Ankara --:-- · —
bilgi@utuhukuk.com
0536 593 16 00
UTU Hukuk ve Danışmanlık14 min readUpdate:
The basic concepts of the KVKK (Personal Data Protection Law), are the starting point for understanding to whom and to which data the Personal Data Protection Law applies. The Draft Personal Data Protection Law, prepared within the scope of harmonisation with the European Union, was submitted to the Speaker of the Grand National Assembly of Türkiye on 18 January 2016. The text was adopted by the General Assembly of the Grand National Assembly on 24 March 2016, became law, and entered into force upon publication in Official Gazette No. 29677 dated 7 April 2016. In this article we discuss the scope of the Law; basic concepts such as personal data, special categories of personal data, data processing, data controller, data processor and explicit consent; and the obligation to register with VERBİS.
Currency note
This article was prepared on the basis of the legislation and practice in force on the date of its publication. There may have been changes since then to the deadlines for registration with VERBİS, the thresholds for the registration obligation and certain provisions of the Law. You are advised to consult a lawyer regarding the current position.
Article 2 of the Law sets out its scope. Under that article, the Law applies to natural persons whose personal data are processed, and to natural and legal persons who process such data wholly or partly by automated means, or by non-automated means forming part of any data filing system.
The Law draws no distinction between public institutions and private bodies. The procedures and principles it lays down apply, as a rule, to all institutions and organisations. Its provisions therefore also apply to personal data processed by public institutions.
The personal data protected under Law no. 6698 are only those belonging to natural persons; data belonging to legal persons are not protected. However, where obtaining data belonging to a legal person leads to the identification of one or more natural persons, such data may also benefit from the protection of the Law. Even then, what is in substance protected is the personal data relating to the natural person.
Nor does the Law draw any distinction according to whether personal data are processed wholly or partly by automated means, or by non-automated means forming part of a data filing system. Accordingly, any system structured according to particular criteria so as to facilitate access to personal data falls within the scope of the Law.
The Law applies only to data relating to natural persons. Data relating to legal persons fall outside its scope, since Article 1 of the Law uses the expression “natural persons whose personal data are processed”.
Nor do the provisions of the Law on the processing of personal data apply to personal data recorded physically and not forming part of a data filing system, since Article 1 uses the expression “processed wholly or partly by automated means, or by non-automated means forming part of any data filing system”.
Excluded cases · Art. 28
Article 28 of the Law, moreover, lays down the cases that fall wholly or partly outside its scope: paragraph 1 sets out the full exemptions and paragraph 2 the partial exemptions. Where a full exemption applies, the provisions of the Law do not apply at all; where a partial exemption applies, only certain provisions do not apply.
The protection of personal data means the protection of fundamental rights and freedoms through the regulation of the processing of personal data.
The protection of personal data is aimed fundamentally at protecting not the data but the persons to whom the data relate. In other words, data protection refers to the administrative, technical and legal measures — given concrete form in the principles governing the protection of personal data — directed at protecting individuals against the harm that may arise from the processing of data about them, whether wholly or partly by automated or by non-automated means.
Example from a Court of Cassation decision
By way of example, in a judgment of the Court of Cassation the sharing of a person’s photographs on social media by another without permission was treated as an act infringing that person’s rights (Court of Cassation, 12th Criminal Chamber, E.2015/13582, K.2017/3109, 12.04.2017).
The basic concepts used in applying the Law are as follows:
Personal data means any information relating to an identified or identifiable natural person.
For there to be personal data, the data must relate to a natural person and that person must be identified or identifiable.
Not only information that establishes a person’s identity — such as name, surname, date and place of birth — but all data that render a person directly or indirectly identifiable are regarded as personal data: telephone number, vehicle registration number, social security number, passport number, curriculum vitae, images, video and voice recordings, fingerprints, e-mail address, hobbies, preferences, persons with whom the individual interacts, group memberships, family information and health information.
As the Law does not adopt an exhaustive list of the information to be treated as personal data, the scope may be extended. What matters is that the data can be associated with the person or can identify them. Whether particular data constitute personal data must be assessed on the facts of each case, having regard to their capacity to identify the person.
Special categories of personal data are data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, together with biometric and genetic data. Sensitive data may thus be regarded as a small group of personal data subject to greater protection.
These data, a more strictly protected subset of personal data, fall within the category of sensitive data because, if learned by others, they may expose the data subject to discrimination or exclusion by society; the Law lays down a number of special provisions in respect of them.
The Law defines the processing of personal data as “any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means, or by non-automated means forming part of any data filing system”.
The Regulation defines the same concept as “any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.
The definitions of “data processing” in the Law and in the Regulation correspond to one another.
The Law describes as the data controller the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. Legal persons are themselves “data controllers” in respect of the activities they carry out in processing personal data, and the legal responsibility set out in the relevant provisions arises in the person of the legal entity. In the Regulation this corresponds to the definition of “controller”.
The data processor is a separate natural or legal person who processes personal data on behalf of the data controller in accordance with the instructions given to them, and who is authorised by the data controller by means of a personal data processing agreement.
Veri sorumlusu
Determines the purposes and means of processing personal data; is responsible for establishing and managing the data filing system.
Data processor
A separate natural or legal person who processes personal data on behalf of the data controller within the framework of the instructions given to it.
The Law defines explicit consent as consent relating to a particular matter, based on information, and expressed by free will. Article 20/3 of the Constitution further provides that personal data may be processed only in the cases prescribed by law or with the explicit consent of the person concerned. Under the Law, explicit consent is one of the grounds of lawfulness for both special categories of personal data and other personal data.
