Bank Secrecy, Customer Secrets and Personal Data in Turkey: Banking Law Art. 73, KVKK, Capital Markets Law Arts. 90 and 135 and Access to Records in Securities Disputes

Records are central to the 2026 fund and market manipulation cases: account statements, order and voice records, custody and transfer data, and the files held by the Capital Markets Board (SPK) and prosecutors. In Turkey, access to these records is governed by several overlapping secrecy regimes. Banking Law No. 5411 Art. 73 protects bank secrets and customer secrets. Since 2020, a customer secret may not be shared with third parties in Turkey or abroad without the customer’s request or instruction, even where the customer has given explicit consent under the data protection law. Capital markets rules separately protect custody account information (Communiqué III-37.1 Art. 64) and MKK records (Communiqué II-13.1 Art. 32). The Personal Data Protection Law No. 6698 (KVKK) governs data about individuals, including the cross-border transfer rules rewritten by Law No. 7499 in 2024. At the same time, SPK inspectors, Borsa İstanbul, MKK, MASAK, prosecutors and the courts can override these protections by statute. This guide explains who is bound by which rule, how a foreign institutional investor can obtain its own records, how records reach courts and criminal files, and what must be checked before records leave Turkey. It reflects the legislation in force as at 26 October 2026.

Why secrecy rules shape the 2026 disputes

Disputes over losses in Turkish funds and listed shares are decided on records. They include the investor’s account statements, the order forms and time stamps for each trade, the voice recordings of telephone orders, custody and transfer data at MKK and Takasbank, bank transfers between the persons involved, and the reports prepared by SPK inspectors. Almost all of these records are held by someone other than the investor, and almost all are covered by a confidentiality rule.

Turkish law does not treat confidentiality as absolute. Each regime names the persons who may receive protected information and the purposes for which they may use it. The practical questions for a foreign institution are therefore specific. Which records about its own account can it obtain directly, and from whom? Which records can be produced only by court order or reach it only through a criminal file? What may it share with its own lawyers, auditors and board outside Turkey? And what exposure arises if records concerning other persons, such as individual traders, are sent abroad without a lawful basis?

This guide answers those questions from the statutes and regulations. It does not repeat the rules on evidence and document production in civil claims, which are covered in our guide to evidence in Turkish securities claims, or the rules on suing SPK, covered in our guide to claims against the Capital Markets Board.

Five layers of protection

The Constitution sets the starting point. Everyone has the right to the protection of personal data concerning them, including the rights to be informed, to access the data, to request correction or deletion, and to learn whether the data are used in line with their purposes. Personal data may be processed only in cases provided by law or with the person’s explicit consent (Constitution Art. 20(3), added by Law No. 5982 in 2010). Below the Constitution sit four sets of statutory rules, each with its own scope and its own sanction.

These regimes apply side by side. A single bank statement showing a transfer from a fund manager’s company to a trader’s personal account is a customer secret of both account holders, personal data of the trader, and potentially evidence in a criminal case. Whether it can be disclosed, to whom and in what form depends on all applicable regimes, not just one.

Bank secrets and customer secrets: Banking Law Art. 73

Article 73 contains three distinct duties.

The supervisors’ duty. Members of the Banking Regulation and Supervision Board (BDDK), its staff, and members and staff of the Savings Deposit Insurance Fund (TMSF) may not disclose secrets of banks, their subsidiaries and their customers that they learn in the course of their duties, except to persons authorised under the Banking Law and their special laws. They may not use those secrets for their own benefit or that of others. The duty continues after they leave office and extends to BDDK’s outsourced service providers and their employees (Art. 73(1)). Secret information obtained by BDDK may be used for licensing, supervision, monitoring compliance and administrative suits against BDDK decisions. Apart from those uses, it may be given only to prosecutors and criminal courts in criminal investigations and prosecutions, and to current or former board members and staff who request it in connection with an investigation or prosecution concerning alleged offences committed in their duties (Art. 73(2), as amended by Law No. 6111 in 2011). Information that BDDK gives to foreign counterparts under memoranda of understanding falls outside this secrecy duty (Art. 73(2)).

