My Personal Data Was Shared Online Without Consent: Where and How Can I Get It Removed in Turkey?

1. What counts as personal data, and when is sharing unlawful?

Personal data is any information relating to an identified or identifiable natural person (KVKK art. 3 [1]): your name, phone number, address, national ID number, or a photo or voice recording that identifies you. Information on health, sex life, criminal convictions, religion, and biometric or genetic data is special category personal data, subject to stricter rules (KVKK art. 6 [1]).

The basic rule is that personal data may not be processed without the person's explicit consent. The law lists exceptions, for example where a law expressly provides for it, where it is necessary for the controller's legal obligation or to exercise a right, or where the person has made the data public themselves (KVKK art. 5 [1]). The Board treats publishing documents containing personal data online as a form of processing (Board announcement on principle decision 2026/1301 [3]).

When KVKK does not apply, or applies only in part

Not every post can be removed through KVKK. The law excludes some situations (KVKK art. 28 [1]):

• Purely personal or household activities: processing by an individual solely about themselves or family members living in the same home, without giving the data to third parties, is outside the law. Public posting online gives the data to third parties and may therefore go beyond this exception.
• Freedom of expression, art, history, literature and science: processing for these purposes is outside the law, but only if it does not violate privacy or personality rights and does not amount to a crime.
• Data you made public yourself: as long as the processing remains proportionate and consistent with the law's principles, the data subject's rights, including the right to request deletion (but not the right to compensation), do not apply.

2. Preserve the evidence before you apply

Once content is removed or the poster deletes it, proof becomes harder. So:

• Take screenshots showing the full web address (URL), the date of the post and the account that shared it.
• Note the date you learned of the content; some deadlines run from that date.
• Do not re-share the content.
• If you plan to sue and the evidence may be lost, you can ask a court to preserve evidence (Code of Civil Procedure art. 400 [4]).

3. Which route does what?

4. Notice to the platform or website

The law calls this the notice method: a person whose rights are infringed first notifies the content provider (who produces or publishes the content) and, if there is no result within a reasonable time, the hosting provider, using their contact addresses (Law No. 5651 art. 2 [2]). On social media this usually means the platform's own reporting form.

Foreign social network providers with more than one million daily accesses from Turkey must appoint a representative in Turkey and publish the representative's contact details where they are easy to find (Law No. 5651 additional art. 4 [2]). Domestic or foreign social networks above that threshold must, under the text in force on the research date, give a reasoned positive or negative reply within 48 hours to requests concerning content covered by articles 9 and 9/A of the law. An amendment by Law No. 7578 removes this limitation on 1 November 2026, so the 48-hour reply duty then covers all requests from individuals (Law No. 7578 arts. 22 and 27, Official Gazette 1 May 2026 [5]).

5. KVKK request to the data controller

The data controller is the person or body that decides why and how personal data is processed (KVKK art. 3 [1]). The company, website operator, municipality or school that published your data may be one. The Board has also held that search engines are data controllers (Board decision 2020/481 [6]).

What can you ask for?

You can ask the controller to delete or destroy your data, to notify third parties to whom the data was transferred, and to compensate damage caused by unlawful processing (KVKK art. 11 [1]). When the reasons for processing no longer exist, the data must be deleted, destroyed or anonymised, either on the controller's own initiative or on request (KVKK art. 7 [1]). If all processing conditions have ended, the controller deletes the data and informs any third parties who received it; if a condition still applies, it may refuse with reasons (Deletion Regulation art. 12 [7]).

How to apply

The request must be made in Turkish, in writing (signed), by registered e-mail (KEP), with a secure electronic or mobile signature, from an e-mail address you previously gave the controller and that is registered in its system, or through an application built for this purpose (Communiqué on Applications to the Data Controller arts. 4–5 [8]). It must include:

• Name, surname and, for written requests, signature
• Turkish ID number (for foreigners: nationality and passport number)
• Address for service; e-mail and phone if available
• What you are asking for (for example, "deletion of my phone number and address from the content at this URL")
• Supporting documents (screenshots, list of URLs)

The controller must conclude the request as soon as possible and within 30 days at the latest. As a rule it is free; if the process involves an additional cost, the fee in the Board's tariff may be charged. A refusal must give reasons and be sent in writing or electronically (KVKK art. 13 [1]).

6. Complaint to the Personal Data Protection Board

If your request is refused, the answer is inadequate or no answer arrives in time, you may complain to the Board within 30 days of learning of the answer and in any case within 60 days of your request. You cannot complain without first applying to the controller (KVKK art. 14 [1]). The Authority also advises waiting for the controller's 30-day reply period and, if there is no reply, complaining within 60 days of the request (Board announcement [9]).

You can complain through the Authority's online Complaint Module (sikayet.kvkk.gov.tr) (Authority announcement [10]) or by a written petition with your name, surname, signature and address. Attach your request to the controller, proof that it was sent, any reply and documents supporting your claim; a lawyer acting for you must attach a power of attorney.

What can the Board do?

• It examines the complaint and replies. If it does not reply within 60 days of the complaint, the request is deemed rejected.
• If it finds a violation, it orders the controller to remedy it; the controller must comply within 30 days of notification.
• Where damage would be difficult or impossible to repair and the violation is clearly unlawful, it may order processing to stop (KVKK art. 15 [1]).

Awarding compensation is not among the Board's powers; the right of persons whose personality rights are infringed to claim compensation under general rules is preserved (KVKK art. 14(3)).

