Data Protection (Law No. 6698) in the Turkish Gambling Sector: Complete Compliance Guide

The intersection of data privacy and the gambling industry in Turkey is one of the most complex regulatory environments in the global iGaming world. Unlike many European jurisdictions where online casinos operate under clear, localized licensing frameworks, Turkey maintains a strict state monopoly on legal betting. Private casinos and online gambling platforms are officially prohibited within the country's borders. However, this restriction has not stopped the massive growth of offshore online casinos targeting Turkish players, nor has it eliminated the physical casino industry in the Turkish Republic of Northern Cyprus (TRNC), which relies heavily on Turkish tourists.

This unique landscape creates a massive, often gray, data processing ecosystem. Whether you are an offshore operator licensed in Curacao or Anjouan, or a physical casino resort in Northern Cyprus, if you are collecting personal and financial data from Turkish citizens, you fall under the scope of Turkey’s Personal Data Protection Law No. 6698, commonly known as KVKK. Understanding this law is no longer just a legal formality; it is a fundamental requirement for operational survival, player trust, and avoiding severe financial and criminal penalties.

The Core Framework: What is Law No. 6698 (KVKK)?

Enacted in 2016 and modeled closely after the older European Data Protection Directive (which later evolved into the GDPR), KVKK is the primary legislation governing the processing of personal data in Turkey. The law applies to any natural or legal person that processes personal data, provided that the data subjects are located in Turkey, regardless of where the company is legally registered.

The legislation is enforced by the Personal Data Protection Authority (KVKK Kurumu) and its decision-making body, the Personal Data Protection Board. For the gambling sector, the law introduces strict rules on how player data must be collected, stored, shared, and eventually destroyed. It shifts the burden of proof onto the operator, meaning that in the event of a dispute or audit, the casino must prove it had a legal basis for processing the player's data, rather than the player having to prove their rights were violated.

Defining the Key Terms for Operators

To navigate KVKK, gambling operators must clearly understand the legal terminology used in the text. The law distinguishes between the entity that controls the data and the individual whose data is being collected.

• Data Controller (Veri Sorumlusu): The entity that determines the purposes and means of processing personal data. In the iGaming context, this is the casino operator or the platform provider holding the player accounts.
• Data Subject (İlgili Kişi): The natural person whose personal data is processed. For casinos, this is the registered player.
• Explicit Consent (Açık Rıza): Freely given, specific, informed, and unambiguous indication of the data subject's wishes. This is the primary legal basis for processing sensitive data in Turkey.
• VERBIS: The Data Controllers Registry Information System. A mandatory national database where operators must register their data processing activities.

Why the Gambling Sector is a High-Risk Zone for KVKK

The gambling industry inherently requires the collection of vast amounts of personal and financial information. To comply with global Anti-Money Laundering (AML) standards and local financial regulations, operators must perform rigorous Know Your Customer (KYC) checks. This means collecting national ID numbers, passport copies, utility bills, and detailed banking information.

This creates a direct conflict between data protection principles and financial compliance requirements. KVKK mandates "data minimization," meaning operators should only collect data that is strictly necessary for a specific purpose. However, AML regulations demand extensive data collection to prevent financial crimes. Furthermore, the Turkish Financial Crimes Investigation Board (MASAK) requires operators to retain transaction records and customer identification data for up to 8 years after the business relationship ends.

Operators often struggle with this paradox. The practical solution lies in strict data segmentation. While you must retain core financial and identity data to satisfy MASAK and KVKK's legal retention exceptions, you must delete or anonymize secondary data (such as marketing preferences, browsing history on the site, or customer support chat logs) as soon as their specific purpose is fulfilled. You cannot use a blanket "legal obligation" excuse to hoard all types of player data indefinitely.

The Extraterritorial Reach: Foreign Operators and Turkish Players

One of the most common misconceptions among international iGaming operators is that holding a license from Malta, Curacao, or the Isle of Man exempts them from local Turkish laws. This is fundamentally incorrect when it comes to data privacy. Article 2 of KVKK explicitly states that the law applies to data processors located outside of Turkey if the processing relates to data subjects residing within Turkey.

If your casino accepts Turkish Lira (TRY), offers customer support in Turkish, or runs localized marketing campaigns targeting Turkish IP addresses, the Personal Data Protection Board will consider you a data controller operating under their jurisdiction. This means foreign operators must comply with KVKK just as a domestic company would, including registering with VERBIS and appointing a local representative or legal liaison in Turkey to handle communication with the Authority.

Core Compliance Obligations for Gambling Operators

To avoid severe administrative fines and potential website blocking, operators must implement a comprehensive data protection framework. The following obligations form the backbone of KVKK compliance for any entity processing Turkish player data.

• VERBIS Registration: Before processing any data, the operator must register in the VERBIS system. This requires declaring the categories of data collected, the purpose of processing, the retention period, and the security measures taken. Failure to register carries heavy daily fines.
• Obtaining Explicit Consent: For non-essential data processing (like sending promotional SMS or emails), operators must obtain explicit consent. This consent cannot be buried in the Terms and Conditions; it must be a separate, clear opt-in mechanism. Pre-ticked boxes are strictly prohibited.
• Data Retention and Destruction Policy: Operators must draft and publish a internal policy detailing how long data is kept and the methods used to securely destroy it once the retention period expires or the player requests deletion (subject to AML retention laws).
• Technical and Administrative Security Measures: Under Article 12, operators must implement robust cybersecurity measures. This includes regular penetration testing, encryption of player databases, strict access controls for staff, and employee training on data privacy.

Player Rights vs. Operator Obligations: A Practical Breakdown

Understanding KVKK requires looking at it from both sides of the table. The law grants specific rights to the players, and in return, imposes strict operational obligations on the casino. Here is how these rights and obligations translate into daily iGaming operations.

