What Is Personal Data Protection Law in Turkey? KVKK and Data Protection

Personal data protection law in Turkey governs the processing of personal data, the obligations of those who process it and the rights of data subjects, and is mainly regulated in the Personal Data Protection Law No. 6698 (KVKK). This guide summarizes personal data, the obligations and rights under the KVKK and the related procedures and links to our detailed articles; articles marked "(in Turkish)" are currently available only in Turkish.

KVKK: Personal Data Protection Law

GDPR: General Data Protection Regulation

VERBİS: Data Controllers' Registry Information System

The concept of personal data, which has recently been on the agenda of the legal community, clearly confuses those who are not familiar with the subject.

For this reason, in addition to KVKK compliance work in companies, KVKK training is also organized for employees.

However, the Personal Data Protection Law can only reach its real potential once social awareness of the concept of "personal data" has been established.

The Concept of Personal Data

Personal data means any information relating to an identified or identifiable natural person. If, once information about a person's identity and personality has been collected and recorded, it becomes possible to determine who that person is, then personal data has been collected.

For example: identity information such as a person's first and last name, fingerprints, eye color, bank accounts, sexual preferences, personal e-mail address and telephone number collected and recorded by the institution for which the person works are personal data, and the collection and recording of this data is now subject to special procedures.

Who Is the Data Controller? Who Is the Data Processor? What Are the Differences?

The data controller is the person who determines which personal data will be collected and the purposes and methods of its processing. The data controller takes the decisions on why and how the processing activity will be carried out. For example, it may require fingerprint data to be collected in accordance with the procedure because it wishes to install fingerprint-controlled access systems at various doors.

More generally, the person who determines the collection of personal data and the collection method, the types of personal data to be collected, the purposes for which the collected data will be used, which individuals' personal data will be collected, whether the collected data will be shared and, if so, with whom, and for how long the data will be stored is the data controller.

The data processor is the term used for a natural or legal person who processes personal data in the name of the data controller on the basis of the authority granted by the controller.

The data controller may, however, authorize the data processor by means of a contract on the processing of personal data, covering which information technology systems or other methods will be used to collect personal data, the method by which personal data will be stored, the details of the security measures to be taken to protect personal data, the method by which personal data will be transferred, the method to be used for the correct application of the storage periods, and the determination of the methods for the deletion, destruction and anonymization of personal data.

Processing of Personal Data

The processing of personal data is the obtaining, recording, storage, modification, transfer, taking over, classification or use of all or part of the data by automatic or non-automatic means.

The processing of personal data is not entirely unlawful; it is merely subject to certain procedures. Companies that have completed their compliance work may process personal data in accordance with these procedures.

Obligations of the Data Controller

The data controller must process personal data in accordance with the following obligations:

• to conduct a data processing process in accordance with the law and the rule of good faith,
• to conduct an accurate and up-to-date data processing operation,
• to process the data for specific and concrete purposes,
• to process the data in a manner connected to the specific purpose for which it is processed, within the limits drawn by that purpose and proportionately,
• to take measures appropriate to the nature of special categories of personal data,
• where there is no requirement of explicit consent for a transfer abroad and the country to which the transfer will be made is on the list of countries that do not provide adequate protection, to obtain a written undertaking from the persons concerned that adequate protection will be provided and to obtain the authorization of the Board (Personal Data Protection Board),
• to have provided the data subject with the required information,
• to have established and implemented the internal mechanisms necessary for data subjects to exercise their rights,
• to have prevented the unlawful processing of personal data within its own organization and unlawful access to such data from inside or outside,
• to have taken the necessary technical and administrative measures to ensure the safekeeping of personal data and to have provided the necessary in-house training,
• not to disclose personal data it has learned to others contrary to the relevant legislation and not to use it for purposes other than the purpose of processing,
• to notify the person concerned and the Board within the shortest time where processed personal data is obtained by others through unlawful means,
• to send the information and documents requested by the Board in relation to its investigation, except for information and documents that are state secrets, within fifteen days and, where necessary, to allow an on-site inspection,
• to process the data for a period appropriate to the legislation or to the purpose determined,
• except in the exceptional cases listed in the law, to process personal data by obtaining the explicit consent of the data subject,
• to delete, destroy or anonymize personal data ex officio or upon the request of the person concerned once the reasons requiring their processing have ceased to exist.

The rule for the processing of personal data is that the data subject gives explicit consent to the processing of their personal data. However, in the following exceptional cases listed in the law, personal data may be processed without the explicit consent of the data subject:

• the cases expressly listed in the law, for example the taking of a suspect's fingerprints by law enforcement,
• the case of factual impossibility, for example the examination of personal health data to identify the blood group of an unconscious victim who has been attacked and is losing blood,
• the case where the personal data has been made public by the data subject,
• the case where it is necessary for the exercise of a legitimate right,
• the case where it is necessary for the data controller to fulfill a legal obligation,
• the case where, provided that the fundamental rights and freedoms of the data subject are not harmed, there is a necessity for the data controller that can be regarded as legitimate with respect to the processing of the person's personal data,
• the processing of personal data that we define as special categories of personal data without explicit consent is prohibited. Special categories of personal data other than health and sexual life may be processed, as with other personal data, in the cases provided for in the laws and listed above, without seeking the explicit consent of the person concerned,
• special categories of personal data relating to health and sexual life may be processed without seeking the explicit consent of the person concerned only for the purposes of the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services and the planning and management of health services and their financing, by persons who are under an obligation of confidentiality or by authorized institutions and organizations.

