Data processor

Scope

The definition has three elements: being a natural or legal person separate from the data controller, relying on the authority given by the data controller, and carrying out the processing on its behalf (Art. 3/1-ğ). A data processor may not disclose to others, contrary to the Law, the personal data it learns, and may not use it outside the purpose of processing; this obligation continues after the end of its duties (Art. 12/4). Where data is processed by another person on its behalf, the data controller is jointly liable with that person for taking security measures (Art. 12/2). Under Article 9, as amended by Law No. 7499, data processors may also transfer data abroad under the conditions in the Law; in a transfer based on the standard contract announced by the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu), the contract is notified to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) within five business days of its signature, and an administrative fine is also provided for a data processor that fails to make this notification (Art. 9/5, 18).

Practical significance

Where services are procured externally, the contract between the parties should expressly regulate the subject and scope of processing, the data controller’s instructions, the security measures to be taken, the use of subcontractors, notification of data breaches, and the return or deletion of data at the end of the contract. If the service provider starts to use the data for its own purposes as well, it may no longer be regarded as a data processor but, for that use, as a data controller, and the obligations in the Law are directed at it.

Commonly confused concepts

The difference between a data processor and a data controller is who makes the decision: the data controller determines the purposes and means, and the data processor acts on its behalf within that framework. A data processor should also not be confused with the concept of “processing of personal data”: processing is an activity describing every kind of operation, from obtaining data to recording, storing and transferring it (Art. 3/1-e), and the data controller also processes data; “data processor,” by contrast, denotes a specific legal position.