Turkish KVKK Legal Text

(1) The members of the Board shall be elected and the organizational structure of the Presidency shall be established within six months following the date of publication of this Law, as per the procedure stipulated in Article 21.

(2) Data controllers are obliged to register with the Data Controllers’ Registry within the time specified and announced by the Board.

(3) The personal data that were processed before the publication date of this Law shall be rendered compatible with the provisions of this Law within two years as of its date of publication. The personal data which are found to be not complying with the provisions of this Law shall be immediately erased, destructed or anonymized. However, consents duly taken before the publication date of this Law shall be deemed compatible with the provisions of this Law, unless no declaration of intent is made to the contrary within one year.

(4) The by-laws provided for by this Law shall be brought into force within one year as of the date of publication of this Law.

(5) A high-level executive, to ensure coordination with regard to the implementation of the Law in public institutions and organisations, shall be appointed and notified to the Presidency within one year as of the date of publication of this Law.

(6) The term of office for the first elected President, the Second President, and two members who are determined by ballot, shall be six years; this period shall be four years for the remaining five members.

(7) Until the budget of the Authority is allocated;

• a) The expenditures of the Authority shall be reimbursed by the budget of the office of the Prime Minister.
• b) All necessary support services such as the premises, equipment, furnishing and the hardware shall be provided by the office of the Prime Minister in order for the Authority to fulfil its duties.

(8) The clerical services of the Authority shall be carried out by the office of the Prime Minister until the service units of the Authority has become fully functional.

(Added:28/11/2017 – Article 7061/120)

(1) Those who are graduated from 4-year degree program from faculties of political sciences, economics and administrative sciences, faculty of law and business administration or the departments of electronics or electrical and electronic engineering, electronic and communication engineering, computer engineering, information systems engineering of faculty of engineering in Türkiye or abroad whose accreditation have been recognized by Council of Higher Education; and who have served for more than two years excluding annual leaves at positions indicated in sub-paragraph (11) of paragraph (A) of “Common Terms” Article 36 of the Law No 657 which requires occupational qualification test and on-the-job training and lecturers, having taken minimum 70 points at Foreign Language Placement Test and who are younger than 40 year old may be assigned as Personal Data Protection Expert. Number of personnel to be assigned in regard may not exceed fifteen.

(Added: 2/3/2024- Art. 7499/36)

(1) The first paragraph of Article 9, as it existed before the amendment introduced by the law, shall remain in effect until 1/9/2024, alongside the amended version that entered into force.

(2) Applications pending before the criminal judgeships of peace as of 1/6/2024 shall continue to be processed by these judgeships.

(1) The purpose of this By-law is to determine and ensure the implementation of procedures and principles related to the establishment and management of Data Controllers’ Registry to be kept publicly available by Presidency under supervision of the Board pursuant to Personal Data Protection Law No. 6698 of 24/3/2016 and envisaged records to be entered into Data Controllers’ Registry.

(1) This By-law shall apply to natural and legal persons who determine the purposes and means of personal data processing and are responsible for establishment and management of the data filing system.

(1) This By-law has been prepared on the basis of Article 16(5) and subparagraphs (d) and (e) of Article 22(1) of Law No. 6698.

(1) For the purposes of this By-law:

• a) “Recipient group” means category of natural and legal persons to which the personal data are transferred by the data controller,
• b) “President” means the President of Personal Data Protection Authority,
• c) “Presidency” means the Presidency of Personal Data Protection Authority,
• ç) (Amended: OG (Official Gazette) – 28/4/2019-30758) “Contact person” means the natural person notified by the data controller which is natural and legal person established in Türkiye and by representative who represents the data controller which is natural and legal person not established in Türkiye during the registration with the Registry for communicating with the Authority relating to obligations within the scope of the Law and secondary legislation to be prepared in accordance with this Law,
• d) “Law” means the Personal Data Protection Law No. 6698,
• e) “Registration” means the notification made by data controllers who are obliged to register, in accordance with procedures and principles determined by this By-law.
• f) “Obligation to register” means the obligation relating to registration to be fulfilled pursuant to the By-law,
• g) “Registered e-mail address (KEP)” means the qualified form of electronic mail which provides legal evidence for the use of it, including sending and delivering of electronic messages,
• ğ) “Personal data” means any information relating to an identified or identifiable natural person,
• h) (Amended: OG-28/4/2019-30758) “Personal data processing inventory” means the inventory which are detailed by explanations of the followings; personal data processing operations performed by data controllers according to their business processes, purposes and legal basis of personal data processing, data category, recipient group, maximum storage period which is formed relating to the group of person subject to data and necessary for the purpose for which personal data are processed, personal data envisaged to be transferred to foreign countries, and measures taken relating to data security.
• ı) “Personal data storage and disposal policy” means the policy which data controllers issue as a basis for erasure, destruction and anonymization of personal data and the determination of maximum storage period for the purpose for which personal data are processed.
• i) “Processing of personal data” means any operation which is performed on personal data, wholly or partially by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof,
• j) “Board” means the Personal Data Protection Board,
• k) “Authority” means the Personal Data Protection Authority,
• l) “Registry” means Data Controllers’ Registry kept by the Presidency,
• m) “Category of Data” means group of personal data related to group(s) of persons subject to data that are classified in accordance with their common features,
• n) “Group of persons subject to the data” means category of the data subject whose personal data are processed by data controllers,
• o) “Data Controllers’ Registry Information System (VERBIS)” means information system that is accessible through the Internet, established and managed by the Presidency, that data controllers will use for the registration with the Registry and the other operations related to the Registry,
• ö) “Data controller” means the natural or legal person who determines the purpose and means of processing of personal data and is responsible for establishment and management of the data filing system,
• p) (Amended: OG-28/4/2019-30758) “Representative of the data controller” means the legal person established in Türkiye or the natural person who is citizen of Republic of Türkiye , minimum authorized to represent data controllers which are not established in Türkiye within the scope of the issues specified in the third paragraph of Article 11 of this By-law,

(2) For the definitions not included in this By-law, the definitions in the Law shall apply.

