KÜHEYLAN HUKUK
Personal Data Crimes (TCK Article 135-140): Recording, Seizing, Dissemination and KVKK Sanctions Criminal and Administrative Liability within the Scope of Turkish Penal Code Articles 135, 136, 137, 138 and Law No. 6698. This guide is based on the Turkish Penal Code, Personal Data Protection Law No. 6698 and the Supreme Court case law as of 2026. updated.
Summary Illegal recording of personal data requires a prison sentence of one to three years, and giving, disseminating or seizing this data to someone else requires a prison sentence of two to four years. If the data is of special nature such as political opinion, health, sexual life or union affiliation, and the act is committed by a public official by abusing authority or taking advantage of the convenience provided by the profession, the penalty is increased by half. These crimes are not subject to complaint and are investigated ex officio. In addition to criminal liability, a separate administrative fine regime operates for data controllers within the scope of Law No. 6698; As of 2026, the upper limit for data security violations is 17,092,242 Turkish liras.
Transferring a customer list to a rival company, an employee viewing records in the system without permission, or sharing a private correspondence on social media. What these incidents have in common is that they can create not only an administrative compliance problem but also a crime punishable by imprisonment.
In Turkish law, personal data is protected on two separate axes. While articles 135 to 140 of the Turkish Penal Code regulate the criminal liability of natural persons, the Personal Data Protection Law No. 6698 foresees administrative sanctions against data controllers. The two regimes are not alternatives to each other; The same incident may be the subject of both a prosecutor's office investigation and a Personal Data Protection Board investigation. In the guide, both regimes, crime types, reasons for compliance with the law and current sanction amounts as of 2026 are discussed together.
Personal data is any information regarding an identified or identifiable natural person. The scope of the definition is not limited to the identification number or name and surname; Any information that makes a person directly or indirectly identifiable is within this scope. Phone number, address, e-mail, bank account information, vehicle license plate, photo, voice recording, location information and internet traffic records can be listed as examples.
Protection is granted only to natural persons; Information about legal entities is not included in this scope. Anonymized data, that is, data that cannot be associated with a person in any way, is also excluded from protection.
The law binds some categories of data to more severe consequences in case of violation. In accordance with the second paragraph of Article 135 of the Turkish Penal Code, the data; If it is related to people's political, philosophical or religious views, racial origins, moral tendencies, sexual lives, health conditions or union affiliations, the penalty is increased by half. Files where health data are processed are the area where this paragraph comes up most frequently in practice.
Anyone who records personal data unlawfully is punished with imprisonment from one to three years. For the crime to occur, it is sufficient to make the data permanent in any way; This includes writing on paper, transferring to electronic media, photographing or recording audio.
The determining criterion in the article is unlawfulness. Records based on an obligation arising from the law do not constitute a crime. For this reason, the employer's keeping a personnel file in accordance with labor legislation, the hospital creating a patient record, or routine customer registration within the scope of commercial activity are not penalized for this reason. On the other hand, sharing the same data with third parties later constitutes an independent crime.
Any person who unlawfully gives, disseminates or obtains personal data to another person is punished with imprisonment from two to four years. According to the acceptance of the General Criminal Assembly of the Supreme Court of Appeals, the crime is optional; The occurrence of only one of the three actions is sufficient for the crime to occur.
Transfer: Transferring data to a specific person. The transferred person may be a natural person or a legal entity; Transfer can take place by hand, by mail or electronically.
Dissemination: Making the data accessible to an undetermined number of people. This includes social media sharing, publishing on the website and transferring to group messaging.
Interception: Obtaining data in an unauthorized manner. Examples include unauthorized access to the system, examining someone else's phone or copying documents.
Pursuant to the second paragraph of the article, if the subject of the crime is the statements and images recorded in accordance with the fifth and sixth paragraphs of Article 236 of the Code of Criminal Procedure, the penalty to be imposed is increased by one fold. This provision grants special protection to video recording of victim and witness statements.
In the practice of the Supreme Court, merely having access to data is not considered sufficient to constitute a crime. It is required to demonstrate that the act was carried out with the intention of illegally seizing or transferring. A person who accesses a system as part of his duty and encounters other data in the process may be acquitted in cases where there is no intention to transfer or use it.