The general duty. Persons who learn the secrets of banks or their customers by virtue of their status or duties may not disclose them to anyone other than the authorities expressly authorised by law. The duty continues after they leave office (Art. 73(3), first two sentences). This duty is not limited to bank employees. It reaches anyone whose position gives them access, such as auditors, valuers, outsourcing providers and lawyers.

The customer secret rule added in 2020. Law No. 7222 added the following to Art. 73(3):

1. 1. Data of natural and legal persons that arise specifically from banking activities after a customer relationship is established become customer secrets.
2. 2. Subject to mandatory provisions of other laws, and outside the exceptions in Art. 73, customer secrets may not be shared with or transferred to third parties in Turkey or abroad without a request or instruction from the customer. This applies even if the customer has given explicit consent under KVKK.
3. 3. On the basis of an assessment of economic security, the BDDK Board may prohibit sharing or transferring any data that are customer or bank secrets to third parties abroad. It may also decide that the information systems banks use, and their backups, must be kept in Turkey.
4. 4. All sharing, including sharing under the exceptions, must be limited to the stated purposes and proportionate, containing only the data those purposes require.

The exceptions in Art. 73(4). Learning bank or customer secrets is outside the secrecy duty in several situations. These include meeting requests by foreign supervisors that are BDDK counterparts, through BDDK. They also cover information exchanged between banks and financial institutions, directly or through the Risk Centre or companies set up by at least five banks or financial institutions. Further exceptions are valuations by prospective buyers of 10% or more of a bank’s capital, consolidation, risk management and internal audit by parent undertakings holding 10% or more, and valuation for the sale of assets including loans. Valuation, rating, support services, independent audit and service procurement complete the list. Each exception applies only where a confidentiality agreement is made and use is limited to the stated purposes. The BDDK Board may set the scope, form and procedures for sharing under paragraphs 3 and 4, and may restrict it (Art. 73(5), added in 2020).

Article 76 gives the customer a direct right to documents. Banks must establish a system to answer customers’ questions about the services provided. They must give customers a certified copy of loan agreements and, on request, a copy of every document relating to other transactions with the customer (Art. 76(1)). This is the most direct route for an investor to obtain the bank-side record of its own transactions, such as transfers, custody movements and foreign exchange conversions.

The BDDK Regulation on sharing secret information

The BDDK Regulation on Sharing of Secret Information was published in the Official Gazette on 4 June 2021 (No. 31501) and amended on 24 December 2021 (No. 31699). It entered into force on 1 July 2022 (Art. 8). It sets out how Art. 73 operates in practice, and several of its rules matter directly in investor disputes.

The fact of being a customer is a secret. Any information showing that a natural or legal person is a customer of a bank is a customer secret (Art. 4(3)). Data that existed before the customer relationship, including personal data, are not secrets on their own. They become customer secrets once processed in a way that shows the person is a bank customer (Art. 4(4)). A bank asked by a third party simply whether a given company holds an account with it is therefore asked to disclose a customer secret.

Sharing with authorities and in disputes. Sharing with authorities expressly authorised by law does not breach secrecy (Art. 5(1)). Where a bank is party to a dispute, it may share bank secrets, and customer secrets of the natural or legal persons who are parties to that dispute, if this is necessary to prove its claim or defence. It may share them with judicial authorities in Turkey or abroad and with arbitral, mediation and similar dispute resolution bodies. It may also share them with the persons representing it in the dispute, for submission to those bodies (Art. 5(7)). The exception covers disputes to which the bank itself is a party. It does not permit a bank to produce records about other customers in a dispute between third parties.