(1) Following principles, rules and procedures shall be applied in establishment, management and supervision of the Registry:

• a) Data controllers are obliged to register with the Registry prior to the start of data processing.
• b) Data controllers not established in Türkiye are obliged to register with the Registry by their representatives prior to the start of data processing.
• c) The Registry shall be kept publicly available. Board is authorized to determine the scope of this principle and derogations provided that the principle of making publicly available is ensured.
• ç) (Amended: OG-28/4/2019-30758) Data controllers under registration obligation are obliged to prepare Personal Data Processing Inventory. The information to be entered in the application for the Registry is prepared based on Personal Data Processing Inventory.
• d) The information entered into the Registry based on personal data processing inventory and published in the Registry, shall be the basis for the obligation to inform for data controllers referred to in Article 10 of the Law, responses to the request of concerned data subjects referred to in Article 13 of the Law and the determination of the scope of explicit consent to be given by data subjects.
• e) Data controllers shall be responsible for the information entered into the Registry and published in the Registry to be complete, accurate, up-to-date and lawful. Registration of the data controllers with the Registry shall not remove the other obligations under the Law.
• f) Without prejudice to the conditions specified in Article 28 of the Law, the Board may provide derogation from the obligation to register for the data controllers meeting certain conditions on the basis of the objective criteria specified in Article 16 of the By-law. This derogation shall not remove the obligations of those data controllers under the Law.
• g) The operations relating to the Registry shall be carried out by data controllers through VERBIS.
• ğ) (Amendment: OG-28/4/2019-30758) – (1) Maximum storage period necessary for the purpose of processing of personal data entered by data controllers into the Registry and published in the Registry shall be basis for erasure, destruction and anonymization obligations of data controllers specified in Article 7 of the Law.

(1) Registry is established by Presidency. Presidency, for the establishment, management, protection of the Registry and maintaining it up-to-date, shall take necessary technical and organizational measures to establish and to operate VERBIS.

(2) Responsible department for establishment and management of the Registry is Department of Data Management.

(3) Supervision of the Registry is carried out by the Board. Activity report which has been prepared by Department of Data Management once a three month and whose scope determined by the Board, shall be transmitted to the Board.

(1) The Presidency shall make current information in the Registry publicly available by the appropriate means to be determined pursuant to Board decisions.

(2) Among the information given in the Registry, the following shall be disclosed to the public:

• a) (Amendment: OG-28/4/2019-30758) The data controller, representative of the data controller, if any, address and KEP (Registered E-Mail) address, if taken,
• b) The purposes for which the personal data will be processed,
• c) Group(s) of persons subject to the data and data categories relating to those persons,
• ç) Recipients and recipient groups to whom personal data may be transferred,
• d) Personal data which are envisaged to be transferred to foreign countries,
• e) Registration date and expiration date of the registration.
• f) Measures taken for the security of personal data,
• g) Maximum storage period necessary for the purposes for which personal data are processed.

(1) Data controllers shall fulfil the obligation to register with the Registry prior to the start of data processing.

(2) If the data controllers, who are not under the registration obligation, become obliged to register later, they shall register with the Registry within thirty days following their entry into the obligation.

(3) Data controllers, who are obliged to register with the Registry, may request additional time for fulfilling their registration obligation from the Authority in cases where they cannot fulfil their obligation to register due to any technical, legal or actual impossibility on the condition that apply to the Authority in writing with justifiable grounds in not later than 7 work days. Authority may give additional time only once, not exceeding thirty days in any case.

(1) Registration Application to the Registry includes the following information:

• a) The information included in the application form determined by the Board relating to the identity and address of the data controller, representative of the data controller, if any and contact person,
• b) The purposes for which the personal data will be processed,
• c) The explanations about group(s) of persons subject to the data as well as about the data categories belonging to these people,
• ç) The recipients or groups of recipients to whom personal data may be transferred,
• d) The personal data which are envisaged to be transferred abroad,
• e) Measures taken as referred to in Article 12 of the Law and in accordance with the criteria determined by the Board,
• f) Maximum storage period of personal data laid down by the legislation or for the purposes for which personal data are processed,

2) Information to be entered into the Registry by data controllers pursuant to subparagraphs (b), (c), (ç) and (d) of the first paragraph; shall be transmitted through VERBIS to the Registry based on Personal Data Processing Inventory by using headings given in VERBIS.

(3) Information to be entered into the Registry by data controllers pursuant to subparagraph (e) of the first paragraph shall be transmitted through VERBIS to the Registry in the manner that cover the issues specified in the Article 12 of the Law by using headings given in VERBIS.