If those who are obliged to destroy the data within the system, even though the periods specified by law have passed, do not fulfill their duties, they will be sentenced to imprisonment from one to two years. If the subject of the crime is data that must be eliminated or destroyed in accordance with the provisions of the Code of Criminal Procedure, the penalty is increased by one.
This crime is the least known regulation in practice but poses the most concrete risk to corporate data controllers. Records that are not destroyed after their retention period has expired may result in both criminal and administrative liability.
If the above crimes are committed by a public official by abusing the authority granted by his/her office or by taking advantage of the convenience provided by a certain profession or art, the penalty to be imposed is increased by half. Bank employee leaking customer information, healthcare personnel sharing patient records, or courier officer transferring address information are evaluated in this context.
1 year to 6 months 4 years to 6 months Recording of personal data art.135/1 1 to 3 years imprisonment
Penalty is half the amount. Recording of sensitive data, Art. 135/2. Increases are applied together and increased.
Giving, disseminating or obtaining data Article 136/1 Imprisonment from 2 years to 4 years Imprisonment from 3 years to 6 years
The subject of the crime is CMK art.236 records, art.136/2 The penalty is increased by one, the increases are applied together
Non-destruction of data Article 138/1 1 year to 2 years imprisonment 1 year 6 months to 3 years imprisonment
7. Reasons for Compliance with Law: In Which Circumstances Does a Crime Not Occur?
The common element in all these types of crimes is that the act is against the law. In the following cases, the element of unlawfulness does not occur.
Explicit consent of the person concerned: Consent must be given with free will and based on information regarding a specific issue. A general and unlimited consent is not considered valid.
Fulfillment of the provision of law: Transactions carried out within the scope of the recording and notification obligations stipulated by the legislation do not constitute a crime.
Use of the right: Limited situations where a person acts to protect his own law are evaluated within this scope.
The most discussed issue in practice is the recording of an audio or video recording of a crime being committed against a person. According to the established approach of the Supreme Court, a recording taken for the purpose of preserving evidence that cannot be obtained again in case of a sudden event and against the possibility of loss is considered lawful. On the other hand, recording in a pre-planned, systematic and continuous manner is not considered within the scope of this protection.
Even if the recording is deemed lawful, sharing this recording with people other than authorized authorities or publishing it on social media constitutes an independent crime. The distinction between presenting it as evidence and making it public is decisive at this point.
In accordance with Article 139 of the Turkish Penal Code, crimes of recording personal data, unlawfully providing or obtaining data, and failure to destroy data are not subject to complaint. These crimes are investigated ex officio and withdrawing the complaint does not drop the public case. The fact that some other crimes in the same section, such as violation of privacy, are subject to complaints often leads to confusion in practice.
Crimes are not included in the scope of mediation. The competent court is the criminal court of first instance, and the competent court is the court of the place where the crime was committed. In terms of basic cases, the statute of limitations is eight years, and this period may be extended in cases where the incremental provisions are applied. In accordance with Article 140 of the Turkish Penal Code, specific security measures are imposed on legal entities due to the commission of these crimes.
It is possible to convert the imposed penalty into a judicial fine, to postpone it, or to decide to postpone the announcement of the verdict, if the conditions are met. However, the fact that the lower limit of the crime in Article 136 of the Turkish Penal Code is two years significantly narrows these opportunities when the increase provisions come into effect.
Criminal liability is directed at natural persons. Administrative fines set out in Article 18 of Law No. 6698 are applied to companies and institutions that act as data controllers. These amounts are increased by the revaluation rate at the beginning of each calendar year and are updated without the need for a separate decision by the Board.
When determining the amount of the penalty, the Board takes into account the duration of the violation, the number of people affected, whether the data is of special nature, the economic situation of the data controller and how quickly the violation notification is made. If it is determined that more than one obligation has been violated in a single incident, separate penalties may be imposed for each violation.
The judicial remedy to be applied against the Board's decisions has changed. In accordance with the regulation that came into force on June 1, 2024, a lawsuit against administrative fines can be filed in the competent administrative court within sixty days from the notification of the decision. For decisions made before this date, the appeal to the criminal judgeship of peace was valid. An error in terms of time and authority will result in rejection without considering the merits.
10. What Should a Person Suffered from a Data Breach Do?
The methods that a person can follow when he learns that his data has been processed unlawfully are independent of each other and can be used simultaneously.
Screenshots containing the content, link addresses, and date and time information must be identified before they are lost; If possible, the determination should be made through a notary.
