IT Law and Data Protection

Under Article 13 of the Act, the data controller must conclude the requests contained in the application free of charge, depending on their nature, as soon as possible and within thirty days at the latest. If the transaction requires an additional cost, the fee set out in the tariff may be charged.

If the application is rejected, the response given is found insufficient, or no response is given within the period, a complaint may be filed with the Board.

Under Article 14 of the Act, this complaint must be filed within thirty days of learning of the response, and in any event within sixty days of the date of the application. Missing these periods forecloses the right to complain.

Under Article 9 of the Act, personal data may be transferred abroad if one of the conditions set out in Articles 5 and 6 exists, and there is an adequacy decision regarding the destination country, sectors within that country, or international organisations.

Where no adequacy decision exists, reliance on one of the appropriate safeguards, such as standard contractual clauses, binding corporate rules, an undertaking, or an international agreement, is required. The data subject must also have the means to seek their rights.

This framework requires a separate compliance effort for companies using cloud services and intra-group data sharing. The basis on which the transfer is made must be documented.

The duty to inform must be fulfilled before data is processed and is independent of obtaining consent. The notice must include the identity of the data controller, the purposes of processing, the transfer, and the legal basis.

Explicit consent must be given in relation to a specific matter, based on information, and expressed with free will. Making the provision of a service conditional on consent may render the consent invalid.

Where a legal basis other than consent exists, reliance on that basis is preferred over obtaining consent. Collecting unnecessary consent increases compliance risk.

Data controllers exceeding the set thresholds are required to register with the Data Controllers' Registry (VERBIS). The scope of the registration obligation depends on criteria such as the number of employees and financial size.

A personal data processing inventory must be prepared before registration. The inventory includes the purposes of processing, categories of data, retention periods, and transfer information.

A retention and destruction policy must be put in writing. Failure to destroy data whose retention period has expired is the deficiency most commonly encountered in audits.

Where personal data is unlawfully accessed, the data controller must notify the Board and the affected data subjects as soon as possible. Because the notification period is short, preparation must be made in advance.

The scope of the incident, the categories of data affected, and the measures taken must be recorded. A breach log must be kept.

The technical examination report and the corrective measures taken are considered in the assessment of administrative sanctions. For this reason, documenting the response steps is important.

Under Act No. 5651, an application may be made to the criminal judgeship of peace on the grounds that personal rights have been violated, requesting removal of the content or blocking of access. The decision is rendered promptly.

A direct application may also be made to the content provider or hosting provider. The application must clearly indicate the address of the content and the reason for the violation.

A request for delisting from search results is based on data protection legislation. If the request is rejected, a complaint may be filed with the Board.

The correct legal basis must be determined for data processed during recruitment, personnel, and performance processes. Formation of the employment contract and legal obligations are commonly used bases.

Proportionality is required in practices such as camera recording, location tracking, and monitoring of corporate email. The employee must have been informed in advance.

Health data is subject to stricter conditions as a special category of personal data. Access to this data must be restricted.

If the post is considered to constitute a crime, a complaint may be filed with the public prosecutor's office. A complaint period is set for the offense of insult.

A claim for non-pecuniary damages may also be filed for the same incident. Criminal and civil remedies proceed independently of each other.

To prevent loss of evidence, having the content recorded through a notary or a court-appointed expert is useful. A screenshot alone may be weak evidence.

The log records, device examination, and expert report underlying the allegation are examined in detail. The integrity of the records and their timestamps are at the center of the dispute.

The distinction between authorized and unauthorized access is important. The elements of the offense are assessed differently for data an employee accessed in the course of their duties.

Whether the evidence obtained was collected in a lawful manner is also reviewed. An unlawful search or seizure affects how the evidence is evaluated.

Compliance with consumer legislation is required regarding information provided on distance contracts, the right of withdrawal, and delivery periods. The pre-contractual information form must be provided on a durable medium.

Prior consent must be obtained and registration made with the Message Management System (IYS) for sending commercial electronic messages. Sending without consent results in an administrative fine.

A privacy notice, cookie management, and retention periods must be established for personal data collected through the site. Data sharing with the payment infrastructure must also be documented.

The scope of delivery, acceptance criteria, maintenance and support conditions, and service level commitments must be clearly stated. An unclear scope turns into a dispute over additional work.

Who will own the intellectual property rights and whether the source code will be transferred must also be set out. If it is not transferred, the scope of the usage licence must be specified.

Data processing roles must be defined in the agreement. Where the service provider acts as a data processor, additional security obligations apply.

Violation of obligations such as the duty to inform, data security, registration with the registry, and failure to comply with Board decisions is subject to an administrative fine. The fines are updated each year.

An action for annulment may be filed in the administrative courts against a Board decision. The period for filing the action must be calculated from the service of the decision.

In addition to the administrative sanction, a claim for compensation by affected persons may also arise. For this reason, documenting compliance work provides protection on both fronts.

Under Article 11 of the Personal Data Protection Act No. 6698, everyone has the right to apply to the data controller to learn whether their personal data is being processed, to request information about it if it is, and to learn the purpose of the processing and whether the data is used in accordance with that purpose.

The same article also lists the rights to know the third parties to whom the data is transferred, whether within Turkey or abroad, to request correction of incomplete or inaccurate data, and to request its deletion or destruction under the conditions set out in the Act.

The Act also provides the right to object to a result that is unfavorable to the person arising from analysis carried out solely through automated systems, and to request compensation for damage arising from unlawful processing.