Administrative fines regulated in Article 18 of the Personal Data Protection Law (“KVKK”) have been recalculated by the revaluation rate this year as every year. The determined amounts are included in the announcement published by the Personal Data Protection Authority on 17.01.2023.

The announcement contains the titles of "Failure to fulfil the obligation to inform", "Failure to fulfil the obligations related to data security", "Failure to fulfil the decisions issued by the Board" and "Act contrary of the obligation to register and notify the Data Controllers Registry (Verbis)" regulated under article 18 of the KVKK. In this context, the amounts of administrative fines for the violations mentioned above were increased by 122.93%, which is the revaluation rate.

The table for 2022 and 2023 administrative fines is as follows: 

VIOLATIONS

FINES FOR 2022

FINES FOR 2023

Min

Max

Min

Max

Failure to Fulfil the Obligation to Inform (KVKK A.18/a and A.10)

13.391

267.883

29.852

597.191

Non-fulfilment of Obligations Related to Data Security (KVKK A.18/b and A.12)

40.179

2.678.863

89.571

5.971.989

Non-fulfilment of the Decisions issued by the Board (KVKK A.18/c and A.15)

66.965

2.678.863

149.285

5.971.989

Acting Contrary to the Obligation to Register and Notify the Data Controllers Registry (KVKK A. 18/ç and A. 16)

53.572

2.678.863

119.428

5.971.989

 2023 KVKK Administrative Fines

The amounts of administrative fines determined within the framework of the revaluation rate are quite high. In order not to be faced with administrative fines of this kind, data controllers must strictly comply with all obligations specified under the KVKK. 

You may reach the announcement text via the link.