What can a person do when their personal data is processed unlawfully? Is the only option to complain to the Board, or can they also claim for the harm they suffered? In the KVKK ecosystem, avenues of redress are multi-layered: administrative sanctions, administrative litigation, compensation under private law, and, in certain cases, criminal liability all operate together.
In this article we address compensation and legal remedies under the KVKK, keeping to the general framework, under the headings of challenging Board decisions, material and moral damages, and the criminal dimension.
A General Map of the Avenues of Redress
In disputes concerning the protection of personal data, three distinct legal tracks complement one another:
- Administrative track: Complaint to the Personal Data Protection Board and the decisions the Board issues.
- Private-law track: Actions for material and moral damages brought to compensate the harm.
- Criminal track: The criminal process for offences defined in the law and in the Turkish Penal Code.
These tracks are as much complementary as they are alternatives; a person may both apply to the Board and separately bring an action for their damages.
A complaint to the Board and a compensation action do not replace one another; they serve different aims and can proceed together.
Application to the Board and the Administrative Process
The data subject first applies to the data controller. If the application is rejected, found insufficient, or not answered in time, they may lodge a complaint with the Personal Data Protection Board. If the Board finds a violation after its review, it may order various measures and administrative sanctions against the controller.
What matters at this stage is procedural discipline: applying to the controller, tracking the deadlines, and preserving documents. The Board process addresses the administrative dimension of the violation, independently of any compensation claim.
Legal Remedy Against Board Decisions: Administrative Litigation
Because the Board is an administrative authority, its decisions are administrative acts. The remedy against Board decisions is therefore administrative litigation; that is, decisions may be challenged before the administrative courts.
This is a valid avenue of review both for a controller subjected to a sanction and for a data subject whose complaint has been rejected. Administrative litigation reviews the lawfulness of the act. Paying attention to the time limits for bringing an action and to procedural rules is critical on this path.
Material and Moral Damages: General Provisions
The KVKK does not establish a separate, self-contained compensation regime for harm arising from unlawful processing; instead it refers to the general provisions. In other words, compensation for the harm is claimed within the framework of the law of obligations and general liability principles.
Within this framework, two types of harm are distinguished:
- Material harm: Concrete losses in one's assets (for example the monetary equivalent of a loss).
- Moral harm: Abstract harm such as the distress, grief and reputational loss caused by the violation of personality rights.
Under the general provisions, a person claiming compensation is, as a rule, expected to establish the harm, the unlawful act, and the causal link between them. These actions are heard in the judicial (civil) courts, independently of the administrative process.
The Criminal Dimension: Reference to the Turkish Penal Code
For certain unlawful acts concerning personal data, the KVKK refers to the Turkish Penal Code. Acts such as unlawfully recording, obtaining, disseminating, or failing to destroy data may give rise to criminal liability.
What matters here is framing it correctly: the criminal process runs through the prosecutor's office and the criminal courts; it is a track separate from administrative sanctions and private-law compensation. The same event may simultaneously produce administrative, civil and criminal consequences.
Comparing the Avenues
The table below summarises the three main tracks with their core features.
| Dimension | Administrative (Board) | Compensation (Private Law) | Criminal |
|---|---|---|---|
| Forum | Board, then administrative court | Judicial (civil) courts | Prosecutor, criminal courts |
| Claimant | Data subject | The injured party | Via complaint/investigation |
| Basis | KVKK | General provisions | Reference to the Penal Code |
| Outcome | Measure/administrative sanction | Material/moral damages | Criminal sanction |
Steps to Follow When Seeking Redress
A practical sequence a data subject can follow in the face of a violation:
- Gather the evidence. Systematically keep screenshots, correspondence and dates.
- Apply to the data controller. Before turning to legal channels, apply directly and await the response.
- Complain to the Board. If the application yields no result, lodge a complaint with the Board.
- Escalate to administrative litigation if needed. If you disagree with the Board's decision, consider an action before the administrative court.
- Bring a compensation action. If there is concrete harm, claim material and/or moral damages under the general provisions.
- Assess the criminal dimension. For acts that may constitute an offence, consider applying to the relevant authorities.
Example Scenario
After leaving a job, an employee learns that their former employer shared sensitive data from their personnel file with unrelated third parties. The employee first assembles the correspondence and witness information, then applies to the data controller requesting that the situation be corrected.
When the application is not answered satisfactorily, they lodge a complaint with the Board. At the end of the Board's review, the administrative dimension is addressed. Even so, the employee does not consider this sufficient for the reputational and moral harm they suffered. Therefore, independently of the administrative process and relying on the general provisions, they bring an action for moral damages before the judicial courts. They also consider applying to the relevant authorities regarding the criminal dimension of the act.
In the end a single event sets in motion three distinct but complementary legal tracks.
Frequently Asked Questions
If I complain to the Board, can I no longer bring a compensation action?
You can. A complaint to the Board is an administrative avenue focused on finding the violation and imposing sanctions. You may separately bring a compensation action for your material or moral harm under the general provisions; the two paths do not exclude one another.
If I am unhappy with the Board's decision, where do I turn?
Because the Board is an administrative authority, its decisions are administrative acts and can be challenged in administrative litigation, that is, before the administrative courts. It is important to observe the time limits for bringing an action.
Is material harm always required for moral damages?
No. Moral damages target abstract harm such as the distress and reputational loss caused by the violation of personality rights; they can be claimed even without a material loss. Claims are assessed within the framework of the general provisions.
Does every violation give rise to criminal liability?
No. Criminal liability arises for the specific acts defined by the law and the Penal Code. Not every instance of unlawful processing automatically constitutes an offence; the administrative, civil and criminal dimensions are assessed separately according to the nature of the event.
This content is for general informational purposes only and does not constitute legal advice.
With JUS. you can record your application, complaint and breach processes and manage your deadlines and evidence in one place; request a demo for the details.