(4) Information relating to the maximum storage period laid down by the legislation or for the purposes for which personal data are processed relating to the personal data to be entered into the Registry by data controllers pursuant to the subparagraph (f) of the first paragraph, shall be entered into the Registry by matching them with data categories. Maximum storage period necessary for the purposes of processing of data categories entered into the Registry by the data controller may differ from the period envisaged in the legislation. In such cases, if maximum storage period is envisaged in the legislation, this period shall be entered into the Registry, if not envisaged, the longest storage period of this category shall be entered into the Registry. While determining the maximum storage period required for purposes for which personal data are processed, following issues shall be taken into account:

• a) The period generally accepted in the sector in which the data controller operates within the scope of purposes for processing relevant data category,
• b) The period that requires processing of personal data in the relevant data category and to continue legal relationship with the data subject,
• c) The period to be valid for the legitimate interest to be obtained by the data controller in accordance with lawfulness and fairness, depending on the purpose of processing relevant data category,
• ç) The period in which the risks, costs and responsibilities arising from the storage of the relevant data category depending on the purpose of processing shall continue legally,
• d) Whether maximum storage period to be determined is appropriate to keep the relevant data category accurate and up-to-date where necessary,
• e) Time period in which the data controller is obliged to retain personal data given in the relevant data category pursuant to its legal obligation,
• f) Period of limitation determined by the data controller for assertion of a right relating to personal data in the relevant data category.

(5) Data controllers shall issue a personal data storage and disposal policy for defining maximum storage period of personal data for the purposes of processing, complying with this period indicated in personal data processing inventory and tracking whether these periods are exceeded or not and shall ensure the implementation of such policy.

(6) In cases where headings and contents given in VERBIS do not cover operations of the data controller and the information to be entered into the Registry, the data controller shall complete its registration by entering such information into “Others” section in VERBIS which is provided for such cases.

(1) Data controllers shall be deemed to have fulfilled its registration obligation by entering the information specified in Article 9 into VERBIS.

(2) Data controllers, who have been given additional time by the Authority pursuant to third paragraph of Article 8, are obliged to complete registration before this time expires.

(1) Legal persons are themselves the data controllers for the legal persons. The data controller obligations of legal persons established in Türkiye under the Law are fulfilled by capacity of competent to represent and bind the legal person or the person(s) specified in the relevant legislation pursuant to provisions of the relevant legislation. Competent representative may assign one or more persons for its obligations to be fulfilled for the implementation of the Law. This assignment does not remove the responsibilities of legal person pursuant to the provisions of the Law.

(2) Representatives of data controllers not established in Türkiye shall submit certified copy of decision for the designation of a representative to be taken its competent or person to the Authority during application.

(3) Decision of designation for representative of the data controller shall be arranged to cover at least the following points:

• a) to receive or accept notifications and correspondence made by the Authority on behalf of the data controller,
• b) to transmit the demands made by the Authority to the data controller and to submit the responses of the data controller to the Authority,
• c) to receive and transmit requests to be made by data subjects pursuant to first paragraph of the Article 13 of the Law on behalf of the data controller, in case no other principle has been determined by the Board.
• ç) to transmit the response of the data controller to the data subjects pursuant to third paragraph of Article 13 of the Law, in case no other principle has been determined by the Board,
• d) to perform operations relating to the Registry on behalf of the data controller.

4) (Amendment: OG-28/4/2019-30758), Data controllers established in Türkiye and representatives of data controllers not established in Türkiye shall enter contact person information into the Registry at the time of registration. Contact person is not authorized to represent data controllers in accordance with the provisions of the Law and the By-law.

5) (Amendment: OG-28/4/2019-30758) Contact person in the public institutions shall be head of department or higher executive to be assigned by the coordinating high level executive for the aim of communication with the Authority.

(1) Related to the implementation of the Law, the Authority shall use following means of communications with data controllers:

• a) For legal persons established in Türkiye; identity, address or KEP (registered e-mail address) address notified to the Registry,
• b) For natural persons settled in Türkiye; identity, address or KEP address notified to the Registry,
• c) For data controllers not established in Türkiye; representative of the data controller notified to the Registry.

(1) (Amendment: OG-28/4/2019-30758) In case of any change in the Registry records, data controllers shall notify the Authority through VERBIS within seven days of the date of change.

(1) The data controller shall apply to the Authority relating to the erasure of their Registry records through VERBIS.

(2) If the obligation to register is relieved or terminated, Registry records shall be erased. These records shall be accessible in case of any request however they are kept in a manner that no changes can be made.

(3) Erasure of registry records does not relieve the data controller of the obligations during the period in which it is registered.

(1) In respect of the following personal data processing activities, data controllers are not obliged to register and notify these activities to the Registry:

• a) Data processing is necessary for the prevention of committing a crime or for crime investigation.
• b) Processing the data which are made public by the data subject himself/herself.
• c) Data processing is necessary for performance of supervision or regulatory duties and disciplinary investigation and prosecution to be carried out by the assigned and competent public institutions and organizations and by the public professional organizations, in accordance with the power conferred on them by the law,
• ç) Data processing is necessary for protection economic and financial interests of State related to budgetary, tax and financial matters.

