KVKK Decisions in Türkiye in 2025: SMS Consent, VERBİS and Sanctions
Decisions published by Türkiye’s Personal Data Protection Board in 2025 included measures directly affecting retail, service delivery, VERBİS and explicit-consent processes.
What’s in this article?
Decisions published by Türkiye’s Personal Data Protection Board in 2025 included measures directly affecting retail, service delivery, VERBİS and explicit-consent processes.
This is not a statistical ranking of all Board decisions from 2025. It focuses on selected official decisions and regulations that directly affect companies’ daily KVKK operations.
1. 2025/1072 – SMS verification codes and explicit consent
Principle Decision No. 2025/1072 of 10 June 2025 addressed combining SMS verification during payment, membership, quotation or similar transactions with marketing or other activities requiring explicit consent.
Specifically:
- clearly explain the purpose of the SMS to the user;
- do not combine different processing activities into one action;
- offer separate choices for activities requiring explicit consent;
- keep privacy information and explicit consent separate;
- do not present marketing consent as a mandatory product or service condition.
The Board emphasised these points.
Impact for Retail and E-Commerce
Review any till, app or checkout process in which one SMS code represents bundled consent for membership, marketing and other processing purposes.
2. 2025/1572 – VERBİS exemption criterion
Decision No. 2025/1572 of 4 September 2025 introduced a VERBİS exemption criterion for certain small controllers whose main activity is processing special categories of personal data.
Even where this is their main activity, controllers may qualify if:
- their annual employee count is below 10 and
- their annual balance sheet total is below TRY 10 million.
Natural-person or legal-entity controllers meeting these criteria may be exempt from registration.
Not to be confused with general VERBIS Exception
Different thresholds apply where processing special categories of data is not the main activity. Determine the exemption group from actual operations and current Board decisions.
3. 2025 KVKK Administrative Fines
Administrative fines in Article 18 of Law No. 6698 are updated annually in accordance with the revaluation rate.
A fine cannot be predicted solely from minimum and maximum amounts. The facts, type of infringement and Board assessment matter.
Operational compliance priorities for 2025
Selected official developments have highlighted the following controls, especially for companies:
- Separation of consent flows,
- SMS processes at checkout and in stores
- the distinction between explicit consent and the duty to inform,
- Correct determination of the VERBIS exception,
- Compliance of inventory and VERBIS information with actual activity.
2025 KVKK Official Decision Checklist
- Does SMS verification comply with Decision 2025/1072?
- Is marketing consent separate from the service requirement?
- Is privacy information provided separately?
- Is VERBIS status checked taking into account 2025/1572?
- Are both exemption criteria actually met?
- Is the data inventory up to date?
- Is the current administrative-fine table being used?
The B10 Approach
B10 Digital Agency turns Board decisions into practical checklists for web, CRM, employee, store and e-commerce operations, rather than treating them only as legal bulletins.
Official Sources
- KVKK - Principle Resolution 2025/1072
- KVKK - Announcement of the VERBIS Exception Decision 2025/1572
- KVKK – Current administrative-fine amounts
Conclusion
The useful lesson from the 2025 decisions is not an unsourced ranking of the most penalised areas, but identifying which controls must change in actual data-processing workflows.
This content is for general information only.