Proportionality in detail. Shared data must be limited to what the stated purposes require. It must be possible to show that every data set shared is necessary. Data must be aggregated, de-identified or anonymised where the purpose can still be achieved that way, and sharing must create as few copies as possible (Art. 6(1)). Health data and data on sexual life may not be shared with parties in Turkey or abroad on the basis of any of the exceptions, even if they are customer secrets (Art. 6(2)).

Customer requests and instructions. Without a customer request or instruction, customer secrets may not be shared outside the exceptions, even with explicit consent. A bank may not make consent, a request or an instruction a precondition for its services (Art. 6(3)). The request or instruction may be given in writing, or through a “durable medium” if it is provable. It may cover several transactions and, for continuing transactions, may be open-ended. The customer may revoke or change it by the same method (Art. 6(4)). For transfers, letters of credit, guarantees and similar transactions that by their nature require data to pass through other banks or settlement and messaging systems, the customer’s initiation of the transaction counts as the instruction (Art. 6(6)).

Data about other customers. When a customer asks for data to be shared, the proportionality review is limited to whether the bank followed the request. If the requested data set contains secrets of other customers, or of customers of other banks, the full proportionality requirements apply to that part (Art. 6(7)). A bank answering a request for transfer records may therefore limit the details it gives about the counterparties’ accounts to what the purpose requires.

Foreign sharing and internal control. The BDDK Board may prohibit sharing customer or bank secrets with third parties abroad on economic security grounds, applies the principle of reciprocity, and may restrict or stop sharing with parties in a country that does not observe reciprocity (Art. 6(11)). Each bank must have an Information Sharing Committee that coordinates sharing, assesses incoming requests and records its assessments. Its members include representatives of the business line, internal control, compliance and legal departments (Art. 7).

Confidentiality at investment firms, MKK and the exchange

The customer secret rules in Banking Law Art. 73 protect the customers of banks. The client information held by investment firms that are not banks is protected by capital markets rules instead. Banks that provide investment services are subject to both regimes.

Client orders. Investment firms must protect the confidentiality of client orders. Order information may not be passed to or used by any third party against the client and in the third party’s favour without the client’s knowledge (Communiqué III-37.1 Art. 19(1)(f) for execution and Art. 14(1)(e) for reception and transmission of orders). Our guide to investment services rules under Communiqué III-37.1 explains the conduct rules around these duties.

Custody accounts. Information about client accounts held in custody by an investment firm is confidential. Giving information to persons authorised by legislation, while informing the client, is not a breach (Communiqué III-37.1 Art. 64(1)). The duty to inform the client is a useful point of reference. An investment firm that has disclosed custody information to an authority should be able to say so, unless a specific rule such as the secrecy of an SPK examination or of a criminal investigation prevents it.

MKK records. MKK’s records are confidential. Giving information to persons or bodies authorised by law, or by legislation expressly authorised by law, is not a breach (Communiqué II-13.1 Art. 32(1)). Exchanges and central clearing institutions may obtain information for surveillance and central counterparty purposes under a protocol with MKK, stating the purpose and giving reasons, and must keep it confidential (Art. 32(2)). Our guide to MKK and book-entry securities describes how holdings are recorded, including in omnibus and foreign depository accounts.

SPK’s own secrets. SPK board members and staff may not disclose confidential information or trade secrets learnt in their duties to anyone other than authorities authorised by law, even after leaving office (Capital Markets Law Art. 121(3)). Article 135 adds a regime modelled on Banking Law Art. 73. SPK may use secret information for public offerings, licensing, supervision, monitoring compliance and administrative suits against its decisions. Otherwise, it may give that information only to prosecutors and criminal courts in criminal investigations and prosecutions, and to current or former board members and staff in proceedings about alleged offences connected with their duties (Art. 135(2)). Information given to foreign counterparts under memoranda of understanding is outside the secrecy duty. Where a memorandum lacks reciprocity or the counterpart is not bound by equivalent secrecy, the secrecy rules apply by analogy (Art. 135(2)–(3)).