(1) The Board may provide derogation from registration obligation by considering following criteria:

• a) The nature of personal data.
• b) The quantity of personal data.
• c) The purpose of processing of personal data.
• ç) The field of activity where personal data are processed.
• d) Transferring personal data to third parties.
• e) The fact that the processing of data is laid down in the laws.
• f) Storage period of personal data.
• g) Group of persons subject to the data or categories of data.
• ğ) (Annex: OG-28/4/2019-30758) The information of annual number of employees or annual financial balance sheet of the data controller.

(2) Board has the authority to take decisions in order to determine principles and procedures of implementation and the scope of exemptions determined in the framework of criteria listed in the first paragraph. Board shall announce such decisions to public via appropriate means of communication.

(1) Administrative fine referred to in sub-paragraph (ç) of Article 18(1) of the Law shall be imposed on data controllers who act contrary to the obligation to register and notify.

(2) In the event that the action to contrary to the obligation to register and notify is committed within the public institutions and organizations as well as the public professional organizations, the disciplinary provisions shall be applied to the civil servants and other public officers employed in the relevant public institutions and organisations and those employed in the public professional organizations upon the notice of the Board and the result is reported to the Board.

(1) The Board is authorised to clarify the doubts and recover disruptions to occur during the implementation of this By-law, to direct the implementation, to determine the principles and standards and make necessary arrangements to ensure the unity of implementation, to demand any type of information and documentation in this regard and to take a decision within the framework of the relevant legislation on matters which are not included in this By-law.

(1) This By-law enters into force on 1/1/2018.

(1) The President shall enforce the provisions of this By-law.

(1) The purpose of this By-Law is to determine principles and procedures regarding erasure, destruction and anonymization of personal data processed wholly or partially by automated means or by non-automated means which provided that form part of a data filing system.

(1) Provisions of this By-Law shall apply to data controllers in accordance with Article 7 of the Personal Data Protection Law No. 6698 and of 24/03/2016.

(1) This By-Law is issued on the basis of Article 7(3) and sub-paragraph (e) of Article 22(1) of Personal Data Protection Law No. 6698.

(1) For the purposes of this By-Law:

• a) “Recipient group” means category of natural or legal persons to which the personal data are transferred by the data controller,
• b) “User concerned” means persons who process personal data within the organization of the data controller or upon authorization and instructions received from the data controller, other than the person or department which is responsible for the technical storage, protection and back up of personal data,
• c) “Disposal” means erasure, destruction or anonymization of personal data,
• ç) “Law”: Personal Data Protection Law No. 6698 and of 24/3/2016,
• d) “Recording medium” means any type of environment that keeps the personal data processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system,
• e) (Amendment:OG-28/4/2019-30758) “Personal data processing inventory” means the inventory which are detailed by explanations of the followings: personal data processing activities of data controllers according to their business processes; purposes and legal ground of personal data processing; data category; maximum data storage period required for the purposes formed relating to the recipient group to whom the data are transferred and with data subject groups, and for personal data processing; personal data envisaged to be transferred to foreign countries; and measures taken relating to the data security,
• f) “Personal data storage and disposal policy” means the policy which data controllers issues as a basis for erasure, destruction and anonymization of personal data and determination of maximum storage period for the purpose for which personal data are processed,
• g) “Board” means Personal Data Protection Board,
• ğ) “Periodic Disposal” means the erasure, destruction or anonymization process which is determined in the personal data storage and disposal policy and to be carried out periodically ex officio, in the event that all of the conditions for processing laid down in the Law no longer exist,
• h) “Registry” means Data Controllers’ Registry kept by Personal Data Protection Authority,
• ı) “Data filing system” means the filing system where personal data are processed by being structured according to specific criteria,
• i) “Data Controller” means the natural or legal person who determines the purpose and means of processing personal data and is responsible for the establishment and management of the data filing system,

(2) For the definitions not included in this By-Law, the definitions in the Law shall apply.

(1) Pursuant to Article 16 of the Law; data controllers who are obliged to register with Data Controllers’ Registry system shall issue personal data storage and disposal policy in accordance with personal data processing inventory.

(2) To issue personal data storage and disposal policy shall not mean that personal data are stored, erased, destructed or anonymized in accordance with the Law and the By-Law.

(3) For data controllers who are not obliged to issue personal data storage and disposal policy, the obligation of storage, erasure, destruction or anonymization of personal data shall continue pursuant to the Law and By-Law.

(1) Personal data storage and disposal policy shall at least include the following:

• a) Purpose of issuing personal data storage and disposal policy,
• b) Recording medium arranged in accordance with personal data storage and disposal policy,
• c) Definitions of technical and legal terms indicated in personal data storage and disposal policy,
• ç) Explanations relating to legal, technical or other reasons requiring storage and disposal of personal data
• d) Technical and organizational measures taken against unlawful processing of and access to personal data and for storing personal data securely,
• e) Technical and organizational measures taken for lawful disposal of personal data,
• f) Definitions of titles, units and tasks of those who are involved in personal data storage and disposal processes
• g) Table that shows storage and disposal periods,
• ğ) Time period for periodic disposal,
• h) Any alterations being made in the current personal data storage and disposal policy, if any.

(1) Personal data shall be erased, destructed or anonymized by the controller ex officio (by its own initiative) or upon the request of the data subject, in the event that all of the conditions for processing laid down in Article 5 and Article 6 of the Law no longer exist.

(2) It is mandatory to act in accordance with general principles of Article 4 of the Law, technical and organizational measures to be taken within the scope of Article 12, provisions of the relevant legislation, Board decisions and personal data storage and disposal policy in erasure, destruction and anonymization of personal data.

