Individual Application and Compensation Process for KVKK Violation in Antalya

What is the Personal Data Protection Law and its Application Area in Antalya

The Personal Data Protection Law (KVKK) came into force in 2016 to prevent the unlawful processing and dissemination of personal data. This law has become even more critical in cities like Antalya, where tourism, health, education and real estate sectors are concentrated.

Basic Principles of KVKK

Processing in accordance with law and rules of integrity
Limited to specific, clear and legitimate purposes
Storage for a limited period of time as stipulated in the relevant legislation or for the purpose for which they are processed

Data-Intensive Industries in Antalya

Private hospitals and clinics
Hotels and tourism agencies
Real estate offices
Educational institutions
Site and apartment managements

Protection of Special Personal Data

Sensitive information such as identity, health, and biometric data must be protected with special precautions. In Antalya, this data is particularly at risk due to health tourism and foreign patient services.

What is a KVKK Violation? What Behaviors Are Considered Violations?

Processing, sharing or not protecting personal data without the consent of the person concerned constitutes a violation.

Data Processing Without Explicit Consent

If a person who makes a reservation at a hotel shares their information with other companies without their permission, this is a violation.

Failure to Ensure Data Security

Keeping camera recordings without a password in the site management system will result in a violation.

Sharing of Personal Data with Third Parties

Publishing student lists or patient information on other platforms is a serious violation.

Rights of Persons Who Have Violated KVKK in Antalya

The person who has suffered a violation may take both administrative and judicial action within the scope of the law:

Right to Apply to Data Controller

The first step is to submit a written application to the data controller (e.g. hospital, school, hotel). This route must be exhausted before going to the board.

Complaint Application to the Board

If the data controller rejects the application or does not respond on time, a complaint can be made to the Personal Data Protection Authority within 60 days .

Compensation and Ways to File a Lawsuit

A person who suffers material or moral damage due to a violation may file a lawsuit for compensation.

How Does the Application Process to the Data Controller Work?

Duration: The application must be made within 30 days after learning of the violation.
Response Time: The data controller must respond to the application in writing within 30 days .
If No Response: In this case, the person can directly file a complaint with the KVKK Board .

Information That Must Be Included in the Application

Name, surname and Turkish identity number
Address of place of residence for notification
What data was breached and how it was learned
Subject of request

How to File a Complaint with the KVKK Board in Antalya?

Duration: It must be made within 30 days from the response of the data controller, or within 60 days from the application if no response is given.
Form: Application is made to KVKK by petition or online application system is used via e-Government.
Review Process: The institution conducts technical and legal review, requests defense from the relevant institution and makes a decision.

The Lawsuit Process to be Filed in Antalya Courts for Compensation Claims

A person who has suffered damage due to a data breach may file a lawsuit at the Civil Court of First Instance in Antalya.

Difference between Material and Non-Pecuniary Compensation

Material Compensation: Can be claimed if there is tangible loss of income or material damage.
Non-pecuniary damages: Requested if damage has been caused to a person's reputation or psychological integrity.

Competent and Authorized Court

Competent court: Civil Court of First Instance
Competent court: The court where the defendant resides or where the data breach occurred.

Gathering of Evidence and Burden of Proof

Email correspondence
Message records
Witness statements
KVKK Board decisions

Precedent Decisions Regarding KVKK Violations in Antalya

Private Hospital Violation: A patient's information was the subject of an advertising SMS, and the person applied to the Board and the court and won compensation.
Sharing of Student Information: A school shared parent lists on a social media group, resulting in a lawsuit filed by a parent and a violation was determined.
Dissemination of Camera Recordings: The Board imposed an administrative fine after an apartment manager disseminated camera footage to neighbors.

Mediation and Alternative Solutions for KVKK Violations

Is Mediation Mandatory?
It is not mandatory to apply for mediation in compensation cases to be filed regarding KVKK violations, but it is recommended.
Application Usage:
The person who has suffered damage as a result of the breach may apply to a mediator to reach an agreement with the data controller before filing a lawsuit.

Most Frequently Asked Questions

How is compensation determined in case of KVKK violation?
→ The severity of the breach, the type of data, whether it was disclosed to the public, and the degree of damage are taken into account.

How many days is the application period?
→ Application must be made to the data controller within 30 days and to the Board within 60 days.

Can I file a lawsuit without evidence?
→ Without concrete signs of data breach, litigation is difficult; evidence or Board decision required.

In which areas are violations most common in Antalya?
→ Violations are frequently reported in the healthcare, tourism, apartment management and education sectors.

Is it necessary to hire a lawyer?
→ No, but due to the complexity of the legal process, it is advisable to proceed with an attorney.

Are institutions penalized for violations disclosed to the public?
→ Yes. The public is informed through the decisions published on the official website of KVKK.