How to File a KVKK Complaint: A Step-by-Step Guide

⏱️ Reading time: 9 min · 📁 Category: KVKK & Digital Compliance

How to File a KVKK Complaint: A Step-by-Step Guide (2026)

If you believe your personal data is being processed unlawfully, you have the right to make a complaint under KVKK.
Before going directly to the Personal Data Protection Board, however, there is a mandatory preliminary step :
applying to the data controller.

This guide explains the KVKK complaint process as practised in 2026 step by step.

1️⃣ Prerequisite: apply to the data controller first (mandatory)

The KVKK rule is: Apply to the data controller before complaining to the Board.
The data controller may be the institution or company processing your data: a bank, online shop, hospital, employer, residential property management or app provider, for example.

🧾 What can you request?

Whether my data is processed
The purpose and legal basis of any processing
Whether data has been transferred to third parties
Correcting incorrect/missing data
Deletion, destruction or anonymisation
Stopping processing activity, etc.

💡 Practical tip: Always attach evidence to your application: screenshots, emails, SMS, contracts, call recording details,
privacy notices, logs, URLs or timestamps. General applications without evidence are weaker. 2️⃣ Response Time of the Data Controller: 30 Days

The data controller must resolve your application within 30 days at the latest and notify you in writing or electronically.
Additional costs may lead to charges in some cases; the application procedure must still be properly followed.

3️⃣ Deadlines for complaints to the Board (the critical part)

There are two main complaint deadlines. In practice, they are treated as critically important, much like time limits after which rights lapse.

🅰️ From learning of the response: 30 days

If the data controller responds with a refusal or an inadequate answer, you may complain to the Board within 30 days of learning of that response.

🅱️ In all cases, from the application date: 60 days

If the data controller does not respond within 30 days or the process takes longer, you may complain to the Board within 60 days of the application date.

⚠️ Summary: Apply first → allow 30 days for a response → complain to the Board within 30 days of the response, and in all cases within 60 days of applying.
The Authority’s public announcements also explain that the person concerned need not wait for a reply once the data controller’s 30-day response period has expired, even if a reply arrives later.
Calculate deadlines carefully for the specific case. 4️⃣ Where can you submit a complaint to the Board?

You can submit a complaint electronically through the KVKK Complaint Module.
The module includes profile updates, creating a complaint, uploading documents and confirming submission.

Online: KVKK Complaint Module
Guide: Complaint Module Guide (PDF)

5️⃣ What should a complaint contain?

Your complaint should clearly set out the facts, legal grounds and request. At a minimum, include:

Name/title of data controller
A summary of the breach (what happened, when did it happen, how did you find out?)
Affected personal data categories (identity, communication, location, visual, finance, etc.)
The right or obligation breached: information duties, deletion, data security, transfers, etc.
Your application to the data controller and its attachments
The data controller’s response, if any, and why it is inadequate
Request: stop processing, delete or correct data, halt transfers, impose sanctions, etc.

6️⃣ Documents to attach to strengthen your complaint

A copy of your application to the data controller
The response letter or email, if any
Screenshots, SMS, emails and call centre recording details
Contract, membership screen, privacy notice, cookie screen, etc.
Technical records: logs, timestamps, URLs

Note: In most cases, the complaint module also allows documents to be added later.
Still, include the main evidence and the full application/response history in your initial submission. 7️⃣ What happens after the Board’s review?

The Board may examine the complaint, request a defence or further information from the data controller, and impose administrative sanctions or measures if it finds a breach.
In some cases, an investigation may also begin on the Board’s own initiative.

❌ Common Mistakes (The Most Frequently Rejected Requests in 2026)

Complaining directly to the Board before applying to the data controller
Missing the 30-day or 60-day deadline
Leaving the request unclear rather than specifying what you want
Using an unsupported or overly general account: saying they used my data is not enough
Omitting the response date and the date you learned of it

✅ Short Checklist

I applied to the data controller
I tracked the 30-day response period
I met the 30-day and 60-day deadlines
I added evidence
I wrote my request clearly
I sent it through the Complaint Module

Get help drafting your KVKK application and complaint