(3) All operations relating to erasure, destruction and anonymization of personal data shall be recorded and those records shall be stored for minimum three years excluding other legal obligations.

(4) (Amendment: OG-28/4/2019-30758) The data controller is obliged to describe the methods used for the erasure, destruction and anonymization operations of personal data in the relevant policies and procedures.

(5) Unless otherwise decided by the Board, the data controller may choose one of the appropriate methods for periodic erasure, destruction or anonymization of personal data ex officio. Upon request of data subject, the data controller may choose appropriate method with justified grounds.

(1) Erasure of personal data is the process of rendering personal data inaccessible and non-reusable for the users concerned, by no means.

(2) The data controller is obliged to take necessary technical and organizational measures required for ensuring erased data to be inaccessible and non-reusable for its users concerned.

(1) Destruction is the process of rendering personal data inaccessible, irretrievable or non-reusable by anyone, by no means.

(2) The data controller is obliged to take any type of technical and organizational measures required for ensuring destruction of personal data.

(1) Anonymization is the process of rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data.

(2) To anonymize the personal data, personal data shall be rendered impossible to relate to identified or identifiable person, even through using appropriate techniques in respect of the recording medium and relevant field of activity, such as recovery of data by the data controller, recipient or recipient groups and matching data with other data.

(3) The data controller is obliged to take any type of technical and organizational measures required for ensuring anonymization of personal data.

(1) The data controller, who has issued data storage and disposal policy, shall erase, destruct or anonymize the personal data in the first periodic disposal process following the date when obligation of erasure, destruction or anonymization of personal data arises.

(2) Time interval for periodic disposal shall be defined in personal data storage and disposal policy by the data controller. This time interval cannot exceed six months in any case.

(3) Data controllers who are not obliged to issue personal data storage and disposal policy, shall erase, destruct or anonymize personal data within three months following the date for obligation of erasure, destruction or anonymization of personal data arises.

(4) Board may shorten the durations specified in this Article in the case of irreparable or impossible damages, and in the event of explicit infringement of the law.

(1) (Amendment- OG-28/4/2019-30758) When the data subject requests erasure or destruction of his/her personal data from the data controller, pursuant to Article 11 and 13 of the Law;

a) In the event that all of the conditions for the processing no longer exist; the data controller shall erase, destruct or anonymize the mentioned personal data which are subject to the request. The data controller shall act on the request of the data subject at the latest within thirty days and inform the data subject.

b) In the event that all of the conditions for the processing no longer exist and the personal data which are subject to the request have been transferred to any third party; the data controller shall notify the third party of such request and ensure the performance of necessary operations by the third party within the scope of this By-Law.

c) In the event that all of the conditions for the processing have not disappeared completely, the request may be rejected by the data controller in accordance with the Article 13(3) of the Law together with its justified grounds and such rejection shall be communicated to the data subject in writing or by electronic means at the latest within thirty days.

(1) The Board is authorised to clarify the doubts and recover disruptions to occur during the implementation of this By-Law, to direct the implementation, to determine the principles and standards and make necessary arrangements to ensure the unity of implementation, to demand any type of information and documentation in this regard and to take a decision within the framework of the relevant legislation on matters which are not included in this By-Law.

(1) This By-Law shall enter into force on 1/1/2018.

(1) The President of Personal Data Protection Authority shall enforce the provision of this By-Law.

(1) The purpose of this By-Law is to establish the procedures and principles regarding the implementation of Article 9 of the Personal Data Protection Law No. 6698 dated 24/03/2016, which regulates the transfer of personal data abroad.

(1) The provisions of this By-Law shall apply to data controllers and data processors involved in the transfer of personal data abroad in accordance with Article 9 of the Law No. 6698.

(1) This By-Law is issued pursuant to Article 9(11) and Article 22(1)(e) of the Law No. 6698.

(1) For the purposes of this By-Law, the following definitions shall apply:

• a) President: The President of the Personal Data Protection Authority;
• b) Data subject: A natural person whose personal data is processed;
• c) Law: The Personal Data Protection Law No. 6698 dated 24/3/2016;
• ç) Personal data: Any information relating to an identified or identifiable natural person;
• d) Processing of personal data: Any operation which is performed on personal data, wholly or partially, by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof;
• e) Transfer of personal data abroad: The transmission of personal data from a data controller or data processor under the Law No.6698 to a data controller or data processor established abroad, or making such data accessible to them by any other means;
• f) Board: The Personal Data Protection Board;
• g) Authority: The Personal Data Protection Authority;
• ğ) Data exporter: A data controller or data processor transferring personal data abroad;
• h) Data importer: A data controller or data processor in a foreign country receiving personal data from the data exporter;
• ı) Data processor: A natural or legal person who processes personal data on behalf of the data controller upon its authorisation;
• i) Data controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.

(2) For the definitions not covered in this By-Law, the definitions provided in the Law and relevant legislation shall apply.

(1) Personal data may only be transferred abroad by the controller and the processor in accordance with the procedures and principles set forth in the Law and this ByLaw. In cases where personal data is transferred by the processor, the instructions from the controller shall also be complied with.

(2) The provision of the first paragraph shall also apply to onward transfers of personal data that has been transferred abroad, and transfers to international organisations.

(3) The provisions of other laws concerning the transfer of personal data abroad are reserved.

