KVKK art. 11(g) — a right to object with no offence of its own to enforce it
Binds Every data controller processing personal data in Türkiye, with no size, sector or turnover threshold — the right is asserted against «the data controller» without qualification, so enterprise, SME and public body alike. Art. 2 applies the Law to natural persons whose personal data are processed and to natural or legal persons processing personal data wholly or partly by automated means, or by non-automated means provided the processing forms part of a data filing system. The exemptions in arts. 28(1) and 28(2) are the boundary to check before assuming coverage, and the second of them matters here: art. 28(2) disapplies certain articles — but not the Law as a whole — where processing is, among other cases, necessary for preventive, protective and intelligence activities by public institutions charged with national defence, national security, public security or the economic security of the State, or is carried out for investigation, prosecution, trial or execution proceedings by judicial authorities. Hiring, credit scoring and insurance underwriting all fall inside the ordinary scope. Two practical features shape who is exposed. First, VERBİS: art. 16 requires controllers to enrol in the Data Controllers' Registry before beginning to process, subject to exemptions the Board sets by criteria including the number of employees, annual balance sheet total and the nature of the business, so the population of registered controllers is enumerated and the Authority knows where to look. Second, the representative rule — a controller not resident in Türkiye must appoint a representative there and enrol through it — so an offshore scoring engine reaching Turkish data subjects is not outside the frame. The limit to state plainly is the one in the text: art. 11(g) attaches to a result produced by analysing data processed «solely» through automated systems, and the Law offers no guidance on what degree of human involvement defeats that, nor has the Board issued a decision defining it.. Türkiye's automated-decision rule is a single sub-paragraph of a rights article, and it is drafted as an objection right rather than as a prohibition. Article 11 of Law No. 6698 on the Protection of Personal Data lists what a data subject may demand of a controller, and limb (g) gives the right «to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems». Read against GDPR art. 22 the differences are structural rather than cosmetic. There is no bar on taking the decision: the controller may make it, and the data subject's remedy is to object after the fact. There is no exception architecture, because a right to object needs none — no contract limb, no explicit-consent limb, no authorised-by-law limb, and so nothing corresponding to GDPR art. 22(2) or to the three ways out in s. 62(2) of Zambia's Act. There is no right to obtain human intervention and no right to contest as a distinct step, so the safeguard triad that Zambia carries in full is absent here. And there is no explanation limb anywhere: art. 11 runs (a) to (ğ) and none of its limbs is a logic-disclosure item, while the art. 10 duty to inform at the point of collection covers the controller's identity, the purpose of processing, to whom and for what purpose processed data may be transferred, the method and legal reason of collection, and the art. 11 rights themselves — it does not require a controller to volunteer that a decision was automated. The trigger wording is also narrower than the European one in a way worth preserving: «a result against the person» (kişinin kendisi aleyhine bir sonucun ortaya çıkması) requires an adverse outcome, where GDPR art. 22 catches legal or similarly significant effects whether adverse or not, and where the Swiss art. 21(1) reaches a decision with a legal consequence even absent adversity. A favourable automated decision produces no art. 11(g) right. The 2024 amendment to the Law, made by Law No. 7499 of 12 March 2024, rewrote art. 6 on special categories of personal data and art. 9 on transfers abroad and added the standard-contract notification duty now penalised in art. 18; it did not touch art. 11.
In force since 7 October 2016, and the publication date of the Law is not the operative date for this article. Law No. 6698 was published in the Official Gazette of 7 April 2016, No. 29677, and art. 32 splits commencement: most of the Law entered into force on publication, but arts. 8, 9, 11, 13, 14, 15, 16, 17 and 18 «shall enter into force after six months as of the date of its publication», which brings art. 11 — and with it limb (g) — to 7 October 2016. The 7 April 2016 date carried by most secondary accounts is the Law's date, not this obligation's, and the six-month tranche is easy to miss because it is stated once in the final article rather than in the rights article itself. The grouping is also informative: the same tranche carries art. 13 (application to the controller), art. 14 (complaint to the Board), art. 15 (examination by the Board) and art. 18 (misdemeanours), so the right and its entire enforcement route commenced together on one date, by design. Nothing since has moved it. Law No. 7499 of 12 March 2024, published 12 March 2024, amended arts. 6 and 9 and added a limb to art. 18 with its own 1 June 2024 commencement for the transfer regime, and left art. 11 untouched. Türkiye signed Convention 108+ on 10 October 2018 but has not ratified it, and the Convention itself is not in force, so art. 9(1)(a) of that instrument supplies no independent Turkish rule of the kind the Malabo Convention supplies for Namibia. A live watch, recorded rather than published: a draft AI law modelled on the EU AI Act was submitted to the Grand National Assembly in June 2024 and referred to committee, and successive drafts have circulated since; none has been enacted, so Türkiye has no AI-specific statute in force and art. 11(g) remains the operative automated-decision rule.
Stated maximum penalty — No fine attaches to art. 11(g) directly, and finding that out means reading art. 18 limb by limb rather than quoting the headline range. Art. 18(1) penalises exactly five things: failure to fulfil the art. 10 duty to inform; failure to fulfil the art. 12 data-security obligations; failure to comply with decisions issued by the Board under art. 15; breach of the art. 16 registry obligations; and, since Law No. 7499, failure to make the art. 9(5) standard-contract notification. Breach of a data subject's art. 11 rights is not among them. The enforcement route is therefore indirect and sequential, and it is the route the Law commenced alongside the right itself. Art. 13 requires the data subject to apply to the controller first, and the controller to conclude the request within thirty days at the latest. Art. 14 allows a complaint to the Personal Data Protection Board where the application is rejected, the reply is insufficient, or no reply arrives in time — within thirty days of learning the reply and in any case within sixty days of the application. Art. 15(5) then provides that where an infringement is established the Board «shall decide that the identified infringements shall be remedied by the relevant data controller», and that decision must be implemented without delay and within thirty days at the latest. Only if the controller fails to implement it does a fine become available, and it becomes available under art. 18(1)(c) — non-compliance with a Board decision — rather than under anything about art. 11. The statutory band for that limb is 25,000 to 1,000,000 Turkish lira as printed in the 2016 text, and the printed figures are not the payable ones: art. 18 fines are uprated for every calendar year under art. 17(7) of the Misdemeanour Law No. 5326 read with repeated art. 298 of the Tax Procedure Law No. 213, using the annual revaluation rate, so a decade of compounding sits between the statutory numbers and the current ones. The revalued figures are not published in this row because the Authority's own annual announcement was not retrieved for this check; the statutory band and the revaluation mechanism are recorded instead, and the current-year table should be read from the Authority before any figure is quoted. Two further routes exist alongside: art. 11(ğ) preserves a right to claim compensation for damage through the ordinary courts, and arts. 135 to 140 of the Turkish Penal Code No. 5237 create separate imprisonment offences for unlawful recording, transfer and non-deletion of personal data — none of which is an automated-decision offence. Impact tier: all entities.