(1) The data subject shall make the requests relating to the implementation of this Law to the data controller in writing or by other means to be determined by the Board.

(2) The data controller shall conclude demands in the request within the shortest time by taking into account the nature of the demand and at the latest within thirty days and free of charge. However if the action requires an extra cost, fees may be charged in the tariff determined by the Board.

(3) The data controller shall act on the request or refuse it together with justified grounds and communicate its response to the data subject in writing or by electronic means. In case the demand in the request is accepted, it shall be fulfilled by the data controller. If the request is made due to fault of the data controller, the fee is refunded to data subject.

(1) If the request is refused, the response is found insufficient or the request is not responded within the specified time period, the data subject may lodge a complaint with the Board within thirty days as of he or she learns about the response of the data controller, or within sixty days as of the request date, in any case.

(2) A complaint shall not be lodged before exhausting the remedy of the request to the data controller pursuant to Article 13.

(3) The right to compensation, under the general provisions, of those whose personal rights are violated, is reserved.

(1) The Board shall carry out the necessary examination on the matters falling within its task upon complaint or ex officio where it has learnt about the alleged infringement.

(2) The notices and complaints not meeting conditions pursuant to Article 6 of the Law No. 3071 of 1/11/1984 on the Use of Right to Petition shall not be examined.

(3) Except for the information and documents having the status of state secret, the data controller shall send the information and documents demanded by the Board related to the subject of examination within fifteen days, and shall enable, where necessary, on-the-spot examination.

(4) Upon complaint, the Board examines the demand and gives an answer to the data subjects. In case it is not responded in sixty days from the date of complaint the demand shall be deemed refused.

(5) As a result of the examination made upon complaint or ex officio, in cases where it is understood that an infringement exists, the Board shall decide that the identified infringements shall be remedied by the relevant data controller and notify this decision to the relevant parties. This decision shall be implemented without delay and within thirty days at the latest after the notification,

(6) As a result of the examination made upon complaint or ex officio, in cases where it is determined that the infringement is widespread, the Board shall take a resolution on this matter and publishes this resolution. Prior to taking the resolution, the Board may also receive the opinions of the relevant institutions and organisations, if needed.

(7) The Board may decide to stop the processing of personal data or transfer of personal data abroad in the case damages which are difficult or impossible to compensate for, and in the event of explicit infringement of the law.

(1) Under the supervision of the Board, the Data Controllers’ Registry shall be kept by the Presidency and be made publicly available.

(2) Natural or legal persons who process personal data shall register with the Data Controllers’ Registry prior to the start of data processing. However, by taking into account the objective criteria set by the Board such as the nature and quantity of the data processed, that data processing is laid down in a law, or transferring the data to third parties, the Board may provide derogation from the obligation of registration with the Data Controllers’ Registry.

(3) Application for registration with the Data Controllers’ Registry shall be made with a notification including:

• a) The identity and address of the data controller and of its representative, if any,
• b) The purpose for which the personal data will be processed,
• c) The explanations relating to group(s) of persons subject to the data and the data categories of these persons,
• ç) The recipients or groups of recipients to whom the personal data may be transferred,
• d) The personal data which are envisaged to be transferred abroad,
• e) The measures taken concerning the security of personal data.
• f) The maximum storage period necessary for the purpose for which personal data are processed.

(4) Any changes in the information given pursuant to the third paragraph shall be immediately notified to the Presidency

(5) Other procedures and principles relating to the Data Controllers’ Registry shall be laid down through a by-law.