Practical Guide: Data protection compliance in Turkey

Introduction

Turkey’s Personal Data Protection Law (KVKK) is the first law in Turkey that regulates personal data protection and outlines the legal obligations that entities and individuals dealing with personal data must comply with. No. 6698 or Kişisel Verileri Koruma Kanunu (KVKK) came into force on 7 April 2016, weeks before the EU passed its General Data Protection Regulation (GDPR). There are notable differences between the KVKK and GDPR, not only because the Turkish data protection law is based on the GDPR’s predecessor (the KVKK was meant to bring Turkish legislation in line with the EU’s Directive 95/46/EC, which at the time governed data protection in the EU) but also because the data protection law of Turkey comes with its own set of unique requirements.

FAQ's

General

Personal data processing refers to a set of operations performed on personal data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transferring, taking over, making retrievable, classification, or preventing their use, fully or partially through automated or non-automatic means only for the process that is a part of any data registry system established by the Law.

Special categories of personal data is defined as data relating to:

race;
ethnic origin;
political beliefs;
philosophical beliefs;
religion, denomination, or other faiths;
clothing and attire;
membership of an association, charity or union;
health;
sexual life;
criminal convictions and security measures; and
biometric and genetic data.

The common characteristic of these data groups is the risk of discrimination, which is seen as a high-risk factor.

The Turkish Data Protection Law does not require the appointment of a data protection officer. However, data controllers domiciled outside Turkey need to appoint a data controller representative in Turkey to establish an account within the Registry. The representative can be either a legal entity located in Turkey or a Turkish individual. The appointment of the representative must be made with a resolution of the data controller, which needs to be notarised and apostilled.

Personal data may only be processed in compliance with the procedures and principles set forth in laws. Furthermore, the following principles shall be complied within:

a) Lawfulness and conformity with rules of bona fides

b) Accuracy and being up to date, where necessary

c) Being processed for specific, explicit and legitimate purposes

d) Being relevant with, limited to and proportionate to the purposes for which they are processed.

e) Being retained for the period of time stipulated by relevant legislation or the purpose for which they are processed.

The Data Protection Law does not distinguish between the personal data of adults and minors. However, a set of guidelines was published regarding what shall be considered in order to protect children's data. These guidelines are for awareness-raising purposes and they do not regulate any legal requirement regarding the processing of children's data yet. It can be expected that provisions based on these guidelines will be introduced into legislation in the future.

Definitions

After all of the appointments were made, the Board began operating in January 2017.

The Board is required to carry out and apply the duties and functions assigned by the Data Protection Law and other legislation independently and under its responsibility. Furthermore, no organ, authority, office, or person has the jurisdiction to make orders or instructions to the Board on topics that fall within the scope of its duties and functions.

The Board's functions and obligations are mostly governed by Article 22 of the Data Protection Law, but some are also covered by other provisions.

A representative of the data controller is the person who represents the foreign data controller in Turkey. This person can either be a legal person incorporated in Turkey or a natural person. If a natural person has been appointed as a data controller representative, this person must have Turkish citizenship (Article 4, letter p and Article 11, paragraphs 2 and 3 of the regulation on the data protection register).

The 8 steps to data protection compliance in Turkey

1. Informing data Subjects

2.a. Obtaining explicit consent from data subjects for processing personal data

2.b. Obtaining explicit consent from data subjects for processing special personal data

2.c. Obtaining explicit consent from data subjects for data transfers to third parties and abroad

If applicable: International data transfer applications to the Data Protection Authority

3. Appointment of data controller representative and VERBIS Registration

4. Guaranteeing data security with policy and procedure

If applicable: Data breach notification and appropriate response

5. Creation and adherence to data retention and erasure policies

6. Contracts with third-party data processors

7. Training and awareness for employees

8. Conducting regular compliance and security audits

our services

Data Controller Representation Service

Applications for international data transfers

Registration with Verbis

Data breach crisis management

Creation of information and explicit consent texts

Creation of data security, retention, erasure and privacy policies

Compliance audits

Contracts with third party data processors & employees

How to compliantly transfer data abroad from Turkey

Penalties and enforcement decisions for breaches of Data Protection Law in Turkey

The rights of data subjects

The legal bases for compliant data processing

Key points on explicit consent for data protection compliance

1. Informing data subjects

Regardless of the legal basis of data processing, data controllers are obliged to inform the data subjects when collecting personal data in respect of the minimum mandatory content outlined below (Article 10 of the Data Protection Law):

the identity of the data controller and its representative (the latter when necessary);
the purpose of personal data processing;
the recipients to whom the personal data is transferred, that it will be transferred abroad and where, and the purpose of the transfer;
the methods and legal reasons of collection of personal data; and
the data subject's rights under Article 11 of the Data Protection Law.

