What changed: KVKK announced that answering data subject requests only by phone call, face-to-face briefing or similar verbal methods is not accepted as the response required under the Law and the Communique.
Who is affected
Data controllers receiving requests from data subjects are in scope; the source does not specify sectors or business size.
What it means for your business
For businesses receiving data subject requests, this means the final response should not be left to a verbal conversation; it should be sent in writing or electronically.
What to do
Send the final response to data subject requests in writing or electronically; clearly record accepted requests, reasons for rejected requests and actions taken. Consult your accountant or legal adviser before acting on this.
When it takes effect
The source gives no effective date or deadline; the notice was published on 1 October 2026.
