One of the most widespread received ideas in the publishing world runs like this: “Journalism is exempt from the KVKK.” That sentence has two separate problems. First, in the full text of Personal Data Protection Law No. 6698 (“KVKK”) the words “journalism” and “press” do not appear at all. Second, the exemption being relied on is not unconditional: it is tied to eight separate limits and covers only a particular kind of processing. This article opens up Article 28 as it is worded, separates the two different layers of exemption from one another, and tabulates which activity of a news organisation falls into which layer.
The Law does not say “journalism” — so how is the exemption constructed?
Neither “journalism” nor “press” nor “media” appears in the text of Law No. 6698 as the heading of an exemption. The provision news organisations rely on is subparagraph 28(1)(c), and it is worded like this: “... processing for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression.”
In other words, journalistic activity comes under this subparagraph not as a separate professional exemption but under the heading of “processing within the scope of freedom of expression”. This is not a technical detail; it has a direct practical consequence: the scope of the exemption is determined not by your profession but by whether that specific act of processing remains within the scope of freedom of expression. Holding a press card, having “publishing” written in the company's trade registry entry, or having declared your site as a periodical does not on its own bring any processing within the exemption.
Article 28 constructs two separate layers of exemption
The most frequent mistake in practice is to confuse these two layers. In the same article the Law sets out two completely different regimes: the first paragraph switches off the whole of the Law, while the second paragraph suspends only three articles.
Layer 1 — Article 28(1): FULL exemption
The wording: “ARTICLE 28- (1) The provisions of this Law shall not apply in the following cases:” The subparagraphs are:
- a) Processing of personal data by natural persons within the scope of activities relating entirely to themselves or to family members living in the same dwelling, provided that the data are not given to third parties and that the obligations relating to data security are complied with.
- b) Processing of personal data for purposes such as research, planning and statistics through anonymisation with official statistics.
- c) Processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute an offence.
- ç) Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations assigned duties and powers by law to ensure national defence, national security, public safety, public order or economic security.
- d) Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.
The subparagraph that concerns a news organisation is (c). Where its conditions are met, no provision of the Law applies: Article 4 general principles, Articles 5-6 processing conditions, Article 10 duty to inform, Article 11 rights of the data subject, Article 12 data security, Articles 13-15 application and complaint, Article 16 VERBİS, Article 18 administrative fines — all of them are switched off.
Layer 2 — Article 28(2): PARTIAL exemption
The wording of the second paragraph is entirely different: “(2) Provided that it is in line with the purpose and the fundamental principles of this Law and is proportionate, Article 10, which regulates the data controller's obligation to inform, Article 11, which regulates the rights of the data subject, except for the right to claim compensation for damage, and Article 16, which regulates the obligation to register with the Data Controllers' Registry, shall not apply in the following cases:”
- a) Where the personal data processing is necessary for the prevention of the commission of an offence or for a criminal investigation.
- b) The processing of personal data made public by the data subject themselves.
- c) Where the personal data processing is necessary, on the basis of the authority conferred by law, for the performance of supervisory or regulatory duties and for disciplinary investigations or prosecutions by public institutions and organisations and by professional bodies having the status of a public institution.
- ç) Where the personal data processing is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters.
| Layer 1 — Art. 28(1) | Layer 2 — Art. 28(2) | |
|---|---|---|
| Wording | “The provisions of this Law shall not apply” | “Articles 10, 11 and 16 shall not apply” |
| Scope | THE WHOLE Law switched off | Only three articles suspended |
| Journalism / freedom of expression | IN THIS LAYER (subparagraph c) | Not in this layer |
| Art. 4 general principles | Does not apply | Applies |
| Arts. 5-6 processing conditions | Does not apply | Applies |
| Art. 7 erasure / destruction | Does not apply | Applies |
| Art. 10 duty to inform | Does not apply | Does not apply |
| Art. 11 rights | Does not apply | Does not apply — except the right to compensation, subparagraph (ğ) |
| Art. 12 data security and breach notification | Does not apply | Applies |
| Arts. 13-15 application, complaint, examination | Does not apply | Applies |
| Art. 16 VERBİS | Does not apply | Does not apply |
| Arts. 17-18 offences and misdemeanours | Does not apply | Applies |
| Overriding condition | Compliance with the subparagraph's eight limits | Conformity with the purpose and fundamental principles of the Law, and proportionality |
The full exemption is not unconditional: eight limits
Subparagraph 28(1)(c) ties the exemption to eight separate “does not violate / does not constitute” limits. They are not alternatives but cumulative: if even one of them is breached the exemption falls away and the Law applies in full.
- 1) Does not violate national defence
- 2) Does not violate national security
- 3) Does not violate public safety
- 4) Does not violate public order
- 5) Does not violate economic security
- 6) Does not violate the privacy of private life
- 7) Does not violate personal rights
- 8) Does not constitute an offence
For a news website, the threshold at which the exemption is most often lost is the sixth and the seventh limit: the privacy of private life and personal rights. A news item that violates personal rights simultaneously loses the KVKK exemption and gives rise to liability in damages under the general provisions by virtue of Article 14(3) — because Article 14(3) expressly states that “The right of those whose personal rights are violated to claim compensation under the general provisions is reserved.”
The exemption attaches to purpose and limits, not to an activity
Read the construction of the subparagraph carefully: what is protected is not a profession but a processing purpose. “Processing for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression” — the subject of the sentence is the processing of personal data, and what qualifies it is the purpose of that processing.