Secrecy of an examination. Persons under SPK examination, and anyone asked for information about the matter, including public bodies, must keep the existence and nature of the examination secret (Art. 90(2)). A bank or investment firm that has received an SPK information request may therefore be unable to tell its client about it.

Who can lift secrecy, and on what basis

The secrecy regimes are subject to statutory powers that expressly prevail over them. Some powers belong to supervisors and market institutions, some to judicial authorities, and some to the customer or data subject.

Two points follow from the table. First, an investor cannot use the supervisory routes itself. SPK, the exchange, MKK and MASAK obtain information for their own functions, and what they obtain is in turn protected by their own secrecy rules. Second, a civil court is not in the same position as a criminal court. SPK and BDDK may give their secret information to prosecutors and criminal courts, but the statutes do not name civil courts among the recipients (Capital Markets Law Art. 135(2); Banking Law Art. 73(2)). For this reason, information gathered by supervisors often reaches civil claimants through the criminal file, as explained in our guide on joining a criminal case in Turkey.

Personal data: what KVKK adds

KVKK applies to natural persons whose personal data are processed and to natural or legal persons who process those data, wholly or partly by automated means or otherwise as part of a filing system (Art. 2). Personal data means any information relating to an identified or identifiable natural person. Processing covers almost any operation, from collection and storage to disclosure, transfer and making data available (Art. 3(1)(d)–(e)). In a securities dispute, KVKK is relevant to any record that names or identifies an individual. Examples are traders, portfolio managers, directors, account holders who are individuals, and the investor’s own staff.

Principles. Processing must be lawful and fair, accurate and where necessary kept up to date, for specified, explicit and legitimate purposes, relevant, limited and proportionate to those purposes, and retained only for the period required by legislation or the purpose (Art. 4(2)). Personal data may be processed only in accordance with KVKK and other laws (Art. 4(1)).

Legal grounds. As a rule, processing requires the data subject’s explicit consent (Art. 5(1)). Article 5(2) allows processing without consent on several grounds. Those most relevant to disputes are processing expressly provided for by law (a), necessary to comply with the controller’s legal obligation (ç), necessary for the establishment, exercise or protection of a right (e), and necessary for the controller’s legitimate interests without harming the data subject’s fundamental rights and freedoms (f). Ground (e) is the usual basis on which a party collects and uses personal data to bring or defend a claim.

Special categories. Data on criminal convictions and security measures are special category data, together with data on health, religion, biometrics and other listed matters (Art. 6(1)). Since the amendment of Art. 6 by Law No. 7499, in force from 1 June 2024, special category data may be processed on grounds that include express provision by law and necessity for the establishment, exercise or protection of a right (Art. 6(3)(b) and (d)). Adequate measures set by the KVKK Board must also be taken (Art. 6(4)). A litigation file that includes conviction records of individuals therefore needs particular care.

Domestic transfers. Personal data may be transferred without explicit consent on one of the Art. 5(2) grounds, or, with adequate measures, on one of the Art. 6(3) grounds. Provisions on transfers in other laws are reserved (Art. 8(2)–(3)).

Rights and remedies. Data subjects may ask whether their data are processed, request information, learn the purpose, know the third parties in Turkey or abroad to whom data have been transferred, request correction and deletion, object to adverse results of purely automated analysis, and claim compensation for damage caused by unlawful processing (Art. 11(1)). Applications are made to the data controller, which must respond within 30 days at the latest, free of charge unless the process involves an additional cost (Art. 13(2)). A complaint to the KVKK Board may be filed within 30 days of learning the controller’s response, and in any event within 60 days of the application, only after the application route has been used (Art. 14(1)–(2)). The right to compensation under general provisions is reserved (Art. 14(3)). If the Board does not respond to a complaint within 60 days, it is deemed rejected (Art. 15(4)).

