be presented as a separate list of mandatory documents arising automatically from the Authority’s 2026 guide. In every use, the legal processing and transfer conditions in the law are additionally required.

Data security and the management of access permissions in a law office

Article 12 of Law No. 6698 requires appropriate technical and administrative measures to be taken to prevent unlawful processing and unauthorized access and to ensure the safekeeping of data. In law offices, a single, abstract “confidentiality undertaking” does not constitute a sufficient control system. File-based authorization, access according to staff role, strong authentication, up-to-date software, secure backup, physical archive locks, a personal device policy and secure document transfer channels may be considered among the measures to be applied.

For files containing special categories of personal data, the Board’s decision on adequate measures dated January 31, 2018, No. 2018/10 must be observed. If access is to be given to technical service providers, translators, independent experts, e-signature assistants or external support providers, limits on authority and duration should be set; unnecessary bulk file sharing should be avoided. Training should be given, within an appropriate scope, not only to attorneys but to everyone who actually processes data, such as secretarial, finance, IT and temporary staff.

A data security breach is not only a cyberattack. An email sent to the wrong recipient, the loss of a client file, a shared link that can be opened by anyone, folder permission granted to unauthorized staff or the use of a malicious data query program may give rise to different risks. For each incident, technical determination, the groups of persons/data and the need for legal notification are assessed separately.

What should be done in the event of a data breach? How are the 72 hours calculated?

Under Article 12(5) of Law No. 6698, where personal data is obtained by others through unlawful means, notification to the data subject and to the Board comes into question. Under the Board’s decision dated January 24, 2019, No. 2019/10, the expression “as soon as possible” for notification to the Board is, as a rule, interpreted as 72 hours at the latest from the time the incident is learned of; for data subjects, notification is to be made within a reasonable shortest time following the determination of the situation. Whether the incident is only at the level of suspicion, whether unauthorized access has occurred and which persons have been affected must be investigated promptly.

When a data breach is noticed, the first step is not to delete documents or conceal records. Access to the affected system is restricted, the necessary evidence is preserved, the scope and data categories are determined; corrective measures and the need for notification are assessed in a recorded manner. The Guide uses the loss of a physical case file as an example: the lost file may contain health, financial or identity data, and the possibility of access by third parties must be taken into account.

Notification to the Board and informing data subjects must be planned together with the confidentiality obligation relating to professional secrecy and the characteristics of the incident. Disclosing the statutory notification to the public more broadly than necessary is not a safe approach, nor is rejecting the notification obligation outright on the grounds of “client confidentiality.”

The attorney’s liability: administrative sanctions, compensation, disciplinary and criminal dimensions

Unlawful processing of personal data or a breach of obligations relating to data security may lead to administrative sanctions within the framework of Article 18 of Law No. 6698. The Guide also emphasizes that the monetary limits relating to data security breaches are updated according to the annual revaluation rates. Nevertheless, the consequences of using incorrect data, disclosing data obtained from an unlawful source or revealing a client’s secret may not be limited to an administrative fine alone.

With respect to the attorney engagement agreement, a breach of the ancillary duty of protection may, where its conditions are met, give rise to discussions of contractual liability and compensation. Disciplinary liability arising from the Attorneyship Law and the rules of the profession, and offenses relating to personal data under the TCK, are also assessed separately according to the circumstances of the specific case. Not every security incident means an automatic criminal conviction or automatic compensation; the act, fault, unlawfulness, damage, causation and the relevant procedural conditions are examined separately.

For this reason, a law office needs to develop its data security measures not only to prepare for KVKK audits, but also for the institutional fulfillment of the duty of care and confidentiality required by the attorney’s function.

Implementation checklist for law offices: responsibility across 12 workflows

The table below is an editorial implementation recommendation prepared on the basis of the explanations in the Guide and Law No. 6698. It is not an official twelve-item checklist listed verbatim in the legislation or made mandatory for every office.

In practice, what matters is not the length of the checklist but whether it can actually work for each type of file. Prospective clients, criminal/health information, digital archives, staff departures, delegation, remote access and artificial intelligence services in particular give rise to different risks. For this reason, instead of a single-text general policy, a system supported by process ownership, a responsible person, training, records and review is useful.

Related articles: Respect for private life and protection of personal data: application routes; The offense of unlawfully obtaining, giving or disseminating personal data (TCK 136); The limits of trust in the attorney–client relationship and professional ethics.

Conclusion

The fundamental message of the 2026 KVKK Implementation Guide for the legal profession is that personal data protection and the right of defense are not two mutually exclusive activities. It is essential that the attorney be able to access the necessary information, process data for the establishment and protection of a right, and exercise his or her professional independence; in return, the legal basis, necessity and source of the data obtained, with whom it is shared, its safekeeping and its destruction must be explainable.

Incorrect determination of the data controller–data processor role, the use of general explicit consent forms in every operation, mistaking the registry exemption for being outside the scope of the law, disproportionate sharing of data belonging to third parties and the uncontrolled transfer of case documents to cloud or artificial intelligence systems are the main areas requiring attention for law offices. The institutional approach is to record data processing and security decisions appropriate to the needs of the specific file.

Frequently Asked Questions

Are attorneys subject to the KVKK?

