Legal Glossary

A data controller is a natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. It is defined in Article 3/1-ı of Law No. 6698 on the Protection of Personal Data. The core obligations in the Law, such as informing data subjects, data security, responding to data subject applications and, where required, registering with the Data Controllers’ Registry (Veri Sorumluları Sicili), as a rule fall on the data controller.

A data processor is a natural or legal person who processes personal data on behalf of the data controller and on the basis of the authority given by the data controller. It is defined in Article 3/1-ğ of Law No. 6698 on the Protection of Personal Data. External service providers offering payroll, accounting, cloud hosting or call center services are in this position in many cases. The data processor does not itself determine the purposes and means of processing; the Law holds the data controller jointly responsible with the data processor for security measures.