Exemptions relevant to investigations. KVKK does not apply to processing by judicial authorities or enforcement offices in connection with investigation, prosecution, adjudication or enforcement (Art. 28(1)(d)). Articles 10, 11 (except the right to compensation) and 16 do not apply where processing is necessary for preventing crime or for a criminal investigation, or where public bodies process data for supervisory or regulatory duties (Art. 28(2)(a) and (c)). An individual who asks a broker under Art. 11 whether their data have been passed to SPK or a prosecutor may therefore receive a limited answer.

Sending records abroad

A foreign institution will usually want Turkish records reviewed by its own legal team, external lawyers in its home jurisdiction, auditors and decision-makers outside Turkey. Three questions arise. Does banking secrecy allow the record to leave the bank? Does KVKK allow the personal data in it to be transferred abroad? And does any other rule, such as the secrecy of a criminal investigation, restrict its use?

Banking secrecy. Customer secrets may not be shared with third parties abroad without the customer’s request or instruction, outside the statutory exceptions (Banking Law Art. 73(3)). When the investor asks its bank to send its own records to named recipients abroad, it supplies that request. The BDDK Board can prohibit foreign sharing on economic security grounds (Art. 73(3); Regulation Art. 6(11)), so the current position should be checked before relying on a standing instruction.

KVKK Article 9. Law No. 7499 replaced Art. 9 with effect from 1 June 2024. The previous first paragraph, which allowed transfers abroad with explicit consent, continued to apply alongside the new text until 1 September 2024 (Provisional Art. 3). The current Art. 9 sets three tiers.

Onward transfers from the recipient abroad, and transfers to international organisations, must also respect KVKK’s safeguards (Art. 9(8)). Where the interests of Turkey or the data subject would be seriously harmed, a transfer requires the Board’s permission after consulting the relevant public body, subject to international agreements (Art. 9(9)). Other laws on cross-border transfers are reserved (Art. 9(10)). The Board may order a cross-border transfer to stop where irreparable harm and clear unlawfulness are present (Art. 15(7)).

Criminal file material. Material obtained from a Turkish criminal file is subject to the secrecy of investigation procedures (Code of Criminal Procedure Art. 157) and any restriction order on file access. Before sending such material abroad, its status should be checked separately. Requests by foreign authorities for Turkish evidence follow the mutual legal assistance route described in our guide to international judicial cooperation in criminal matters.

Obtaining your own records

The investor’s strongest position is in relation to records about its own account. Several provisions give it direct rights, and it should use them before a dispute narrows the cooperation it receives.

From an investment firm. Investment firms holding client accounts must send account statements monthly, within five business days after the end of each period. At the client’s request, the statement may be sent by e-mail or made available online (Communiqué III-45.1 Art. 17(1)). It must show, for the period, every instrument bought or sold with the date, time, price and quantity, all movements of cash, securities and other assets held with the firm, and all commissions, fees and taxes charged (Art. 17(2)). Professional clients may agree in a separate contract or in the framework agreement that statements and reports will not be sent (Art. 17(3)). The firm bears the burden of proving that statements and reports were sent or made available (Art. 17(4)). Clauses deeming statements accepted after a period are void (Art. 17(5)). A signed copy of a written order form must be given to the client on request (Art. 9(1)).

Retention of records. Investment firms must keep all documents received and produced in connection with investment services, including order forms whether or not executed, electronic orders, fax and voice recordings, and remote identification records, for ten years in line with Commercial Code Art. 82 (Communiqué III-45.1 Art. 27(1)). Records that are the subject of a dispute must be kept until the dispute is concluded, regardless of the ten-year period (Art. 27(4)). Records must be kept in a structure that cannot be deleted, altered or falsified (Art. 27(5)). Under the anti-money laundering law, obliged parties must keep transaction documents, books and identification records for eight years (Law No. 5549 Art. 8).

From a bank. A bank must give a copy of every document relating to the customer’s transactions on request (Banking Law Art. 76(1)). Information about the customer’s own account is not a secret as against the customer. Information about the counterparty to a transfer, however, may be a customer secret of the counterparty (BDDK Regulation Art. 6(7)).

