Regarding the Law on the Protection of Personal Data.

Law No. 6698, concerning the Protection of Personal Data (KVKK), came into effect on April 7, 2016, and regulations and announcements have been published under the scope of this law. According to the decision of the Personal Data Protection Board dated July 19, 2018, the obligation to register with the Data Controllers Registry for those with a number of employees or a total financial balance exceeding a certain threshold, as well as for data controllers based abroad, began on October 1, 2018, with a deadline of September 30, 2019, for registration. Different deadlines were established for those whose main activity involves the processing of special-category personal data, with the registration obligation starting on January 1, 2019, and for public institutions and organizations, with the obligation starting on April 1, 2019.

Genel

As is known, within the framework of cooperation with EU countries regarding the protection of personal data and in accordance with EU acquis, Law No. 6698 on the Protection of Personal Data (KVKK) was published and came into effect on April 7, 2016.

According to the law;

Regulation on the Deletion or Anonymization of Personal Data, dated October 28, 2017.

Regulation on the Procedures and Principles Regarding the Working Methods of the Personal Data Protection Board, dated November 16, 2017.

Regulation Regarding the Registry of Data Controllers, dated December 30, 2017.

Personal Data Protection Expertise Regulation dated February 9, 2018,

Personal Data Protection Authority Organizational Bylaw dated April 26, 2018,

Regulations,

Regulation on Procedures and Principles Regarding Applications to the Data Controller, dated March 10, 2018.

With the notification amending the notification dated April 28, 2019, the "Notification on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation" is hereby published.

Published.

The Law regulates the processing of personal data, including its general principles, processing conditions, the deletion, destruction, or anonymization of personal data, the transfer of personal data, the obligations of data controllers to provide information, obligations related to data security, procedures for applications and complaints, the register of data controllers, the rules and procedures for investigations, offenses and violations, the Data Protection Authority, its duties, the Data Protection Board, the Board's operational principles and organizational structure, data protection specialists and their assistants, provisions related to personnel rights, exceptions, and temporary articles.

Personal data processing must be carried out in compliance with the relevant regulations and announcements regarding KVKK (Law on the Protection of Personal Data), otherwise administrative fines, imprisonment, and compensation may be imposed.

The Personal Data Protection Board's decision dated July 19, 2018, with number 2018/88, regarding "Commencement Dates of the Registration Obligation," is presented for your information:

Considering Article 16(2) of Law No. 6698 on the Protection of Personal Data ("the Law"), which states: "Legal entities and individuals processing personal data must register with the Registry of Data Controllers before commencing data processing. However, the Board may, considering objective criteria to be determined by the Board, such as the nature of the personal data processed, the number of individuals affected, whether the data processing is based on the law, or whether the data is transferred to third parties, exempt certain entities from the obligation to register with the Registry of Data Controllers." Also considering Article 1, paragraph 2 of the Law's Provisional Article, which states: "Data controllers must register with the Registry of Data Controllers within the period determined and announced by the Board; "

- It is accepted that the obligation for data controllers, whether individual or corporate, with an annual number of employees exceeding 50 or a total annual financial balance exceeding 25 million TL, to register with the Data Controllers Registry began on October 1, 2018, and that a deadline of September 30, 2019, is granted to these data controllers to register with the Registry.
- It is accepted that the starting date for the obligation of real and legal entities residing abroad to register with the Data Controllers Registry is October 1, 2018, and that these data controllers are given until September 30, 2019, to register with the Registry.
- It is accepted that for real and legal entities who are data controllers and whose main activity is the processing of special-category personal data, and who have an annual number of employees less than 50 and a total annual financial balance less than 25 million TL, the obligation to register in the Data Controllers Registry has a starting date of January 1, 2019, and that these data controllers are given a deadline of March 31, 2020, to register in the Registry.
- It is accepted that the starting date for the obligation of data controllers from public institutions and organizations to register in the Data Controllers Registry is April 1, 2019, and that these data controllers are given until June 30, 2020, to register in the Registry.
- This decision will be published on the institution's website and in the Official Gazette.
The decision was made unanimously.

https://kvkk.gov.tr

This site sets no tracking or advertising cookies and loads nothing from other websites. We count page views anonymously, without cookies and without storing your IP address, to see which pages are used. You can opt out of the counting at any time.

Cookie Policy · GDPR Policy