(1) Personal data storage and disposal policy shall at least include the following:

• a) Purpose of issuing personal data storage and disposal policy,
• b) Recording medium arranged in accordance with personal data storage and disposal policy,
• c) Definitions of technical and legal terms indicated in personal data storage and disposal policy,
• ç) Explanations relating to legal, technical or other reasons requiring storage and disposal of personal data
• d) Technical and organizational measures taken against unlawful processing of and access to personal data and for storing personal data securely,
• e) Technical and organizational measures taken for lawful disposal of personal data,
• f) Definitions of titles, units and tasks of those who are involved in personal data storage and disposal processes
• g) Table that shows storage and disposal periods,
• ğ) Time period for periodic disposal,
• h) Any alterations being made in the current personal data storage and disposal policy, if any.