About individuals in the investor’s own organisation. Where an employee or portfolio manager of the investor is named in Turkish records, that individual may exercise KVKK Art. 11 rights against the Turkish data controller. The investor itself has no KVKK rights as a legal entity.

Records in civil and criminal proceedings

Civil proceedings. Parties must produce all documents in their possession on which they or the other side rely as evidence (Code of Civil Procedure Art. 219(1)). If the court finds that a document requested from the other side is necessary to prove an allegation and the request is lawful, and the other side admits possession, stays silent, or the document’s existence is shown by an official record or another document, it sets a final deadline for production (Art. 220(1)). If the party fails to produce without acceptable excuse, the court may accept the requesting party’s statement about the document’s content (Art. 220(3)). For documents held by third persons or institutions, the court orders production if it finds the document necessary to prove an allegation (Art. 221(1)). Third parties may refuse to produce on the grounds that allow refusal to testify (Art. 221(3)). These include information protected by law as a secret, but the refusal is not available if the owner of the secret permits disclosure (Art. 249(1)). An investor seeking its own bank records through the court can therefore remove the secrecy objection by giving its permission. For records about other persons, the court must be persuaded that the specific document is necessary for proof. Our guide to evidence covers preservation of evidence and production orders in more detail.

Criminal proceedings. During investigation and prosecution, information requested in writing by the prosecutor, judge or court must be provided within ten days. If this is impossible, the reason and the latest date for a response must be given within the same period. The request must state that non-compliance may constitute the offence of misconduct in office under Criminal Code Art. 257 (Code of Criminal Procedure Art. 332). Bank accounts may be seized where there is strong suspicion based on concrete evidence. For certain offences, a report is obtained from BDDK, SPK, MASAK or other listed bodies on the value derived from the offence (Art. 128(1)). Investigation procedures are secret unless the law provides otherwise, without prejudice to the rights of defence (Art. 157). Records gathered in a criminal file often become available to a victim who files a complaint and joins the proceedings, subject to the rules on file access.

The bank as a party. When a bank is itself a party to a dispute with the investor, it may share secret information concerning the parties with courts and arbitral bodies in Turkey or abroad to the extent necessary for its claim or defence (BDDK Regulation Art. 5(7)). The secrecy rule does not prevent a bank from defending itself with the relevant records.

Lawyers’ secrecy. Lawyers may not disclose matters entrusted to them or learnt in their professional capacity. They may testify about such matters only with the client’s consent, and even then they may refuse. Exercising the right to refuse gives rise to no civil or criminal liability (Attorneys Act Art. 36). The Code of Civil Procedure preserves this rule in the context of witness secrecy (Art. 249(1)).

When secrecy or data rules are breached

Breaches of secrecy can arise in two directions. A Turkish institution may disclose an investor’s information without a legal basis. Alternatively, the investor or its advisers may obtain or transfer information about others in breach of the rules. The sanctions differ according to the regime.

Where an offence may be prosecuted only on complaint, the complaint must be filed within six months of the day the person entitled learns of the act and the identity of the perpetrator, within the limitation period (Criminal Code Art. 73(1)–(2)). Judicial fines expressed in days are converted into money at a daily rate determined by the court.

Data controllers must take technical and organisational measures to prevent unlawful processing and access and to safeguard data. They are jointly responsible with processors acting on their behalf (KVKK Art. 12(1)–(2)). If processed data are obtained by others unlawfully, the controller must notify the data subject and the Board as soon as possible (Art. 12(5)). Civil compensation is available for unlawful processing (Art. 11(1)(ğ); Art. 14(3)) and under the general rules on tort and personality rights.

For a foreign institution, the practical lesson runs both ways. Records concerning other persons, such as transfer details of a suspected trader obtained informally from a contact at a Turkish bank, may themselves be the product of an offence. Using them can expose the investor and its advisers, and they may be challenged as evidence. Records should be obtained through the routes described above.