This is usually done in the form of a privacy policy on webpages or delivered through digital communication or physical paper as well as other various notices prior to the data processing being carried out.

2. Obtaining express (explicit) consent from data subjects

In general, all kind of processing including transfers of personal data without the explicit consent of the data subject is only allowed under following exceptions:

it is clearly provided for by the laws;
it is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid;
processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the conclusion or fulfillment of that contract;
it is mandatory for the controller to be able to perform his legal obligations;
the data concerned is made available to the public by the data subject himself;
data processing is mandatory for the establishment, exercise or protection of any right; or
it is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

In terms of exceptions to the consent requirement, the Data Protection Law divides special personal data into two different sub-categories:

personal data related to health or sexual life; and
other special categories of personal data.

While other types of special categories of personal data can be processed if such processing is permitted by the laws, without express consent personal data related to health or sexual life can only be processed by authorised persons, institutions and establishments under the obligation of confidentiality (e.g. doctos, hospitals, nurses) for the purposes of:

protection of public health;
preventive medicine;
medical diagnosis;
provision of health care services and treatment; and
planning and management of health care services and their financing.

Personal data cannot be transferred to third parties nationally or transferred abroad without the explicit consent of the data subject.

Personal data may be transferred abroad without explicit consent of the data subject provided that one of the exceptions outlined in a. exists in combination with;

(a) sufficient protection is provided in the foreign country where the data is to be transferred (the authorities determine and announce the countries where a sufficient level of protection is provided) or,

(b) the controllers in Turkey and in the related foreign country guarantee sufficient protection in writing and the authorities have authorized such transfer.

In cases where the interest of Turkey or the data subject will seriously be harmed, personal data, without prejudice to the provisions of international agreements, may only be transferred abroad upon the permission to be given by the authorities after receiving the opinions of related public institutions and organizations.

The regulatory authority has not yet drawn up a list of safe countries.

If a transfer of sensitive personal data is to take place the data subject has to give his explicit consent for the transfer of special personal data. The exceptions in b. apply.

If applicable: Application to the data protection authority for international data transfers

The application for data transfer abroad is currently somewhat problematic. All of the applications are currently being examined on a case-by-case basis.

3. Appointment of data controller representative and VERBIS Registration

The biggest difference between the KVKK and the GDPR is the obligation data controllers face under the KVKK to register at VERBIS, the TDPA’s Data Controllers Registry Information System. VERBIS registration is free and mandatory for all data controllers before they begin processing the data of Turkish residents. Once registered, data controllers are expected to record the data processing activities they engage in.

Due to the complex nature of the VERBIS registration process, the deadline for it has been pushed back twice already, with the TDPA finally extending it to 31 December 2021 for all controllers.

There are several exemptions to VERBIS registration, however these do not apply to data controllers domiciled outside of Turkey.

Data controllers who have less than 50 employees and an annual balance sheet below TL 25 million (approximately $3.5 million), as long as their main activity does not require the processing of special categories of data;
Data controllers who process data only by non-electronic means;
Custom brokers and mediators;
Public notaries, certified public accountants, and lawyers;
Associations, foundations, and syndicates;
Political parties.

To register with VERBIS and start the processing of personal data, data processors domiciled outside of Turkey need to first appoint a data controller representative who must be a Turkish legal entity or a Turkish natural person (the appointment of the representative must be made with a resolution of the data controller, which needs to be notarised and apostilled).

These persons have to appoint a person in Turkey as a data controller representative, and through this person they have to be entered in the data protection register as a data controller.