(1) Personal data may be transferred abroad by controllers and processors under one of the conditions specified in Article 5 and Article 6 of the Law, and in the event of the following circumstances:

• a) An adequacy decision has been issued regarding the country, sectors within that country, or international organisations to which the transfer is to be made;
• b) In the absence of an adequacy decision, one of the appropriate safeguards specified in Article 10 is provided by the parties, on the condition that data subject rights and effective legal remedies for data subjects are also available in the country receiving the transfer.

(2) In the absence of an adequacy decision and where the parties cannot provide one of the appropriate safeguards specified in Article 10, personal data may be transferred abroad by controllers and processors only under one of the exceptional circumstances specified in Article 16, provided that such transfer is incidental.

(3) Without prejudice to the provisions of international conventions, personal data may only be transferred abroad with the permission of the Board by obtaining the opinion of the relevant public institution or organisation, in cases where the interests of Türkiye or the data subject would be seriously harmed.

(1) In cases where personal data is transferred abroad by the processor, the processor shall act within the purpose and scope established by the controller, on behalf of the controller, and in accordance with the controller’s instructions. The processor shall implement all necessary technical and organisational measures to ensure an appropriate level of security, corresponding to the nature of personal data, in order to prevent unlawful processing of personal data, unlawful access to personal data, and to ensure protection of personal data.

(2) The transfer of personal data abroad by the processor shall not relieve the controller of its responsibility to comply with the procedures and principles, and to ensure the necessary safeguards stipulated in the Law and this By-Law. The controller shall be obliged to ensure that the technical and organisational measures specified in the first paragraph are implemented by the processor.

(3) If the processor is obliged to notify the standard contract pursuant to the Article 14(5), the processor shall fulfil this notification obligation independently of any instructions from the controller.

(1) The Board may decide that a country, one and more sectors within that country, or an international organisation offers an adequate level of protection with respect to the transfer of personal data abroad. When assessing the adequacy of the level of protection, the following elements shall be taken into account:

• a) The reciprocity status concerning the transfer of personal data between Türkiye and the country, sectors within that country, or international organisations to which the data will be transferred;
• b) The relevant legislation and practices of the country receiving the data transfer, and the rules governing the international organisation receiving the data transfer;
• c) The existence of an independent and effective data protection authority in the country or to which an international organisation is subject, as well as the availability of administrative and judicial redress for the data subjects;
• ç) The status of being a party to relevant international conventions on personal data protection or membership in international organisations by the country or international organisation to which the personal data will be transferred;
• d) The membership status of the country or international organisation receiving the data transfer in global or regional organisations that Türkiye is a member of;
• e) The international conventions to which Türkiye is a party.

(2) The Board shall be authorised to determine additional factors beyond those specified in the first paragraph.

(3) If the Board deems it necessary in its assessment regarding the adequacy decision, it may seek the opinions of relevant institutions and organisations.

(4) Adequacy decisions issued by the Board shall be published in the Official Gazette and on the Authority’s website.

(1) The adequacy decision shall be re-evaluated at least every four years. The adequacy decision in question shall explicitly specify the re-evaluation periods. If, following the re-evaluation, the Board determines that the relevant country, one or more sectors within the country, or the international organisation no longer provides an adequate level of protection, it may amend, suspend, or revoke its decision with prospective effect.

(2) The Board may, without being restricted by the re-evaluation period specified in the first paragraph, review the adequacy decision at any time if it deems it necessary and may amend, suspend, or revoke the decision with prospective effect.

(3) The Board may consult with the competent authorities of the relevant country or international organisation to remedy the circumstances that led to the amendment, suspension, or revocation of the adequacy decision pursuant to first and second paragraphs.

(4) The decisions concerning the amendment, suspension, or revocation of the adequacy decision shall be published in the Official Gazette and on the Authority’s website.

(1) In the absence of an adequacy decision, personal data may be transferred abroad on the condition that one of the conditions specified in Article 5 and Article 6 of the Law exists, and that data subject rights and effective legal remedies for data subjects are also available in the country receiving the transfer, but only where one of the following appropriate safeguards is provided by the parties involved in the transfer:

• a) The existence of an agreement, which is not classified as an international convention, between public institutions and organisations, or professional organisations with public institution status in Türkiye and public institutions, organisations, or international organisations abroad, along with approval for the transfer by the Board;
• b) The existence of binding corporate rules, containing provisions on personal data protection, which the companies within a group of undertakings engaged in joint economic activities are required to comply with, and which have been approved by the Board;
• c) The existence of a standard contract which is published by the Board, containing information such as data categories, purposes of the data transfer, recipients and recipient groups, technical and organisational measures to be implemented by the data importer, and additional measures for sensitive personal data,
• ç) The existence of a written commitment containing provisions to ensure adequate protections, and approval for the transfer by the Board.

(1) Appropriate safeguards may be provided by provisions to be inserted into agreements, not classified as an international convention, for the transfer of personal data between public institutions and organisations, or professional organisations with public institution status in Türkiye, and public institutions, organisations, or international organisations abroad. The agreement shall be concluded between the parties to the personal data transfer.

(2) The Board’s opinion shall be sought during the negotiation process of the agreement.

