(1) The members of the Board shall be elected and the organizational structure of the Presidency shall be established within six months following the date of publication of this Law, as per the procedure stipulated in Article 21.

(2) Data controllers are obliged to register with the Data Controllers’ Registry within the time specified and announced by the Board.

(3) The personal data that were processed before the publication date of this Law shall be rendered compatible with the provisions of this Law within two years as of its date of publication. The personal data which are found to be not complying with the provisions of this Law shall be immediately erased, destructed or anonymized. However, consents duly taken before the publication date of this Law shall be deemed compatible with the provisions of this Law, unless no declaration of intent is made to the contrary within one year.

(4) The by-laws provided for by this Law shall be brought into force within one year as of the date of publication of this Law.

(5) A high-level executive, to ensure coordination with regard to the implementation of the Law in public institutions and organisations, shall be appointed and notified to the Presidency within one year as of the date of publication of this Law.

(6) The term of office for the first elected President, the Second President, and two members who are determined by ballot, shall be six years; this period shall be four years for the remaining five members.

(7) Until the budget of the Authority is allocated;

• a) The expenditures of the Authority shall be reimbursed by the budget of the office of the Prime Minister.
• b) All necessary support services such as the premises, equipment, furnishing and the hardware shall be provided by the office of the Prime Minister in order for the Authority to fulfil its duties.

(8) The clerical services of the Authority shall be carried out by the office of the Prime Minister until the service units of the Authority has become fully functional.

(Added:28/11/2017 – Article 7061/120)

(1) Those who are graduated from 4-year degree program from faculties of political sciences, economics and administrative sciences, faculty of law and business administration or the departments of electronics or electrical and electronic engineering, electronic and communication engineering, computer engineering, information systems engineering of faculty of engineering in Türkiye or abroad whose accreditation have been recognized by Council of Higher Education; and who have served for more than two years excluding annual leaves at positions indicated in sub-paragraph (11) of paragraph (A) of “Common Terms” Article 36 of the Law No 657 which requires occupational qualification test and on-the-job training and lecturers, having taken minimum 70 points at Foreign Language Placement Test and who are younger than 40 year old may be assigned as Personal Data Protection Expert. Number of personnel to be assigned in regard may not exceed fifteen.

(Added: 2/3/2024- Art. 7499/36)

(1) The first paragraph of Article 9, as it existed before the amendment introduced by the law, shall remain in effect until 1/9/2024, alongside the amended version that entered into force.

(2) Applications pending before the criminal judgeships of peace as of 1/6/2024 shall continue to be processed by these judgeships.