Foreign domiciled companies can also have a branch (Şube) or a liaison office in Turkey. The decision of the supervisory authority on data protection of 23/07/2019 deals with whether the branch or the liaison office itself must then be registered as a DC. (see b.)

The decision (see a.) evaluated the regulations on branches and came to the conclusion that the branches do not have legal personality, but are entered in the commercial register in Turkey like other companies, and therefore the branches themselves are to be entered in the data protection register as data controllers. This also corresponds to the regulation in Article 4 of the EU Directive and the regulations of the Turkish Data Protection Act.

It should also be noted, however, that in addition to the obligation to register the branch office, there could also be an obligation for the main company located abroad if the main server on which personal data (including those of the branch staff) is stored is outside of Turkey. In such cases, an application for permission to transfer data abroad could also have to be submitted.

A liaison office is not responsible as a data controller and does not need to be entered in the data protection register as a data controller. However, at least the data of the employees is recorded in this case. Thus, the supervisory authority states that the main company, even if it is located abroad, is responsible as the data controller in Turkey and has to enter itself in the data protection register.

i. The main company of a liaison office is registered in Turkey as a data controller.

ii. The data controller has to appoint a representative in Turkey. The method of appointment is set out in the relevant regulation.

iii. The representative of the data controller is then the contact person of the supervisory authority for data protection.

During registration, data controllers will also be required to submit a Data Processing Inventory that identifies the categories of data subjects, the types of data they process, its purpose, their legal basis, and the technical and administrative measures that an organization is taking to comply with the KVKK.

The data processing inventory for all data processed in Turkey must include at least the following information:

identifying information (including the address of the data controller or its representative);
data categories;
purpose of the data processing;
data subject groups;
recipient or recipient groups to which the data may be transferred;
information on whether the relevant data category is transferred abroad;
data security measures taken; and
the maximum time period for processing personal data.

4. Guaranteeing data security with policy and procedure

According to Article 12 of the Data Protection Law, data controllers are obliged to:

prevent unlawful processing of personal data;
prevent unlawful access to personal data; and
ensure the retention of personal data.

The controller shall take all necessary technical and organisational measures for providing an appropriate level of security in order to fulfil these obligations.

The data controllers must take all necessary technical and organisational measures to provide appropriate data security. The Personal Data Security Guide regarding technical and administrative measures published by the Board in January 2018 and the guideline for technical and administrative measures to be taken by the public authorities and key infrastructure organisations published by the Digital Transformation Office in July 2020 can be taken as references while complying with the obligation on data security measures.

Example: Board Decision dated 9 October 2020 and numbered 2020/787 shows how the Board handles specific aspects of security breaches. This decision is based on the data breach notification filed by the relevant data processor in the health sector within the statutory notification period. The Board decided that the data breach was caused by a common-used program, not by the data controller's lack of precaution, and that the data controller could not intervene in this case. The data controller has noticed the violation in a short time and took all necessary technical and administrative measures promptly and in line with the Data Protection Law. Therefore, the Board does not impose any sanctions on the data controller (only available in Turkish here).

In addition to these sources, the Board's decision numbered 2018/10 must be taken into account with regards to the processing of special categories of personal data. The Board declared with this decision that data controllers must prepare a separate policy and procedure for protecting special categories of personal data and emphasised the importance of implementing measures which had previously been determined in the Personal Data Security Guide. As a result, data controllers must ensure that adequate safeguards are in place when processing special categories of personal data.

If a natural or legal person processes personal data on behalf of the controller, the controller and these individuals are jointly responsible for implementing the appropriate precautions. As a result, data processors must likewise take steps to maintain data security. As a result, if the data controller's company's records are stored by an accounting firm (data processor), the controller and the accounting firm are jointly responsible for implementing the data processing measures outlined in the first paragraph.

If applicable: Data breach notification and appropriate response

If the processed data is collected by third parties via unlawful methods, data controllers must notify the data subject and the Board as soon as possible. The Board may, if required, publicize the breach on its official website or by other means it deems appropriate.