Consent is a concept to which all instruments governing data processing attach importance; the Regulation likewise defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”.
Age limit for consent under the Regulation
The Regulation lays down an age limit in respect of consent. Where the child is at least 16 years old, the child’s consent is valid and the processing of that child’s personal data is lawful. Where the child is under 16, the processing is lawful only if, and to the extent that, consent is given or authorised by the holder of parental responsibility over the child. Member States may also provide by law for a lower age, provided that it is not below 13 years.
Anonymisation means rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching them with other data.
This is the filing system in which personal data are processed, structured according to particular criteria; it corresponds to the filing system referred to in the Regulation.
Equivalents of the concepts in the Law and the Regulation
| Kanun | Regulation |
|---|---|
| Data processing | Data processing (the definitions correspond to each other) |
| Veri sorumlusu | Data controller |
| Data filing system | Dosyalama sistemi |
VERBİS is a registration system in which natural and legal persons who process personal data must register before beginning to process such data, and in which they enter information, by category, about the personal data they process.
Registration is made through the website of the Personal Data Protection Authority, www.kvkk.gov.tr On the page that appears, click the VERBİS button and complete the relevant fields to register with VERBİS.
Provisional Article 1/2 of the Law confers on the Personal Data Protection Board (“the Board”) the task and power to decide and announce the dates on which the obligation to register with the Data Controllers’ Registry begins. Decision no. 2019/387, taken by the Board on that basis and published in the Official Gazette of 27 December 2019, sets the registration start dates for data controllers as follows:
must register with the Registry.
Under Article 16 of the Law, natural and legal persons who process personal data must register with the Registry before beginning to process such data. As a general rule, therefore, natural and legal person data controllers established in Turkey, natural and legal person data controllers established abroad, and public institution and organisation data controllers must register with VERBİS where they process personal data in Turkey. Data controllers exempted by the Board under Article 16 are not, however, subject to the obligation to register.
Under Article 16 of the Law, natural and legal persons who process personal data must register with the Registry before beginning to process such data. Where, however, they carry out the activities set out in Article 28 of the Law, data controllers are not required to enter information about those personal data into VERBİS at the time of registration.
Exemptions — ARTICLE 28 - (1) The provisions of this Law do not apply in the following cases:
a) the processing of personal data by natural persons in the course of activities relating wholly to themselves or to family members living in the same dwelling, provided that the data are not given to third parties and the obligations relating to data security are complied with.
b) the processing of personal data for purposes such as research, planning and statistics, by anonymising them, together with official statistics.
c) the processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not infringe national defence, national security, public security, public order, economic security, the privacy of private life or personal rights, and does not constitute an offence.
ç) the processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations entrusted by law with the task and power of ensuring national defence, national security, public security, public order or economic security.
d) the processing of personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or enforcement proceedings.
(2) Provided that it is proportionate and consistent with the purpose and basic principles of this Law, Article 10, governing the data controller’s obligation to inform, Article 11, governing the rights of the data subject (other than the right to claim compensation for damage), and Article 16, governing the obligation to register with the Data Controllers’ Registry, do not apply in the following cases:
a) where the processing of personal data is necessary for the prevention of crime or for a criminal investigation.
b) the processing of personal data made public by the data subject themselves.
c) where the processing of personal data is necessary, on the basis of the power conferred by law, for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by competent and authorised public institutions and organisations and by professional bodies having the character of a public institution.
ç) where the processing of personal data is necessary for the protection of the economic and financial interests of the State in budgetary, tax and financial matters.
Personal Data Protection Law No. 6698, Art. 28
Article 16 of the Law provides that “the Board may grant exemptions from the obligation to register with the Data Controllers’ Registry, having regard to objective criteria to be determined by the Board, such as the nature and number of the personal data processed, whether the processing arises from law, and whether the data are transferred to third parties” is the applicable provision.
On the basis of that provision, the Board has granted exemptions from the registration obligation to certain data controllers. Board Decision no. 2018/32 was published in the Official Gazette of 15 May 2018, and Board Decisions nos. 2018/68, 2018/75 and 2018/87 in the Official Gazette of 18 August 2018. Accordingly:
are exempt from the obligation to register with VERBİS. Although data controllers within this scope are not obliged to register, they may register with VERBİS.
Scope of the exception
However, it should be borne in mind that exemption from the obligation to register with the Registry does not mean exemption from the provisions of the Law.
Selda GÜNGÖR
Related legislation: Personal Data Protection Law No. 6698 (mevzuat.gov.tr)
The article addresses as basic concepts under Law No. 6698 personal data, special categories of personal data, data processing, data controller, data processor, explicit consent, anonymisation and data filing system.
Personal data is any information relating to an identified or identifiable natural person. In addition to first name, surname and date of birth, data that make a person directly or indirectly identifiable, such as a telephone number, licence plate, image and audio recordings and e-mail address, are also personal data.
No. The Law protects only personal data of natural persons. However, if obtaining data belonging to a legal person leads to the identification of one or more natural persons, such data may also benefit from the protection of the Law; in that case too, what is protected is the natural person's data.
They are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
A data controller is the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system. A data processor is a separate natural or legal person who processes data on behalf of the data controller and in accordance with its instructions.
Hayır. Makalede, Sicile kayıt yükümlülüğünden istisna tutulan veri sorumlularının isterlerse VERBİS’e kaydolabileceği, ancak bu istisnanın Kanun hükümlerinden istisna olmak anlamına gelmediği vurgulanmaktadır.
Consultation request
At UTU Hukuk Danışmanlık, we provide legal representation and advisory services in the field of company law.
Fill in the form and we will call you. You can also contact us directly:
Other articles in Corporate Law