The direct consequence is this: the same legal entity carries out, on the same day, both processing that falls within the exemption and processing that does not. Publishing a source's name in a news report is processing within the scope of freedom of expression; the same newspaper keeping the HR file of its reporter is not. Both are processing by the same company, but their legal regimes are completely different.
The non-publishing data processing of a news organisation — human resources, subscriber management, email newsletters, reader comments, advertising and analytics, e-commerce sales, event registrations — is in no way within the scope of Article 28(1)(c). The whole of the Law applies to that processing. Indeed the debate about VERBİS registration for a news website arises from exactly this distinction.
Decision table: which activity is in which layer?
| Activity | Layer | Provisions that apply |
|---|---|---|
| Use of a name, title or statement in news copy | Art. 28(1)(c) — FULL | The Law does not apply as long as the eight limits are observed |
| Use of photographs and footage in a news item | Art. 28(1)(c) — FULL | The same; if the limit is crossed, the whole Law plus compensation under Art. 14(3) |
| Taking into a news item a post the person made public themselves | Art. 5(2)(d) + Art. 28(2)(b) — PARTIAL | Arts. 10, 11 (except ğ) and 16 do not apply; Arts. 4, 5, 7, 12, 13-15, 17-18 apply |
| Membership and subscription records | No exemption | The whole Law |
| Email newsletter list | No exemption | The whole of Law 6698 plus the prior-consent regime of Law 6563 |
| Reader comments, IP and session logs | No exemption | The whole Law |
| Reporter and employee HR data | No exemption | The whole Law plus the employment subparagraph, Art. 6(3)(f) |
| Advertising, analytics, measurement | No exemption | The whole Law |
| Request to erase an archived news item | Art. 28(1)(c), if the exemption holds | If it does not hold, Art. 7 and Art. 11(1)(e) come into play |
The last row is particularly important: the request of a person asking for an archived news item about themselves to be taken down is dealt with on KVKK ground only if one of the eight limits of the exemption has been breached. We covered how such a request is assessed in the article on the right to be forgotten, and the procedure to follow when a takedown request arrives in what to do when a content removal request arrives.
Data made public: the partial exemption that is most useful in practice
For news organisations Article 28(2)(b) frequently comes into play: “The processing of personal data made public by the data subject themselves.” This subparagraph suspends only Article 10, Article 11 (except ğ) and Article 16. In the same situation Article 5(2)(d) also comes into play and removes the need for explicit consent.
But making data public has its limits. For special categories of personal data, Article 6(3)(ç), in the form introduced by Law No. 7499, ties processing to the condition that it “relates to personal data made public by the data subject and is in accordance with the intention behind making it public”. A person sharing an illness in a support group does not thereby intend that data to be carried into a headline. For concrete scenarios see the article on the use of personal data in news reporting.
What happens if the exemption falls away?
The moment one of the eight limits is breached, the exemption disappears retroactively and that processing is assessed as if there had never been an exemption. This has three concrete consequences: (i) the processing must have a legal ground in Article 5 or Article 6, otherwise it is unlawful; (ii) the data subject can exercise the rights in Article 11 and the application route in Article 13, and if no reply is given in time may complain to the Board under Article 14; (iii) the administrative fines in Article 18, and — through the reference in Article 17 — Articles 135-140 of the Turkish Penal Code No. 5237 (“TCK”), may come onto the agenda.
For that reason, use the exemption not as a shield but as an assessment test. The flow below can be used as a rapid pre-publication check.
ARTICLE 28 DECISION FLOW — PRE-PUBLICATION CHECK
STEP 1 — Is this a publishing activity?
NO (HR, subscribers, newsletter, comments, ads, analytics)
-> NO exemption. The whole Law applies. STOP.
YES -> Step 2
STEP 2 — Is the processing within the scope of freedom of expression?
(Is there a purpose of informing the public on a matter of public concern?)
NO -> NO exemption. STOP.
YES -> Step 3
STEP 3 — THE EIGHT-LIMIT TEST (all must be NO)
[ ] Does it violate national defence? .... no / YES
[ ] Does it violate national security? .... no / YES
[ ] Does it violate public safety? .... no / YES
[ ] Does it violate public order? .... no / YES
[ ] Does it violate economic security? .... no / YES
[ ] Does it violate the privacy of private life? no / YES
[ ] Does it violate personal rights? .... no / YES
[ ] Does it constitute an offence? .... no / YES
A single YES -> THE EXEMPTION FALLS AWAY.
-> look for a legal ground in Art. 5 / Art. 6
-> if there is none, do not publish, or remove the data
-> the risk of compensation under Art. 14(3) is assessed separately
All no -> the FULL EXEMPTION in Art. 28(1)(c) applies
NOTE: This test is for Law 6698 only.
Obligations under Law 5187, Law 5651 and the TCK apply separately.Three common mistakes
- Treating the organisation as exempt as a whole. The exemption looks at individual processing activities, not at the organisation. The publishing exemption does not cover your subscriber database.
- Confusing the two layers. Saying “I fall under Article 28” is not enough; you have to say whether you fall under the first paragraph or the second. The consequences are diametrically opposed.
- Taking the exemption to be an exemption from other laws as well. Article 28(1)(c) switches off only Law No. 6698. Obligations under Press Law No. 5187, Internet Law No. 5651 and the TCK continue unchanged.
Do not forget that third point in particular: Article 21 of Press Law No. 5187 separately prohibits the disclosure of identity in certain cases, and that prohibition is independent of the KVKK exemption. Track your organisation's complete set of obligations through the legal compliance checklist for internet news sites. And prepare the privacy notice required for the reader data collected on your site as a separate document — the publishing exemption is no substitute for it.