Ankara --:-- · —
bilgi@utuhukuk.com
0536 593 16 00
UTU Hukuk ve Danışmanlık5 min readUpdate:
which entered into force on 7 April 2016, Protection of Personal Data Law governs the conditions for processing personal data. In this article, we will first set out the basic concepts.
Currency note
This article was prepared in accordance with the legislation and practice in force on the date of its publication. The legislation on the protection of personal data, in particular the conditions for processing special categories of personal data, may have changed since then. You are advised to consult a lawyer on the current position.
Personal data is defined in the Law as “any information relating to an identified or identifiable natural person” is how it is defined.
As is clear from this definition, for a piece of information to qualify as personal data;
Three elements of personal data
- relate to a natural person,
- concern a natural person whose identity is identified or identifiable, and
- The element of the information relating to a person, in the sense required by the Law, must be present.
In order to grasp what the concept of personal data is, it is useful to examine these criteria in detail:
The personal data protected by the Law are only data relating to natural persons. Consequently, data relating to legal persons are, as a rule, not regarded as personal data.
For information relating to a natural person to be regarded as personal data, the identity of that natural person must be identified or identifiable. A person being identified means that he or she can be distinguished from the other persons in the group to which he or she belongs. Being identifiable refers to the situation in which, although the person cannot be distinguished from others using the available data, he or she can be distinguished with certain additional data.
Identified person
A person who can be distinguished from the other persons in the group to which he or she belongs.
Identifiable person
A person who cannot be distinguished by means of the existing data but can be distinguished with certain additional data.
Criterion of access to additional information
If access to the additional information referred to is not prohibited by law and does not present significant difficulty for the data controller, the data are accepted as personal data.
In general, the requirement of relating to a natural person is met where the information is directly about that natural person. However, it is accepted that the requirement of relating to may also be met in certain cases where the information is not directly about the person.
Any information that meets the three conditions stated above is regarded as personal data. By way of example, information such as first name and surname, address, Turkish Republic identity number, telephone number, tax number, marital status, occupation, date of birth, gender, CV, criminal record, association membership, salary, personnel information, IP address, IMEI number, location information, photographs, video, audio recordings, medical reports, blood group, fingerprints, eye colour, DNA information, disability status, and travel and shopping information is personal data.
Special categories of personal data;
are listed exhaustively in the Law. In other words, they are set out on a closed-list basis.
Veri Sorumlusu (Controller)
The natural or legal person who determines the purposes and means of processing personal data and who establishes and manages the system is a natural or legal person.
Data Processor (Processor)
The person who processes personal data within the framework of the purposes and methods determined by the data controller.
In short, the data subject is defined as “the natural person whose personal data are processed” means.
the Law any operation performed on data, such as the collection, recording, storage, retention, alteration, reorganisation, disclosure, transfer, takeover, making available, classification or prevention of use of personal data, wholly or partly by automated means or by non-automated means provided that they form part of a data filing system, is defined as the processing of personal data.
Hukuka uygunluk sebepleri
In order to identify the grounds of lawfulness for processing personal data, it must first be determined whether a piece of data is personal data or special category personal data. This is because the Law sets out separately the general grounds of lawfulness and the grounds of lawfulness for processing special categories of data.
For the rules on managing consent for commercial electronic messages, see our article on the Message Management System for further details.
The Law defines personal data as any information relating to an identified or identifiable natural person. For this, the information must relate to a natural person, the person’s identity must be identified or identifiable, and there must be an element of relation between the information and the person.
Kanun’un koruduğu kişisel veriler yalnızca gerçek kişilere ilişkin verilerdir; tüzel kişilere ilişkin veriler kural olarak kişisel veri sayılmaz.
It means that, although the person cannot be distinguished from others by the available data, they can be distinguished with additional data. If access to the additional information is not legally prohibited and does not create significant difficulty for the data controller, that data is considered personal data.
Kişilerin ırkı, kökeni, siyasi düşüncesi, felsefi inancı, dini, mezhebi veya diğer inançları, kılık-kıyafeti, dernek, vakıf ya da sendika üyeliği, sağlığı, cinsel hayatı, ceza mahkûmiyeti ve güvenlik tedbirleriyle ilgili verileri ile biyometrik ve genetik verileri Kanun’da sınırlı olarak sayılmıştır.
Any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, classifying or preventing the use of data, is considered processing of personal data.
Consultation request
At UTU Hukuk Danışmanlık, we provide legal representation and advisory services in the field of company law.
Fill in the form and we will call you. You can also contact us directly: