The right to respect for private life protects a person's private sphere, identity, relationships and the use of information about them. The protection is not limited to what happens inside the home. Workplace correspondence, health records, photographs, location data and the online availability of news about a person may also engage this right. Personal data protection is closely connected with private life, but it is a field with its own rules and application procedures.
In a violation, the correct route depends first on identifying the act and the request: deletion of data, stopping publication, review of a dismissal, compensation or a criminal investigation may each require a different route. A complaint to the KVKK, a criminal complaint and a lawsuit are not interchangeable remedies. This article explains these distinctions through Articles 20 and 22 of the Constitution, Law No. 6698 and actual court decisions. [1] [2]
Private life and personal data: the relationship
Personal data is not only confidential information
Information relating to an identified or identifiable natural person may be personal data. A name, a telephone number, an image, an employee's performance record and a location tied to a device are examples. The fact that information is visible to others does not mean it can be used without limit for any purpose. Recording, transferring, classifying and keeping data accessible may each be separate processing activities. [2, Arts. 3–5]
However, it is not correct that explicit consent is required for every data processing activity. Alongside explicit consent, the Law provides other processing conditions, such as processing provided for by law, the conclusion or performance of a contract, a legal obligation, the establishment or protection of a right and, under certain conditions, legitimate interest. The condition relied on must be identified for each concrete activity, and the general principles must also be applied.
Information notice and explicit consent are not the same act
The information notice tells the person about the data controller, the purpose of processing, transfers, the method of collection, the legal basis and the person's rights. Explicit consent, by contrast, is a declaration of will on a specific matter, given on the basis of information and of free will. Signing an information notice does not show that valid explicit consent exists in every case. Consent obtained does not make processing for an unrelated, excessive or indefinite purpose lawful either. [2, Arts. 3, 4 and 10]
For example, requesting broad health information that is not necessary for a job application cannot be justified merely because the form contains a consent box. The necessity of the request, the condition for processing special category data and the retention period must be examined separately. If consent is withdrawn, it should also be assessed whether another lawful ground for retention exists.
The human rights dimension of personal data protection is also addressed in the study by Özkaya and Toprak, which relies on Constitutional Court decisions. Kılınç's study of constitutional protection is an older source that explains the conceptual development of the subject. In particular, the 2012 bill text and older European Union regulations should not be used in place of Law No. 6698, which is in force today. Current rights and obligations are determined under the current text of the law. [14] [15]
Special category data and current KVKK rules
Why the 2024 amendment matters
Article 6 of Law No. 6698 was amended by Law No. 7499. For health, biometric and genetic data, and for the other special category data listed in the article, carrying over only the former distinction between explicit consent and the health exception does not reflect current law. The new regulation sets different conditions, such as processing expressly provided for by law, the exercise of legal rights, certain health services, and employment and social security obligations. Each condition has its own scope. [2, Art. 6]
An employer keeping a health certificate and an employer sending the same document to all managers are different activities. Even if the legal basis permits the first, the second must be justified separately in terms of purpose, necessity and access authority. The data controller must limit who can access the data and how long it is kept, and must take appropriate security measures.
Transfers abroad are assessed separately
Article 9 of the Law was also amended in 2024. Adequacy decisions, appropriate safeguards and the exceptional conditions for occasional transfers are different mechanisms. Where a foreign service provider is used, it must be determined where the data is processed, who can access it and what legal basis supports the transfer. A general sentence of consent does not automatically make all regular transfers valid. [2, Art. 9]
For the applicant, the important point is not merely to argue that the application is foreign-based, but to explain as far as possible which personal data was transferred, to which recipient and within which activity. A request for information addressed to the data controller may clarify this distinction.
Workplace email, camera and communications monitoring
The E.Ü. decision: the problem of vague and broad monitoring
In its decision of 17 September 2020 in the case of E.Ü., Application No. 2016/13010, the Plenary of the Constitutional Court (AYM) examined an employer's review of correspondence in a corporate email account. It found that the right to request protection of personal data and freedom of communication had been violated, because prior information, the necessity of the review, less intrusive methods and the scope of the review had not been sufficiently taken into account. [3, §§ 68–79]
The decision does not state that no review may ever be carried out on an employer's systems. What matters is the legitimate purpose, whether communication traffic or content was examined, the dates and persons to which the review was limited, and how its result was used. The fact that an email account is corporate does not remove the employee's entire expectation of privacy.
Celal Oraj Altunörgü: an example with concrete safeguards
In its decision of 12 January 2021 in the case of Celal Oraj Altunörgü, Application No. 2018/31036, the First Section of the Constitutional Court (AYM) found no violation. The prior information in the employment contract, the rules on business use of the account, the purpose of the review and the assessment made in the proceedings were decisive for the outcome. [4, §§ 30–45]
Read together, the two decisions show that the conditions, not the name of the review, are decisive. The second decision cannot be generalised to mean that an employee's silence counts as explicit consent for all KVKK processing. A contractual monitoring clause also does not permit unlimited screening of content. The legal basis and proportionality of each activity are assessed separately.
The 2026 Board principle decision
The Personal Data Protection Board's (Kurul) principle decision No. 2026/2035 of 16 September 2026 separates the technical ability to access corporate communication tools from the legal authority to access them. It explains that prior information is not the same as the KVKK information notice, and that monitoring must be graduated, limited to its purpose and carried out with defined access authorities. The end of the employment relationship does not justify indefinite review of the account. [5]
For that reason, a workplace policy should not consist only of the sentence "accounts may be audited". The purpose, scope, method, conditions for moving on to content review, retention period and the rights of the person concerned should be set out in clear terms. An employee involved in a dispute should document which version of the policy and of the contract was in force.
Internet photographs, news and the right to be forgotten
The N.B.B. decision: balance for past news
In its decision of 3 March 2016 in the case of N.B.B., Application No. 2013/5653, the Plenary of the Constitutional Court (AYM) examined the easy accessibility of news about a criminal proceeding that had taken place about fourteen years earlier. It considered the applicant's public position, the timeliness of the news and its continuing social interest, and found a violation of the right to protection of honour and reputation under Article 17 of the Constitution. The operative finding should not be reported as a direct violation of Article 20. [6, §§ 64–75]
The right to be forgotten is not a power to demand the complete erasure of the past. The preservation of news archives and the public's access to information are also taken into account. Rather than removing content entirely, more limited solutions, such as anonymising personal data or restricting searchability by name, may be considered in the specific case. The measure sought must correspond to the source of the violation.
Law No. 5651, Article 9 and Article 9/A must not be confused
In the current text of the law, Article 9 of Law No. 5651 appears as annulled by the Constitutional Court (AYM) in its decision E.2020/76, K.2023/172. Presenting the Article 9 route as if it were in force today, on the basis of older decisions or petitions, is wrong. Article 9/A, which concerns the protection of the confidentiality of private life, is a separate provision. [7]
Under Article 9/A, a request to the BTK must include the exact address of the publication that causes the violation, an explanation of the violation and identity information. The law provides that the criminal judgeship of peace must be applied to within twenty-four hours of the request, and that the judge decide within forty-eight hours. The continuation of the measure depends on this procedure. This route is not a general removal mechanism that applies to all disputes concerning personality rights.
Application to the data controller and complaint to the Board
What should be requested from the data controller first?
Under Article 11 of Law No. 6698, a person may ask whether data has been processed, request information, learn whether the data has been used for its purpose, learn the recipients, request correction and, where the conditions exist, request deletion or destruction. The application must clearly identify the relevant record, the incident and the request. It must be made by a method accepted in the Law and the relevant procedural rules, and proof of sending and receipt must be kept. [2] [8]
The data controller must conclude the request as soon as possible and in any case within thirty days. A failure to respond, a rejection or an inadequate response opens the route of a complaint to the Board. A complaint made without first applying to the data controller may not be examined because of the precondition in Article 14 of the Law.
Thirty- and sixty-day periods: how they differ
The rule is thirty days from learning of the controller's response and, in every case, sixty days from the date of the application to the controller. However, these two periods do not give the applicant a free choice of a sixty-day period in every incident. The Board's decision No. 2019/9 of 24 January 2019 explains this distinction. [9]
| Situation | Point to note for the complaint period |
|---|---|
| The controller responds within the first thirty days | The thirty-day period from learning of the response applies; the sixtieth day should not be awaited |
| No response within thirty days | After the response period expires, a complaint is made within the sixty-day limit counted from the first application |
| The response arrives after thirty days | A late response does not create a new thirty-day period; the sixty-day limit from the first application applies |
The date of the application, the content of the response and the record of when it was learned should be kept together. Missing attachments, identity or representation information, and an inability to prove an earlier application are procedural defects that make review harder. The institution's current procedural announcements should be checked before acting. [8] [9]
Compensation, criminal investigation and other routes
A complaint to the Board does not pay compensation to the person
The Board may examine the data processing activity and, within its powers, apply corrective measures or administrative sanctions. An administrative fine is not compensation paid to the applicant. For damage to personality rights, judicial claims may be assessed under Articles 24 and 25 of the Turkish Civil Code and the relevant provisions of the Turkish Code of Obligations. The damage, the unlawfulness and the causal link must be made concrete. [2] [10] [11]
The current rule on challenging the administrative fines imposed by the Board is also important. With the 2024 amendment to Article 18 of Law No. 6698, a lawsuit route before the administrative courts was established. Older descriptions of review by the criminal judgeship of peace, and files from the transitional period, should not be applied directly to current events. Other Board decisions and damage claims are assessed according to their own legal nature. [2]
When does a criminal complaint arise?
Violation of the confidentiality of private life, unlawful recording or giving of personal data, and unlawful obtaining of personal data are different offence types. Not every KVKK violation constitutes a crime; the elements of the criminal provision must also be present. The requirement of a complaint and the time limit may vary by offence type. It is wrong to apply a single six-month complaint period to all data violations. [12]
When collecting evidence, one must not enter other people's accounts without permission or create a new unlawful record. The originals of existing messages, URLs and dates, access records, responses to applications and lawfully established findings should be preserved. A screenshot may be useful, but a single image whose source and context are unclear may not be enough in every dispute.
How to prepare an individual application to the Constitutional Court
A complaint to the Constitutional Court (AYM) should not be limited to describing the act of a private person. It should explain either the direct intervention of public authorities or how the duty to protect a person against private parties was not fulfilled. It may show which decisive argument the court failed to examine, how it balanced the conflicting rights, and why less restrictive measures were not discussed. [1] [13]
The ordinary remedies capable of resolving the violation must be exhausted, and as a rule the thirty-day period runs from learning of the final decision. It should not be assumed that an application to the Board automatically suspends all lawsuit or Constitutional Court time limits. The application file should clearly connect the incident, the data category, the processing activity, earlier objections, the final decision and the redress sought. Rather than republishing personal data alleged to have been obtained unlawfully, the file should be limited to the documents strictly necessary.
Submission and the electronic channel
Article 47 of Law No. 6216 provides for applications made directly to the Constitutional Court, through courts or through consulates abroad. Since 1 October 2025, lawyers have also been able to file individual applications electronically through the UYAP Lawyer Portal. Saving the form and completing the submission are not the same thing; the signature, attachments, fees or legal aid request, and the application record should be checked. This option does not mean that every electronic communication channel is valid. [16]
For more on this subject, see our articles on removal of online content and blocking of access and on dismissal because of social media posts.
Conclusion
Effective protection in cases of violations of private life and personal data first requires the activity to be correctly identified. Consent, the information notice, the processing condition and proportionality are separate matters. From workplace monitoring to internet news, the purpose, scope, duration and effect on the person are assessed in each case. The time limits for applying to the controller and for complaining to the Board must be monitored carefully, and claims for compensation, criminal complaints and constitutional applications must be prepared under their own procedures. For an example in which respect for private life is raised together with the right to education, see our article on equivalent examination summons and the right to education.
Frequently asked questions
Can I use information about me that is publicly available online without limits?
No. Being public is not permission for any purpose. The legal basis, purpose and scope of use are assessed.
Can my employer read my corporate email?
In certain circumstances monitoring may be possible. However, a legitimate purpose, prior information, an information notice, a legal processing condition and proportionality are required. Ownership of a corporate account does not give unlimited monitoring authority.
What can I do if the data controller does not respond?
After the thirty-day response period expires, a complaint to the Board may be considered within the sixty-day limit counted from the first application. Keep the document proving that the application was received.
Can I obtain moral damages through a KVKK complaint?
The administrative fine imposed by the Board is not paid to you. Compensation requires the judicial route suited to the nature of the dispute, which must be assessed separately.
Can I have all old news about me removed?
There is no automatic right of deletion. Timeliness, public interest, the person's position, the content and the effect of accessibility are weighed. More limited solutions, such as anonymisation, may also come into consideration.
If I have given explicit consent, is every processing activity lawful?
No. In addition to the validity of consent, the principles of purpose limitation, data minimisation, security and retention also apply.
Sources and legal bases
- [2] Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu), current text.
- [5] KVKK, official announcement on the Board's principle decision No. 2026/2035 of 16 September 2026.