A working checklist for foreign institutions

1. 1. Map the record holders. List each bank, investment firm, portfolio management company and custodian that holds records about the investor’s Turkish holdings, and identify which are banks subject to Banking Law Art. 73.
2. 2. Ask early and in writing. Request account statements, order records, voice recordings and transfer records for the relevant period under Banking Law Art. 76 and Communiqué III-45.1, and give notice of the potential dispute so that Art. 27(4) preservation applies.
3. 3. Check professional client arrangements. If the investor agreed that statements would not be sent (Communiqué III-45.1 Art. 17(3)), the underlying records still exist and remain subject to the retention rule.
4. 4. Give instructions rather than consents. Where the investor wants a Turkish bank to share its records with third parties, use a written instruction that names the recipients and the purpose (Banking Law Art. 73(3); BDDK Regulation Art. 6(4)).
5. 5. Separate own data from third-party data. Expect redaction of other customers’ details and plan to seek those through the court or the criminal file.
6. 6. Identify individuals in the file. For every record naming individuals, record the KVKK ground and, where data go abroad, the Art. 9 route.
7. 7. Use the standard contract correctly. If transfers will be recurrent, use the Board’s standard contract unchanged and notify it within five business days of signature.
8. 8. Respect investigation secrecy. Treat material from SPK examinations and criminal files as restricted until its status is confirmed (Capital Markets Law Art. 90(2); Code of Criminal Procedure Art. 157).
9. 9. Avoid informal channels. Do not accept bank or customer secrets offered outside a legal route; Criminal Code Art. 239(1) also covers disclosure by persons who obtained the information unlawfully.
10. 10. Keep a log. Record what was requested, from whom, on what basis, what was received and where it was sent, so that the chain of custody can be shown to a court.

Frequently asked questions

Is a foreign fund or sovereign investor protected by Turkish banking secrecy?

Yes. Customer secrets under Banking Law Art. 73(3) cover data of natural and legal persons arising from banking activities after the customer relationship is established. Even the fact that an entity is a bank’s customer is a customer secret (BDDK Regulation Art. 4(3)).

Does KVKK protect a foreign institutional investor?

No. KVKK protects identified or identifiable natural persons (Art. 3(1)(d)). It protects the investor’s employees and other individuals named in records, but not the investor as a legal entity.

Can a Turkish bank share my records with my lawyers abroad if I consent?

A consent under KVKK alone is not enough for customer secrets. The bank needs a request or instruction from the customer, or a statutory exception (Banking Law Art. 73(3); BDDK Regulation Art. 6(3)). If the records include individuals’ personal data, a KVKK Art. 9 route is also required.

Can my bank refuse to give me copies of my own transaction documents?

Banks must give customers, on request, a copy of every document relating to their transactions (Banking Law Art. 76(1)). Information about other parties within those documents may be limited where it is another customer’s secret.

How long must Turkish investment firms keep order and voice records?

Ten years, under Communiqué III-45.1 Art. 27(1) and Commercial Code Art. 82. Records that are the subject of a dispute must be kept until the dispute is concluded (Art. 27(4)).

Can an investment firm refuse to answer SPK because of client confidentiality?

No. Persons asked for information in an SPK inspection may not refuse by relying on confidentiality or secrecy provisions (Capital Markets Law Art. 90(1)). They must also keep the existence and nature of the examination secret (Art. 90(2)).

Will SPK give its examination findings to a civil court in my damages claim?

SPK may use its secret information for its own functions and administrative suits against its decisions, and may give it to prosecutors and criminal courts. The statute does not list civil courts among the recipients (Capital Markets Law Art. 135(2)). Findings often reach civil claimants through the criminal file.

Can a civil court order a bank to produce records about another customer?

A court may order a third party to produce a document it finds necessary to prove an allegation (Code of Civil Procedure Art. 221(1)). The holder may refuse on secrecy grounds unless the owner of the secret permits disclosure (Arts. 221(3) and 249(1)). Whether production is ordered depends on the court’s assessment of necessity in the specific case.