(3) The provisions on personal data protection included in the agreement shall specifically address the following:

• a) The purpose, scope, nature, and legal basis of the personal data transfer;
• b) Definitions of key concepts in accordance with the Law and relevant legislation;
• c) A commitment to comply with the general principles outlined in Article 4 of the Law,
• ç) Procedures and principles for providing information to data subjects about the agreement and the personal data transfer to be carried out under that agreement;
• d) A commitment to ensure that data subjects whose personal data has been transferred can exercise their rights as specified in Article 11 of the Law, and procedures and principles regarding the requests to be made for the use of these rights;
• e) A commitment to implement all necessary technical and organisational measures to ensure appropriate level of security;
• f) A commitment to implement adequate measures as determined by the Board for the transfer of sensitive data;
• g) Restrictions on the onward transfer of personal data; ğ) A redress mechanism available to data subjects in the event of a breach of the data protection provisions to be included in the agreement;
• h) An auditing mechanism to ensure compliance with the data protection provisions to be included the agreement;
• ı) A provision granting the data exporter the right to suspend the data transfer and terminate the agreement if the data importer cannot comply with the data protection provisions to be included in the agreement;
• i) A commitment from the data importer, upon termination or expiration of the agreement, to either return the personal data transferred, including all backups, to the data exporter or to completely destroy such data, at the choice of the data exporter;

(4) To transfer the personal data abroad based on the agreement, the data exporter shall apply to the Board for permission. As part of the application, the final version of the agreement text and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. The transfer of personal data may only commence after the Board has granted the permission.

(1) Appropriate safeguards may be provided through binding corporate rules for the protection of personal data, which the companies within the group of undertakings engaged in joint economic activity are obliged to comply with. To transfer personal data abroad based on binding corporate rules, an application for approval shall be submitted to the Board.

(2) As part of the application, the text of the binding corporate rules and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. If any document submitted for the application is in a foreign language, a notarised translation shall be attached to the application. If the binding corporate rules are also prepared in a foreign language, the Turkish text shall prevail.

(3) In approving the binding corporate rules, the Board shall consider the following:

• a) The binding corporate rules are legally binding and enforceable for each relevant member within the group of undertakings engaged in joint economic activity, including their employees;
• b) The binding corporate rules include a commitment to ensure enforceable data subject rights;
• c) The binding corporate rules contain at least the elements specified in Article 13.

(4) The transfer of personal data may only commence after the Board has approved the binding corporate rules.

(1) Binding corporate rules shall include at least the following elements:

• a) The organisational structure and contact details for each member of the group of undertakings engaged in a joint economic activity;
• b) Information regarding the data transfers under binding corporate rules, in particular the categories of personal data, processing activity and its purposes, data subject group or groups, and identification of country or countries receiving data transfer,
• c) A commitment confirming that binding corporate rules are legally binding both within the internal relations and external legal interactions of the group of undertakings engaged in a joint economic activity;
• ç) Data protection measures such as compliance with the general principles outlined in Article 4 of the Law, conditions for processing personal data, sensitive personal data, technical and organisational measures for ensuring data security, adequate measures for processing sensitive personal data, and restrictions on onward data transfers;
• d) A commitment to ensure that data subjects whose personal data is transferred can exercise of their rights specified in Article 11 of the Law and their right to lodge a complaint with the Board in accordance with the procedures and principles outlined in Article 14 of the Law, along with the existence of the procedures and principles for the exercise of these rights;
• e) A commitment that, in the event of a breach of the binding corporate rules by any member not established in Türkiye, a controller and/or processor established in Türkiye will assume liability for the breach;
• f) Explanations on how the data subjects will be informed about matters related to the binding corporate rules, in particular on the provisions referred to in subparagraphs (ç), (d) and (e), as well as the information provided to the data subjects within the scope of the obligation to inform under Article 10 of the Law;
• g) Explanations on the training to be provided to employees on the protection of personal data;
• ğ) The tasks of the persons or entities in charge of the monitoring compliance with the binding corporate rules within the group of undertakings, including their role in responding to the requests of the data subjects;
• h) The mechanisms for auditing and verifying compliance with the binding corporate rules within the group of undertakings, in particular data protection audits and methods for ensuring corrective actions to protect the rights of the data subjects, and a commitment that such results will be communicated to the person or entity referred to in subparagraph (ğ) and to the board of the controlling company within the relevant group of undertakings, and to the Board upon request;
• ı) The mechanisms for reporting and recording changes to the binding corporate rules and reporting those changes to the Board;
• i) The obligation to cooperate with the Authority to ensure compliance with the binding corporate rules by the members of the group of undertakings, in particular the submission of the results from the audit and verification activities referred to in subparagraph (h);
• j) With respect to personal data to be transferred under the binding corporate rules, a commitment by the members of the group of undertakings that there is no national regulation in the country or countries receiving the data transfer that contradicts the guarantees provided by the binding corporate rules, and mechanisms to notify the Board in case of a legislative change which likely to have a substantial adverse effect on these guarantees;
• k) A commitment to provide appropriate data protection training to personnel having permanent or regular access to personal data;

(2) The Board shall be authorised to determine additional requirements beyond those specified in the first paragraph. The documents required for the application of binding corporate rules shall be determined by the Board.

(1) Appropriate safeguards may be provided through a standard contract, which includes elements such as data categories, purposes of data transfer, recipient and recipient groups, technical and organisational measures to be implemented by the data importer, additional measures, and additional measures for sensitive personal data.