Data Subject (Player) Rights	Data Controller (Operator) Obligations	Practical Application in iGaming
Right to know if their data is processed	Must provide clear, transparent privacy notices	Translating privacy policies into clear, accessible Turkish. Avoiding hidden clauses in lengthy Terms and Conditions.
Right to request information about the processing	Must respond to data subject applications within 30 days, free of charge	Setting up a dedicated legal or compliance email address to handle player data requests and tracking the 30-day deadline strictly.
Right to learn the purpose of processing	Must limit data collection to stated, legitimate purposes	Not collecting a player's phone number for KYC and then using it for automated marketing calls without separate consent.
Right to request deletion or destruction of data	Must delete data when the legal purpose ends, unless retention is required by other laws	Deleting a player's marketing profile upon request, but retaining their transaction history for 8 years to comply with MASAK regulations.
Right to object to automated decision-making	Must not rely solely on automated processing if it produces legal or significant effects	Allowing players to appeal an automated account ban or bonus restriction by speaking to a human compliance officer.

Cross-Border Data Transfers: The Biggest Hurdle for Offshore Casinos

For offshore gambling operators, Article 9 of KVKK regarding cross-border data transfers is often the most difficult compliance hurdle. The law states that personal data cannot be transferred abroad without the explicit consent of the data subject, unless specific conditions are met.

The first condition is that the destination country must have "adequate" data protection laws as determined by the Turkish Personal Data Protection Board. Currently, the Board has a very limited list of countries deemed "adequate." Most popular iGaming licensing jurisdictions and server locations do not fall into this category.

If the destination country is not on the adequate list, the operator must rely on the second mechanism: a formal commitment letter (taahhütname). The data controller in Turkey (or the foreign operator acting as such) and the foreign data recipient must sign a legally binding commitment to provide adequate data protection. Crucially, this commitment letter must be submitted to and approved by the Personal Data Protection Board before any data is transferred. For foreign operators without a legal entity in Turkey, navigating this approval process requires specialized local legal counsel.

Managing Server Locations and Cloud Providers

Many online casinos use cloud hosting services like AWS or Google Cloud. If the servers processing Turkish player data are physically located outside of Turkey, this constitutes a cross-border transfer. Operators must audit their IT infrastructure to ensure that either the servers are located in Turkey, explicit consent is obtained from players for international transfers, or the proper Article 9 commitment mechanisms are in place with the cloud provider.

Penalties for Non-Compliance: What is at Stake?

The Turkish government has significantly increased the administrative fines under KVKK in recent years to deter non-compliance. For the gambling sector, the financial risks are compounded by the fact that operators are already operating in a restricted market.

• Administrative Fines: Fines for failing to inform data subjects, failing to implement data security measures, or failing to register with VERBIS are updated annually. In 2026, these fines can reach millions of Turkish Lira for severe or repeated violations.
• Criminal Sanctions: Under the Turkish Criminal Code, illegal collection of personal data can result in imprisonment ranging from one to three years. If the data is obtained through specific violations of data protection laws, the penalties increase. Illegally transferring data abroad can also lead to criminal charges for the company directors.
• Access Bans and Blocking: While the Information and Communication Technologies Authority (BTK) already blocks unauthorized gambling sites, a confirmed data breach or KVKK violation gives regulators additional grounds to block the operator's payment gateways, affiliate domains, and mirror sites.

Step-by-Step Compliance Checklist for Gambling Operators

Achieving and maintaining KVKK compliance is not a one-time task; it requires continuous monitoring and updating. For operators targeting the Turkish market, the following checklist provides a practical roadmap to building a compliant data protection framework.

1. Conduct a Comprehensive Data Mapping Exercise: Identify exactly what data you collect from Turkish players, where it is stored, who has access to it, and how long it is kept. Document the legal basis for each processing activity.
2. Update Privacy Notices and Consent Mechanisms: Rewrite your privacy policy in clear, plain Turkish. Ensure that consent for marketing is separate from the acceptance of Terms and Conditions. Implement granular opt-in options.
3. Register with VERBIS: Work with local legal experts to prepare your data controller declaration and submit it to the VERBIS system before the deadline. Keep this registry updated as your data processing activities change.
4. Establish a Data Breach Response Plan: Create a protocol for detecting, reporting, and managing data breaches. Under KVKK, you must notify the Authority within 72 hours of becoming aware of a breach and inform the affected players as soon as possible.
5. Audit Cross-Border Transfers: Review your contracts with third-party vendors (payment processors, game providers, cloud hosts). Ensure Article 9 commitments are signed and approved if data is leaving Turkey.
6. Train Your Staff: Conduct regular training for customer support, KYC, and marketing teams. They need to understand how to handle player data requests and recognize phishing attempts or social engineering attacks.

Conclusion: Building Trust in a Restricted Market

Navigating Data Protection Law No. 6698 in the Turkish gambling sector is undeniably complex. The clash between strict local gambling prohibitions, rigorous financial crime regulations, and comprehensive data privacy laws creates a challenging environment for operators. However, viewing KVKK merely as a legal burden is a short-sighted approach.

In a market where Turkish players are already highly cautious about the legitimacy of online platforms, demonstrating a strong commitment to data protection can be a significant competitive advantage. When players see that an operator is transparent about data usage, respects their right to privacy, and complies with local regulations like VERBIS, it builds a foundation of trust. Ultimately, robust data protection is not just about avoiding fines; it is about creating a secure, reliable environment where players feel confident engaging with your platform. As the regulatory landscape continues to evolve in 2026 and beyond, operators who prioritize privacy by design will be the ones that sustain long-term success.