Special Categories of Personal Data

Data concerning a person's race, ethnic origin, political opinion, philosophical belief, religion, religious order or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data, are special categories of personal data. As stated above, the processing of data relating to health and sexual life among special categories of personal data requires particular attention. They may be processed without the explicit consent of the person concerned only for the purposes of the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services and the planning and management of health services and their financing, and only by persons who are under an obligation of confidentiality or by authorized institutions and organizations.

Rights of the Data Subject

Under Article 11 of our Personal Data Protection Law No. 6698:

everyone may apply to the data controller and, in relation to themselves,

• a) learn whether their personal data has been processed,
• b) request information if their personal data has been processed,
• c) learn the purpose of the processing and whether the data is used in accordance with that purpose,
• ç) know the third parties to whom personal data is transferred within the country or abroad,
• d) request the correction of personal data that has been processed incompletely or incorrectly,
• e) request the deletion or destruction of personal data within the framework of the conditions set out in Article 7 (where the reasons requiring processing have ceased to exist although the data was processed in accordance with the law),
• f) request that the transactions carried out under subparagraphs (d) and (e) above (the correction, deletion or destruction of incorrect personal data) be notified to the third parties to whom the personal data has been transferred,
• g) object to a result arising against them through the analysis of the data processed exclusively by automated systems,
• ğ) claim compensation for damage where they have suffered damage as a result of the processing of personal data contrary to the law,

and has these rights.

Application and Complaint Route of the Data Subject

A data subject who notices that their personal data has been violated must first apply to the data controller for the violation to be remedied. The application to the data controller is mandatory before complaining to the Board, and a complaint to the Personal Data Protection Board without exhausting this route would be contrary to the procedure. The data controller must conclude the applications of the persons concerned within 30 (thirty) days free of charge; if the transaction concerned has a certain cost, the tariff fees determined by the Board are taken into account, and this fee is returned to the person concerned where the violation that is the subject of the application arises from the fault of the data controller.

If no decision is taken within 30 days, a complaint can be made to the Board as if a refusal decision had been given. If an acceptance decision is taken, the data controller itself remedies the violation.

If the data controller rejects the application made to it or does not give an acceptance or refusal response within the 30-day response period, the application route is deemed to have been exhausted in accordance with the procedure and the data subject may then use the complaint route by means of a petition prepared in accordance with the procedure and addressed to the Personal Data Protection Board.

The Board, to which the complaint petition has been submitted, decides on the complaint within 60 (sixty) days; if it does not decide, the judicial remedy stage may be reached, on the assumption that it has given a refusal decision.

How Is the KVKK Compliance Process Managed?

The compliance process generally covers the following work, according to the needs of the data controller:

• management of the compliance process,
• inventory records,
• entry of the required information into VERBİS,
• provision of in-house training,
• informing employees by giving presentations on the subject.

A person whose personal data has been processed contrary to the law may apply to the data controller, complain to the Personal Data Protection Board and take legal action.

In Which Other Cases Does Personal Data Matter?

The recording of a person's voice or image without their knowledge is assessed separately both in terms of whether it constitutes an offense and in terms of whether it can be used as evidence in a case. Compensation for damage arising from the unlawful processing of personal data can also be claimed.

• Is Recording Someone without Permission an Offense? Recording Conversations and Violation of the Privacy of Private Life and of Communications (Articles 132, 133 and 134 of the TCK) (in Turkish)
• Assessment of Secret Video, Photograph and Audio Recordings as Evidence in Divorce Cases (in Turkish)
• What Are Compensation Claims in Turkey? Damages and Cases

Is There a Separate Title of Data Protection Lawyer?

No. Data protection lawyer or personal data lawyer are the names used for an attorney who handles compliance, applications, complaints and cases concerning personal data protection; they are not a separate title.

Any attorney registered with a bar association has authority to represent clients in the compliance process of the data controller, in the application of the data subject to the data controller, in complaints to the Personal Data Protection Board and in the cases arising from these; Article 35 of the Attorneyship Law No. 1136 does not divide this authority by area of law. A search for a "data protection lawyer in Ankara" also does not point to a title but to attorneys who handle this work in Ankara.

Under Article 19 of the Personal Data Protection Law No. 6698, the Personal Data Protection Authority is headquartered in Ankara; however, it is not mandatory to retain an attorney to apply to the data controller or to complain to the Board.

Sample Decision

Summary of the Decision of the Personal Data Protection Board dated 28/05/2020 and numbered 2020/429 on "the complaint concerning the unlawful processing and disclosure of the personal data of the data subject by the attorney conducting enforcement proceedings against them"

Following the sending of information about the data subject's debt to a bank by SMS by the attorney conducting the enforcement proceedings to the data subject's colleagues, who were staying at the same public social facility, and to the data subject's older brother, the data subject applied to the law office concerned but received no response, and the complaint was examined; as a result, it was decided:

1. to reject the procedural objections of the data controller as unfounded,
2. that the obtaining by the data controller, an attorney, of the telephone numbers of the data subject's older brother and colleagues on the basis of assumptions and in a manner that could not be fully proved, and the subsequent sharing of the debt information, that is, the personal data, of the data subject with those numbers, as well as the querying of the data subject's GSM subscriptions and debts by using their Turkish identity number, constituted a breach of the provisions of the Law, and that the data controller had thus failed to fulfill its obligation to prevent the unlawful processing of personal data and unlawful access to personal data and had acted contrary to the general principles, and that, since the data processing activity carried out by the data controller constituted a breach of paragraph (1) of Article 12 of the Law, an administrative fine of TRY 125,000 be imposed under subparagraph (b) of paragraph (1) of Article 18 of the Law,
3. that, given the incorrect findings and assessments concerning the Law No. 6698 and its practice contained in the defense of the data controller, the attorney, the data controller be instructed to exercise the utmost care and diligence in complying with the Law.

This article is for general information only and does not constitute legal advice.