Yes. The connection of the legal profession with the judicial system does not take all operations carried out by an attorney outside Law No. 6698. The conditions of the Article 28 exemption specific to judicial authorities do not automatically apply to every professional operation of an attorney.

Is the attorney a data controller or a data processor?

An independent attorney is a data controller with respect to most professional operations. In a limited operation carried out on detailed client instructions without determining the purposes and methods, the role of data processor may be possible. Status is determined by the actual way things work, not by the label in the contract.

Do all attorneys working in the same office become joint data controllers?

No. In a shared office without legal personality, different attorneys may have separate clients and separate decisions on operations. The role of a law practice entity with legal personality is assessed separately.

Is the attorney required to obtain explicit consent?

Not in every operation. If an appropriate processing condition in the law, such as a contract, a legal obligation or the protection of a right, exists, it may not be necessary to additionally seek explicit consent. The duty to inform is different.

Can data belonging to the client’s opposing party be processed without consent?

This may be possible if an appropriate statutory processing condition exists and the data is necessary for seeking legal remedies, connected with the purpose and proportionate. It cannot be concluded that all third-party data may be processed unconditionally.

Can health or trade union information be used in a statement of claim?

This may be possible where it is connected with the specific claim, the burden of proof and the appropriate processing condition in Article 6. Additional security measures and proportionality are required for special categories of data.

Do law offices have to register with the Registry of Data Controllers?

The Board’s decision No. 2018/32 grants a registration exemption to attorneys practicing within the scope of the Attorneyship Law. However, this does not mean exemption from the other obligations of the KVKK; the legal nature of the organization is examined separately.

How long is a case file retained?

Article 39 of the Attorneyship Law regulates, as a rule, a three-year retention obligation for entrusted papers from the end of the mandate; there is also a separate three-month provision with respect to a written notice of return. A specific assessment must be made for other legal grounds and types of data.

Can the client request that all data be deleted immediately?

The client may make the request; however, this does not mean that the request will necessarily be accepted immediately and in its entirety. If there is a pending case, statutory retention or a need for proof, a reasoned response is given after the grounds have been examined.

Within how many days is a data subject’s KVKK request answered?

Under Article 13 of Law No. 6698, the request is concluded as soon as possible and within 30 days at the latest. Identity verification and the secrets of other persons are taken into account.

Can an attorney upload a case file to ChatGPT or another artificial intelligence?

Without examining the data processing and transfer conditions according to the product and the file, it cannot be said “always yes” or “always no.” Transferring an identifiable file to the cloud may be regarded as a domestic or cross-border data transfer and additionally requires a legal basis.

Is storing a file on a foreign server prohibited in all cases?

No. However, the appropriate transfer conditions and safeguards of Article 9 of Law No. 6698 and the basis for data processing must be assessed according to the specific technical flow. A mere claim that the server is secure is not sufficient.

If a physical case file is lost, is notification to the Board required?

Situations in which the file has been obtained by unauthorized third parties, or in which there is a specific risk of this, must be investigated. When the conditions for statutory breach notification are met, notification to the Board without delay, as a rule within 72 hours from learning of it, comes into question.

Can unlawful telephone or identity query software be used?

No. The Board’s principle decision No. 2019/308 clearly sets out the administrative and judicial consequences against applications that run queries on unlawfully obtained data. A need for evidence does not legitimize an unlawful data source.

Are the consequences of a data breach limited to a KVKK fine?

No. Depending on the conditions, contractual compensation, disciplinary liability as an attorney and criminal law consequences may additionally come into question alongside a KVKK administrative sanction. In every case, the specific act and the legal elements are examined.

Sources and legal bases

1. Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), Implementation Guide on the Protection of Personal Data in the Professional Activities of Attorneys (Avukatların Mesleki Faaliyetlerinde Kişisel Verilerin Korunmasına İlişkin Uygulama Rehberi), KVKK Publications No. 115, July 2026, Ankara. Full official text.
2. Personal Data Protection Authority, Implementation Guide Published (Uygulama Rehberi Yayımlandı) Official announcement.
3. Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), Articles 3–13, 16, 18, 28. Legislation Information System (Mevzuat Bilgi Sistemi).
4. Attorneyship Law No. 1136 (Avukatlık Kanunu), in particular Articles 2, 34, 36, 39, 44, 45, 56 and 171. Legislation Information System.
5. KVKK, Board decision dated January 14, 2020, No. 2020/26. Official summary of the decision.
6. KVKK, Board decision dated April 2, 2018, No. 2018/32 (registration exemption). Official decision.
7. KVKK, Board decision dated March 22, 2023, No. 2023/437 (role of a law practice entity). Official decision.
8. KVKK, Board decision dated February 9, 2021, No. 2021/115 (operation tied to a bank). Official summary of the decision.
9. KVKK, Board decision dated September 16, 2021, No. 2021/925 (trade union membership data). Official summary of the decision.
10. KVKK, principle decision dated October 18, 2019, No. 2019/308 (unlawful data query programs). Official decision.
11. KVKK, Board decision dated January 31, 2018, No. 2018/10 (security of special categories of data). Official decision.
12. KVKK, Board decision dated January 24, 2019, No. 2019/10 and breach notification announcement. Official information.
13. KVKK, principle decision dated February 18, 2026, No. 2026/347 (separation of the duty to inform and explicit consent). Official announcement.