The Turkish Data Protection Authority Updates the Guidelines on the Fulfilment of the Obligation to Inform

The Guidelines on the Fulfilment of the Obligation to Inform (“Guidelines”) has been updated and published by the Turkish Data Protection Authority (“Authority”).

The Guidelines sets out in detail the general principles and procedures for fulfilling the obligation to inform in accordance with Law No. 6698 on the Protection of Personal Data (“Law”).

According to the Guidelines;

• The obligation to inform requires data controllers to provide the data subject with information prior to the collection of personal data regarding the purposes for which the data will be processed, the categories of data to be collected, the recipients of the data and the legal grounds for the processing activities. This provision imposes an obligation on data controllers to ensure transparency in the processing of personal data and to inform data subjects of their rights concerning such data.
• The primary party responsible for fulfilling the obligation to inform is the data controller, who bears responsibility for the processing of personal data. The data controller determines the purposes and means of processing and is also accountable for ensuring the security of the data.
• The personal data processing inventory must include detailed information on the purposes of data processing, data categories, recipient groups to whom the data is transferred, data security measures and retention periods.
• The Guidelines recommends that all data controllers prepare a personal data processing inventory, even if they are not registered with the Data Controllers’ Registry.
• The following key points should be taken into consideration when preparing an information notice:
  1. Identity and Contact Details of the Data Controller: The identity of the data controller must be clearly stated in the information notice.
  2. Purposes of Data Processing: The purposes for which the personal data are processed must be explicitly indicated.
  3. Data Transfers: The recipients of the personal data and the purposes of such transfers must be explained.
  4. Method of Data Collection and Legal Basis: The method by which the personal data are collected and the legal grounds for the processing must be specified.
  5. Rights of the Data Subject: The rights of the data subject, as set forth in Article 11 of the Law, must be clearly stated in the information notice.

• Selecting appropriate methods to fulfil the obligation to inform, properly drafting the information notice and ensuring that the rights of data subjects are not violated are of critical importance.

You can access the full text of the Guidelines (in Turkish) here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zumbul Attorneys at Law for general informational purposes only, in accordance with the Attorneyship Law, other relevant legislation and the Professional Rules of Attorneyship of the Union of Turkish Bar Associations. These publications are not intended for advertising or commercial purposes. The information and documents provided are of a general nature and under no circumstances, do they guarantee or warrant that the content is complete, accurate, up-to-date, or reliable. You should not rely on the information and documents on this website without first consulting a lawyer or expert. The links included in our website’s publications are sourced from publicly available materials and are provided solely for the convenience of visitors in accessing additional information. These links do not constitute any form of recommendation or endorsement of the linked persons, institutions or organizations. The information on this website does not in any way constitute legal advice or establish an attorney-client relationship with visitors to the site. All content on this website is the property of by Zumbul Attorneys at Law, and no content may be copied, reproduced, or used without prior written permission.