PERSONAL DATA PROTECTION (KVKK)

All natural and legal persons who process personal data — in practice almost every business that holds customer, employee or visitor information — are within its scope. The obligation to register with VERBİS is determined by Board decisions based on criteria such as number of employees, annual balance sheet and field of activity.

No. Explicit consent is not required where one of the legal grounds listed in the law applies, such as performance of a contract, a legal obligation or legitimate interest. However, informing the data subject about the processing is mandatory in every case.

First apply in writing to the data controller, who must respond within thirty days at the latest. If the request is rejected, the response is inadequate or no timely response is given, a complaint can be filed with the Personal Data Protection Board; a damages claim can also be brought.

The data controller must notify the Board without delay and, under the Board’s decision, within 72 hours at the latest of becoming aware of the breach. Affected individuals must also be notified within a reasonable time and the measures taken must be documented.

The Board’s administrative fines are challenged by filing an action before the administrative court. Apart from fines, acts such as unlawfully recording or sharing personal data may also constitute offences under the Turkish Criminal Code.

Cameras may be used proportionately for security purposes; however, employees and visitors must be informed, and no recording may take place in private areas such as changing rooms or toilets. Recordings must also be kept no longer than the purpose requires.