(1) Pursuant to Article 16 of the Law; data controllers who are obliged to register with Data Controllers’ Registry system shall issue personal data storage and disposal policy in accordance with personal data processing inventory.

(2) To issue personal data storage and disposal policy shall not mean that personal data are stored, erased, destructed or anonymized in accordance with the Law and the By-Law.

(3) For data controllers who are not obliged to issue personal data storage and disposal policy, the obligation of storage, erasure, destruction or anonymization of personal data shall continue pursuant to the Law and By-Law.