A criminal complaint may be filed with the Chief Public Prosecutor's Office. Since the crime is investigated ex officio, the report is also suitable for starting the investigation.
The data controller should be contacted, and if no response is received or the response is insufficient, a complaint should be made to the Personal Data Protection Board.
In terms of content on the internet, an application can be made to the criminal judgeship of peace with a request to block access and remove the content.
A compensation lawsuit may also be filed in the civil court to compensate for material and moral damages.
Before leaving the job, a staff member working in a company's sales unit sent the name, phone number and address information in the customer database to his or her own e-mail address, and then transferred this list to the rival company he or she had just started working for. One of the customers noticed the situation and filed a complaint when he received a promotional message from this company, with which he had never had any contact.
Transferring the data to one's own e-mail address constitutes recording within the scope of Article 135 of the Turkish Penal Code, and forwarding it to a rival company constitutes the act of giving it to someone else within the scope of Article 136. The fact that the act was committed by taking advantage of the access opportunity provided by the job is also evaluated in terms of the qualified situation in Article 137. Since the crimes are not related to the complaint, the customer's subsequent withdrawal of the complaint does not invalidate the public case. The same incident may also be subject to Board investigation on the grounds of violation of data security obligation for the company acting as data controller; The two processes run independently of each other.
Is it a crime to record a conversation without the other person's knowledge?
As a rule, yes. However, a recording made in a sudden situation where the evidence cannot be obtained again regarding a crime being committed against oneself may be considered lawful. Planning and systematic recording is not considered within this scope.
Can I share my legal record on social media?
No. The fact that the recording is considered lawful to obtain as evidence does not justify making it public. The act of dissemination constitutes an independent crime. The registration should only be submitted to the competent authorities.
If I withdraw my complaint, will the case be dismissed? No. In accordance with Article 139 of the Turkish Penal Code, these crimes are not subject to complaint and are investigated ex officio. Waiver does not drop the public case.
Can I use numbers in my phone book for mass messaging?
Just because a person gives you his number does not mean that he consents to the use of that number for commercial communication purposes. Depending on its scope, this use may lead to liability in terms of both Law No. 6698 and commercial electronic message legislation.
Is it possible to apply to both the prosecutor's office and the Board? Yes. The criminal process relates to the liability of natural persons, while the administrative process relates to the obligations of the data controller. The two routes are not alternatives to each other and can be operated simultaneously.
How can I object to the administrative fine imposed by the Board?
An annulment lawsuit is filed with the competent administrative court within sixty days from the notification of the decision. The option of objecting to the criminal judgeship of peace, which was valid before June 1, 2024, is no longer applied.
Failure to detect evidence properly: There is a high probability that the posts will be deleted. Limiting yourself to a screenshot will open the source of the content to discussion.
Publication of the recording: Sharing a legally obtained recording on social media may make the victim a suspect.
Confusion of objection period and authority: Failure to appeal to the administrative court against the Board's decisions within the sixty-day period will result in rejection without going into the merits.
Failure to document consent: For data controllers, explicit consent must be verifiable as well as its existence; Undocumented consent does not serve as a defence.
Failure to follow retention periods: Failure to destroy expired data constitutes a separate crime under Article 138 of the Turkish Penal Code.
Personal data breaches are one of the rare areas where the same act can be considered both a crime punishable by imprisonment and a breach of obligation that can result in administrative sanctions worth millions of lira. Correct evaluation of the element of unlawfulness, grounding the defenses of consent and exercise of rights in concrete facts, detecting digital evidence before it is lost, and not missing the sixty-day trial period in the administrative process are the technical headings that determine the outcome. Küheylan Law Firm provides legal support in carrying out criminal complaint and defense processes in files related to personal data crimes, applications for removing content and blocking access, annulment cases against Board decisions, and compliance processes of data controllers.
Important Legal Notice: The legal explanations and sample scenarios in this guide have been prepared by Küheylan Law Firm for general information purposes and do not constitute legal advice. Since the unique circumstances of each case may change the outcome, it is recommended to seek legal support from a lawyer from the first stage of the process. © 2026 Küheylan Law Firm. All rights reserved.
Küheylan Law Firm — Burhaniye Mh. Neşetbey Sk. No:12/5 Floor:5 Flat:3 Üsküdar/İstanbul — info@kuheylanhukuk.com — kuheylanhukuk.com
KÜHEYLAN HUKUK