The KVKK has published the Board decision numbered 2019/10 dated 24 January 2019 and numbered 2019/10 regarding the notification procedures and principles related to personal data breach. According to this decision:

data controller shall notify the Board without delay and within 72 hours at the latest from the date he/she learns of such breach. After identifying the persons affected by the data breach, the data controller shall promptly notify the related persons by appropriate methods;
in the event that data controller cannot notify the Board within 72 hours for good cause he/she should explain the reasons which caused the delay to the Board with the notification to be made; and
data controllers are obliged to use the document attached to such decision (only available in Turkish here).

In its decision numbered 2019/271 the Board determined the minimum content requirements of a data breach notification to data subjects (only available in Turkish here). The Board stated that data breach notifications to data subjects must be in clear, plain language, and must include at least:

the time and date of breach;
categories of data (personal data, special categories of personal data) affected by the breach);
possible consequences of the breach;
measures that have since been taken, or will be taken by the data controller to address the breach and mitigate its consequences; and
the name and contact details of the contact person(s) from whom data subjects may obtain more information about the breach, or some other means of communication, such as the data controller's website, call center, etc.

5. Creation and adherence to data retention and erasure policies

As required by the principle of purpose limitation, personal data must only be kept for the reason for which it is processed. Data controllers shall comply with the periods foreseen in the legislation for the relevant personal data.

The data controller is required to take the following administrative and technical measures in this regard:

establishing personal data retention and erasure policies and principles;
determining storage periods as well as technical and administrative measures to be used in storage;
and ensuring that personal data is stored in accordance with these principles.

The details of the erasure, destruction, and anonymization process is governed by the DDA Regulation. In addition, a Guide on Erasure, Destruction, or Anonymisation of Personal Data has been prepared by the Board (only available in Turkish here), in order to clarify the implementation to this respect. It should also be mentioned that data controllers which are required to be registered with the Registry must draft a data storage and extermination policy. The mandatory content of the policy has been envisaged under the aforementioned regulation. Data controllers are obliged to publish their policy/procedures related to data retention and extermination.

6. Contracts with third-party data processors

The Data Protection Law does not introduce the idea of data processor agreements. However, when a third-party data processor is involved in data processing, the data controllers and data processors will share responsibility for data security (Article 12 of the Data Protection Law). To guarantee that third party data processors comply with data protection regulations, data controllers must sign data processing agreements.

Furthermore, to ensure the proper flow of personal data processing, the data controller and the data processor should contractually regulate the authorization granted to the data processors, as well as the limits of the authorization, the technical details of the processing activity, and the principles and rules that must be followed by the data processors.

7. Training and awareness for employees

To further reduce risks stemming from employee actions, key employees should be trained in data protection compliance and made aware of the companies policies. Employees who handle personal data of data subjects can be put under further confidentiality obligations.

8. Data controllers are obliged to carry out (or have third parties carry out) necessary audits to ensure compliance with the Data Protection Law within their own organisation

The data controller is also be obliged to be audited regarding its data security. The controller shall be obliged to conduct necessary auditions or have them conducted in his own institution or organization, with the aim of implementing the provisions of this Law. The controller can conduct this audition by himself or through a third party.

We help you minimize legal risks in data processing in Turkey!

Contact Person

Mrs. Kübra Yılmaz, LL.M

COO & Data Protection Compliance Expert

Practical Guide: Data protection compliance in Turkey

Introduction

FAQ's

General

Definitions

The 8 steps to data protection compliance in Turkey

How to compliantly transfer data abroad from Turkey

Penalties and enforcement decisions for breaches of Data Protection Law in Turkey

The rights of data subjects

The legal bases for compliant data processing

Key points on explicit consent for data protection compliance

1. Informing data subjects

2. Obtaining express (explicit) consent from data subjects

If applicable: Application to the data protection authority for international data transfers

3. Appointment of data controller representative and VERBIS Registration

4. Guaranteeing data security with policy and procedure

If applicable: Data breach notification and appropriate response

5. Creation and adherence to data retention and erasure policies

6. Contracts with third-party data processors

7. Training and awareness for employees

8. Data controllers are obliged to carry out (or have third parties carry out) necessary audits to ensure compliance with the Data Protection Law within their own organisation

Contact Person

COOKIES

POLICIES

Copyright Notice

CONTACT