Personal Data Protection and KVKK: Questions and Answers

When personal data are collected, the data controller must give clear information about its identity, the purpose of processing, the legal basis, the recipients of transfers, and the rights of the data subject.

Under Article 10 of Law No. 6698, the duty to inform is an obligation separate from the legal basis for the personal data processing activity. Explicit consent is not the mandatory basis for every processing activity; if the other processing conditions in the law are met, they can be used. Publishing a privacy notice on a website alone does not, by itself, prove that proper information was provided at the specific moment of data processing. For activities such as employees, clients, visitors, job applications, and cookies, the purposes of processing must be specific and consistent. In processing that involves special categories of personal data or transfers of data abroad in particular, the special conditions and the necessary safeguards must be examined separately.

The data subject can exercise the rights of information, correction, erasure, and the other rights under Article 11 of the KVKK by applying to the data controller; this route must be exhausted before a complaint to the Personal Data Protection Board (the Board).

Under Article 13 of the KVKK, the data controller concludes the application within 30 days at the latest. If the response is rejected or inadequate, a complaint to the Board can be made within 30 days of learning of the response; the 60-day upper limit in the law and the special possibilities in the Board’s Decision No. 2019/9 on calculating time limits must also be taken into account. If the data controller gives no response at all, the 60-day period from the application is important. The request should explain which data, which processing, or which incorrect record is in dispute. Claims for damages and personality rights, for which direct recourse to the court is available, and an administrative complaint to the Board are not the same route.

When a data breach is suspected, the scope of the incident is first determined, technical security measures are taken, and the notification obligation under the KVKK is promptly assessed.

Article 12(5) of the KVKK and the Personal Data Protection Board’s Decision No. 2019/10 adopt the principle that, where third parties obtain data by unlawful means, notification to the Board must be made without delay and within 72 hours at the latest after learning of it. The affected persons are also informed in an appropriate manner. It should be documented which data were affected, how the attack took place, the time of detection, the access logs, the measures taken, and whether the breach is continuing. Concealing the incident or deleting records without thought makes both the technical investigation and the defense more difficult. Not every security incident may constitute a data breach in the same scope; a specific legal characterization must be made.

No; if the conditions for processing have ceased to exist, deletion, destruction, or anonymization comes into question.

Under Article 7 of the KVKK and the relevant regulation, retention obligations, proof of a legal dispute, and the grounds for processing personal data are examined separately. The data controller must give a reasoned response and state the available routes of application.

No; there are limits of legitimate purpose, information, necessity, and proportionality.

The workplace email policy, the prior notice given to the employee, the scope of monitoring, and less intrusive alternatives are assessed. The confidentiality of communications and the protection of personal data must be considered together.

As a rule, an application to the data controller is required first.

The thirty-day and sixty-day complaint periods in Article 14 of the KVKK, which run from the data controller’s response or failure to respond, are calculated separately. The documents showing that the application was sent and served should be kept.