How quickly must institutions respond to a prosecutor’s request for information?

Within ten days. If that is impossible, they must give the reason and the latest response date within the same period (Code of Criminal Procedure Art. 332(1)).

Can personal data be sent abroad on the basis that it is needed for a lawsuit?

Only as an incidental transfer, where no adequacy decision or appropriate safeguard is available and the transfer is necessary for the establishment, exercise or protection of a right (KVKK Art. 9(6)(d)). Regular or continuing transfers need an adequacy decision or a safeguard such as the standard contract.

Must the standard contract be notified to the KVKK Authority?

Yes, within five business days of signature, physically, by registered electronic mail (KEP) or by another method set by the Board (KVKK Art. 9(5); Regulation Art. 14(5)). The text must be used without modification (Regulation Art. 14(3)).

Is disclosure of a customer secret a crime?

It can be under two provisions. Banking Law Art. 159 penalises breaches of the Art. 73 secrecy duties. Criminal Code Art. 239 penalises disclosure of trade, bank or customer secrets to unauthorised persons. The latter requires a complaint, except where disclosure is made to a non-resident foreigner.

What can an individual do if a Turkish broker refuses to say whether their data were passed on?

Apply in writing to the data controller, which must respond within 30 days, and then complain to the KVKK Board within 30 days of the response and at most 60 days from the application (KVKK Arts. 13–14). Rights may be limited where processing is necessary for a criminal investigation or supervisory functions (Art. 28(2)).

Do these rules stop a Turkish bank from defending itself against my claim?

No. A bank that is party to a dispute may share secret information about the parties with courts and arbitral bodies in Turkey or abroad, to the extent necessary for its claim or defence (BDDK Regulation Art. 5(7)).

Can the BDDK prohibit data from leaving Turkey?

Yes. On economic security grounds, the BDDK Board may prohibit sharing customer or bank secrets with third parties abroad and may require banks’ information systems and backups to be kept in Turkey (Banking Law Art. 73(3); Regulation Art. 6(11)).

Related guides

• Turkey’s 2026 Fund and Market Manipulation Crisis: Legal Guide for Foreign Institutional Investors — the entry point to this series
• MSCI’s Turkey Index Freeze and the Legal Response
• Lease Certificates (Sukuk) in Turkey
• Inflation Accounting in Turkey: TMS 29 and the Tax Books
• Individual Application to Turkey’s Constitutional Court and the ECHR
• Privileged Shares in Turkish Listed Companies
• Enforcing a Money Judgment in Turkey
• Turkey’s Emissions Trading System and Climate Law No. 7552
• Anti-Money Laundering Rules for Foreign Investors in Turkey
• Recovering Investor Losses from Insurers in Turkey
• Service of Documents in Turkish Proceedings
• Voting at Turkish General Meetings from Abroad
• Derivatives in Turkey: VİOP, OTC and Leveraged Trading
• SPK Investigations in Turkey: Powers, Secrecy and Reports
• Short Selling, Margin Trading and Securities Lending in Turkey
• Crypto Assets in Turkey under Law No. 7518
• Arbitration of Investor Disputes in Turkey
• State-Controlled Listed Companies in Turkey
• Taxation of Foreign Institutional Investors in Turkey
• Evidence in Turkish Securities Claims: Preservation, Production and the Criminal File
• Joining a Criminal Case in Turkey as a Foreign Investor
• Suing the Capital Markets Board in Turkey
• Claims Against Brokers, Custodians and Portfolio Managers in Turkey
• Investment Services Rules in Turkey: Communiqués III-37.1 and III-39.1
• MKK and Book-Entry Securities in Turkey: Communiqué II-13.1
• International Judicial Cooperation in Criminal Matters: Law No. 6706
• Criminal Code Offences in Turkish Capital Markets Cases
• Sue in Turkey or Abroad: Jurisdiction and Enforcement