Personal Data Protection Law

The Personal Data Protection Law (KVKK) is a law that determines the basic legal framework for the protection of personal data in Turkey and entered into force on April 7, 2016. This law includes a series of principles and rules designed to prevent individuals’ personal data from being collected, processed, stored or transferred to third parties without permission. KVKK is a very important legal regulation in terms of ensuring the security of personal data and protecting individuals’ privacy rights.

Personal data can be defined as any information that allows an individual to be identified. This data is not limited to directly identifying information such as name-surname and ID number, but also includes health status, online behavior, biometric data and many other types of information.

KVKK covers not only private sector organizations but also all real and legal persons who process data, including public institutions. This legal regulation requires certain procedures and controls to be carried out at many stages, from the collection, processing, storage and deletion of personal data.

Consequences of Acting Contrary to the Personal Data Protection Law:

1. Data Owner Rights: – Individuals have the right to access, correct, delete, transfer and object to processing activities regarding the processing of personal data. KVKK provides individuals with the opportunity to exercise these rights.
2. Obligations in Case of Data Breach: – In case of a personal data breach, the person or institution processing the data is obliged to immediately report the situation to the Personal Data Protection Authority. In addition, victims of such breaches may also apply for redress of their grievances.
3. Obligations of Data Processors: – Natural and legal persons who process data are obliged to ensure the security of personal data. These obligations include keeping the data accurate and up-to-date, taking security measures, and processing information about the data owner only to the extent necessary.
4. Purposes and Conditions of Data Processing: – Personal data may be collected and processed only for specific, clear and legitimate purposes. In addition, data processing activities must be based on the explicit consent of the data subject or may be carried out in case of a legal obligation.

Basic Issues Addressed Within the Scope of the Personal Data Protection Law:

1. Data Processing Permissions: – Collection of personal data can only be done with the explicit consent of the data owner. In some cases, legal obligations or contractual obligations require data processing permission.
2. Data Security: – Necessary measures must be taken to ensure the security of data. This must be ensured by both physical and technical security measures. In case of breaches, the legal responsibilities of the data controller arise.
3. Data Deletion and Anonymization: – Personal data must be securely deleted or anonymized if the purpose for which it was collected has been fulfilled. These processes must be monitored and audited.
4. Informing Data Owners: – Organizations that process personal data are obliged to inform data owners about the purpose of processing the data, the duration of data processing and to whom it will be transferred.
5. Data Controller and Data Processor: – All obligations regarding the protection of personal data are fulfilled by the data controller. Data processors act in accordance with the instructions of the data controller.

As Aykut Law Firm, the services we offer within the scope of the Personal Data Protection Law:

• Legal consultancy for compliance with the Personal Data Protection Law
• Supervision of personal data processing processes and ensuring legal compliance
• Creation and implementation of data security protocols
• Protection of legal rights and reporting in cases of personal data breach
• Development of internal procedures for companies’ data processing activities
• Managing and finalizing applications regarding personal data
• Regulation and auditing of legal procedures regarding personal data security

Protection of personal data is not only a legal obligation, but also an important process that secures the privacy of individuals. As Aykut Law Firm, we ensure the data security of our clients with services that fully comply with KVKK.