(2) The standard contract shall be determined and announced by the Board.

(3) The standard contract text shall be used without any modifications. In the event the standard contract is also concluded in a foreign language, the Turkish text shall prevail.

(4) The standard contract shall be concluded between the parties involved in the personal data transfer. It shall be signed by the parties to the transfer, or by persons authorised to represent and sign on behalf of the parties.

(5) The standard contract, after finalisation of the signatures, shall be notified to the Authority within five business days, either physically, through a registered electronic mail (KEP) address, or via other methods specified by the Board. The parties to the transfer may designate in the standard contract which party will fulfil the notification obligation. If no such agreement is made, the data exporter shall be responsible for notifying the Board.

(6) The notification shall include documents certifying that the signatories are authorised, along with notarised translations of any foreign language documents.

(7) If the standard contract text announced by the Board is modified, or if one or both parties to the transfer lack valid signatures in the standard contract, the Board shall conduct an examination in accordance with Article 15 of the Law.

(8) In the event of any change to the parties involved in the standard contract, or modifications to the information and explanations it contains, or if the standard contract is expired, the Board shall be notified in accordance with the procedure outlined in paragraph five.

(1) Appropriate safeguards for the protection of personal data may be provided through provisions included in a written commitment letter to be concluded between the parties involved in the transfer.

(2) The provisions related to the protection of personal data in the commitment letter shall specifically include the following:

• a) The purpose, scope, nature, and legal basis of the personal data transfer;
• b) Definitions of key concepts in accordance with the Law and relevant legislation;
• c) A commitment to comply with the general principles specified in Article 4 of the Law;
• ç) Procedures and principles for informing data subjects about the commitment letter and the personal data transfer to be made under its scope;
• d) A commitment to ensure that data subjects whose personal data has been transferred can exercise their rights as specified in Article 11 of the Law, and procedures and principles regarding the requests to be made for the use of these rights;
• e) A commitment to implement all necessary technical and organisational measures to ensure appropriate level of security;
• f) A commitment to implement adequate measures as determined by the Board for the transfer of sensitive data;
• g) Restrictions on the onward transfers of personal data;
• ğ) A redress mechanism available to data subjects in the event of a breach of the commitment letter;
• h) A commitment by the data importer to comply with the Board’s decisions and opinions regarding the processing of personal data subject to the transfer;
• ı) A provision stating that there is no national regulation that will cause the data importer to fail to comply with the commitment letter, and a commitment to notify the data exporter as soon as possible of any potential legislative changes that may lead to such a failure, and in such a case the data exporter shall have the right to suspend the data transfer and terminate the commitment letter;
• i) A provision confirming that if the data importer fails to ensure compliance with the commitment letter, the data exporter shall have the right to suspend the data transfer and terminate the commitment letter;
• j) A commitment that if the commitment letter is terminated or its term expires, the data importer shall, at the choice of the data exporter, either return the personal data with its backups to the data exporter or completely destroy the personal data;
• k) A commitment confirming that the commitment letter is subject to Turkish law and, in case of a dispute, Turkish courts shall have jurisdiction, and that the data importer agrees to recognise the jurisdiction of Turkish courts.

(3) To transfer personal data abroad based on the commitment letter, data exporter shall apply to the Board for permission. As part of the application, the commitment text and any other information and documents necessary for the Board’s evaluation shall be submitted to the Board. If the commitment is also concluded in a foreign language, the Turkish text shall prevail. The transfer of personal data may only commence after the Board has granted permission.

(1) In the absence of an adequacy decision and where the parties cannot provide one of the appropriate safeguards specified in Article 10, personal data may be transferred abroad only under one of the exceptional circumstances specified in the second paragraph, provided that such transfer is incidental. Transfers that are not regular, occur only once or a few times, do not have a continues nature, and are not part of the ordinary course of business shall be considered incidental.

(2) Exceptional cases for the transfer of personal data are as follows:

• a) The data subject has given explicit consent to the transfer, provided that he/she has been informed of the potential risks involved;
• b) The transfer is necessary for the performance of a contract between the data subject and the controller, or for the implementation of pre-contractual measures implemented at the data subject's request;
• c) The transfer is necessary for the establishment or performance of a contract between the controller and another natural or legal person, carried out in the interest of the data subject;
• ç) The transfer is necessary for a substantial public interest;
• d) The transfer of personal data is necessary for the establishment, exercise, or protection of any right;
• e) Transfer of personal data is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid;
• f) The transfer is made from a registry that is open to public or accessible to persons with legitimate interest, provided that the conditions for accessing the registry under relevant legislation are fulfilled, and that the person with a legitimate interest has requested the transfer.

(3) For transfers under subparagraph (f) of the second paragraph, the following procedures and principles shall be observed:

• a) The transfer shall not include all personal data or categories of personal data contained within the registries;
• b) Transfers from registries accessible to persons with legitimate interests shall only be made to those persons or upon their request.

(4) The provisions in subparagraphs (a), (b), and (c) of the second paragraph shall not apply to the activities of public law activities of public institutions and organisations.

(1) The Board shall be authorised to resolve any ambiguities that may arise in the implementation of this By-Law and to make decisions on matters not specifically addressed within herein, in accordance with the relevant legislation.

(1) This By-Law shall enter into force on the date of its publication.

(1) The President of the Personal Data Protection Authority shall be responsible for executing the provisions of this By-Law.