7. Removal from search engine results

Even if the content stays at its source, it may be possible to stop it appearing in searches on your name. This is called delisting, often discussed as the "right to be forgotten". Under Board decision 2020/481 of 23 June 2020 (Board decision [6]):

• You first apply to the search engine, which sets the form of the request and the documents required.
• If the search engine refuses or does not reply, you may complain to the Board and may also go directly to court.
• The request is assessed by a balancing test between your fundamental rights and the public's interest in access to the information.

Delisting does not delete the content at its source; it only stops the result from being listed for searches on your name. For the source, you must apply to the publisher separately.

8. Access ban for violations of private life

If online content violates the privacy of your private life (for example, your private photos or health information have been published), you can apply directly to the Cyber Security Presidency to have access to the content blocked (Law No. 5651 art. 9/A [2]). Until 31 July 2026 this was the task of the Information and Communication Technologies Authority (BTK); Law No. 7590 transferred it to the Cyber Security Presidency (Law No. 7590 art. 27, Official Gazette 31 July 2026 [11]).

The procedure set out in the law:

1. Application: give the full URL of the content, an explanation of how your rights are violated and information proving your identity. Incomplete applications are not processed.
2. Implementation: the President notifies the Association of Access Providers; access providers apply the measure within four hours at the latest. The block applies only to the infringing post, section, image or video, by URL.
3. Judicial approval: within 24 hours of your request you must submit it to a criminal judgeship of peace. The judge decides within 48 hours at the latest; otherwise the measure lapses automatically.
4. If the content is removed, the judge's decision automatically becomes void.

An access ban does not delete the content; it blocks access to that address through access providers (Law No. 5651 art. 2 [2]).

9. Removal and compensation through the courts

A person whose personality rights are unlawfully attacked may ask the judge for protection (Civil Code art. 24 [12]). You may ask for (Civil Code art. 25 [12]):

• prevention of a threatened attack and an end to an ongoing one (such as removal of the content);
• a declaration that an attack is unlawful, even if it has ended, where its effects continue;
• notification or publication of the judgment to third parties;
• material and non-material damages (Civil Code art. 25; for non-material damages, Code of Obligations art. 58 [13]).

You may sue in the court of your own domicile or the defendant's (Civil Code art. 25). The competent court is, as a rule, the civil court of first instance (Code of Civil Procedure art. 2 [4]). If delay risks serious harm, you can ask for an interim injunction to have the content removed before judgment (Code of Civil Procedure art. 389 [4]).

• Mediation: personality-rights claims are not among the disputes where mediation is a mandatory pre-condition to suing (Law No. 6325 art. 18/B [14]).
• Limitation: a damages claim is time-barred two years after you learn of the damage and the person liable, and in any case ten years after the act; if the act is a crime with a longer criminal limitation period, that period applies (Code of Obligations art. 72 [13]).

10. If the sharing is a crime

Some unauthorised disclosures are offences under the Turkish Criminal Code (Criminal Code arts. 134–139 [15]):

A complaint can be filed with the public prosecutor or the police, in writing or orally (Code of Criminal Procedure art. 158 [16]). For complaint-based offences, the deadline is six months from the day you learn of the act and the identity of the offender (Criminal Code art. 73 [15]). For complaint-based offences, an attempt at victim-offender mediation (uzlaştırma) is, as a rule, made (Code of Criminal Procedure art. 253 [16]). A criminal complaint does not replace the separate requests for removal of the content.

11. Hypothetical example

This example is entirely hypothetical. A former acquaintance of A posts a photo of A's medical report on a public social media account. A takes screenshots showing the URL and date and uses the platform's reporting form. Because the post concerns A's private life, A applies to the Cyber Security Presidency under article 9/A and submits the request to a criminal judgeship of peace within 24 hours. Finding the same content on a forum, A sends the site operator a KVKK deletion request and keeps the proof of delivery. A also files a complaint with the public prosecutor. Whether each request succeeds is for the judge, the Board or the prosecutor to assess on the facts.

12. Frequently asked questions

I don't know who posted it. Can I still apply?

Yes. An access-ban application requires the URL of the content and your own identity details, not the poster's identity. The prosecutor must also start investigating as soon as they learn of circumstances suggesting a crime (Code of Criminal Procedure art. 160). For complaint-based offences, the six-month period starts when you learn who the offender is.

The content is on a foreign website. What changes?

Because an access ban is applied through access providers in Turkey, the content may remain reachable from abroad. To remove it at its source, you must also apply to the site or platform itself.

I posted the photo myself first. Can I object to others spreading it?

It depends. For data you made public yourself, the KVKK rights, including deletion (but not compensation), do not apply as long as the processing is proportionate (KVKK art. 28(2)). For special category data, processing must also match your intention in making it public (KVKK art. 6). If the use goes beyond these limits or violates your personality rights, you can go to court.

A news site mentions my name and an event from years ago. Can I ask for deletion?

Publications within freedom of expression and the press are outside KVKK unless they violate privacy or personality rights (KVKK art. 28(1)). The Board has said it assesses requests to delete data from news reports under the law, and that delisting requests to search engines involve a balancing test (Board decision 2020/481). The outcome depends on factors such as how current the news is and the public interest.

My data leaked from a company and was published online. What can I do?

If data a controller processes is obtained by others unlawfully, the controller must notify you and the Board as soon as possible (KVKK art. 12(5)). You can apply to the company under KVKK and ask for your damage to be compensated, and file a criminal complaint against those who disseminate the data (Criminal Code art. 136).

Do I need a lawyer for these applications?

No. You can apply to the data controller, complain to the Board and apply for an access ban yourself. Where deadlines are short and several routes run in parallel, it is worth assessing on the facts which route to prioritise.