KVKK

12301
PERSONAL DATA PROTECTION LAW
Law Number : 6698
Accepted Date: 24/3/2016
Published in the R. Newspaper: Date: 7/4/2016 Issue: 29677
Published Code: Arrangement: 5 Volume: 57
FIRST PART
Purpose, Scope and Definitions
Aim
ARTICLE 1- (1) The purpose of this Law is to process personal data, especially private life.
to protect the fundamental rights and freedoms of individuals, including privacy, and to process personal data.
to regulate the obligations of natural and legal persons and the procedures and principles to be followed.
Scope
ARTICLE 2- (1) The provisions of this Law apply to real persons whose personal data are processed and to
be a part of any data recording system that is fully or partially automated or
It applies to natural and legal persons who operate by non-automatic means, provided that
Definitions
ARTICLE 3- (1) In the implementation of this Law;
a) Explicit consent: On a specific subject, based on information and free will
declared consent,
b) Anonymization: Personal data cannot be used in any way, even by matching with other data.
making it impossible to be associated with an identified or identifiable natural person,
c) Chairman: Chairman of the Personal Data Protection Authority,
ç) Relevant person: The real person whose personal data is processed,
d) Personal data: Any information relating to an identified or identifiable natural person,
e) Processing of personal data: Fully or partially automatic or
obtained by non-automatic means, provided that it is part of any data recording system.
recording, storing, preserving, changing, rearranging,
disclose, transfer, take over, make available, classify or
all kinds of operations performed on the data, such as preventing its use,
f) Board: Personal Data Protection Board,
g) Institution: Personal Data Protection Authority,
ğ) Data processor: Personal data on behalf of the data controller based on the authority given by him.
the real or legal person who operates,
12302
h) Data recording system: Personal data is processed and structured according to certain criteria.
registration system,
ı) Data controller: Data logger, which determines the purposes and means of processing personal data.
The natural or legal person responsible for the establishment and management of the system,
means.
SECOND PART
Processing of Personal Data
General principles
ARTICLE 4- (1) Personal data can only be processed by the procedures and procedures stipulated in this Law and other laws.
can be processed in accordance with the principles.
(2) The following principles must be complied with in the processing of personal data:
a) Compliance with the law and honesty rules.
b) Being accurate and up-to-date when necessary.
c) Processing for specific, explicit and legitimate purposes.
ç) Being connected, limited and restrained with the purpose for which they are processed.
d) Keep for the period required by the relevant legislation or for the purpose for which they are processed.
not to be
Terms of processing personal data
ARTICLE 5- (1) Personal data cannot be processed without the explicit consent of the person concerned.
(2) In the presence of one of the following conditions, without seeking the explicit consent of the person concerned
It is possible to process personal data:
a) It is clearly stipulated in the laws.
b) Those who are unable to express their consent due to actual impossibility or
life or body of the person or another person whose legal validity is not recognized
necessary to preserve its integrity.
c) Provided that it is directly related to the establishment or performance of a contract,
It is necessary to process the personal data of the parties to the contract.
ç) It is mandatory for the data controller to fulfill its legal obligation.
d) The person concerned has been made public by himself.
e) Data processing is mandatory for the establishment, exercise or protection of a right.
f) Provided that it does not harm the fundamental rights and freedoms of the person concerned, the data controller
data processing is necessary for their legitimate interests.
Conditions for the processing of special categories of personal data
ARTICLE 6- (1) Race, ethnic origin, political thought, philosophical belief, religion, sect
or other beliefs, dress, association, foundation or union membership, health, sexual life,
data on criminal convictions and security measures, as well as biometric and genetic data
qualified personal data.
(2) Processing of sensitive personal data without the explicit consent of the person concerned is prohibited.
12303
(3) Personal data other than health and sexual life listed in the first paragraph,
may be processed without seeking the explicit consent of the person concerned, in the foreseeable circumstances. On health and sexual life
Personal data can only be used for the protection of public health, preventive medicine, medical diagnosis, treatment and
execution of care services, planning and management of health services and financing
persons or authorized institutions and organizations under the obligation to keep secrets.
may be processed without seeking the explicit consent of the person concerned.
(4) In the processing of special categories of personal data, sufficient
precautions must be taken.
Deletion, destruction or anonymization of personal data
ARTICLE 7- (1) Processed in accordance with the provisions of this Law and other relevant laws
personal data ex officio in the event that the reasons requiring its processing disappear.
or deleted, destroyed or anonymized by the data controller at the request of the data subject.
is brought.
(2) Other information regarding the deletion, destruction or anonymization of personal data.
the provisions of the laws are reserved.
(3) Regarding the deletion, destruction or anonymization of personal data
procedures and principles are regulated by regulation.
Transfer of personal data
ARTICLE 8- (1) Personal data cannot be transferred without the explicit consent of the person concerned.
(2) Personal data;
a) In the second paragraph of Article 5,
b) Provided that adequate measures are taken, in the third paragraph of Article 6,
In the event that one of the conditions specified is present, without the explicit consent of the person concerned.
transferable.
(3) Provisions in other laws regarding the transfer of personal data are reserved.
Transfer of personal data abroad
ARTICLE 9- (1) Personal data cannot be transferred abroad without the explicit consent of the person concerned.
(2) Personal data, in the second paragraph of Article 5 and the third paragraph of Article 6
the existence of one of the specified conditions and in the foreign country to which the personal data will be transferred;
a) The availability of adequate protection,
b) In the absence of adequate protection, in Turkey and in the relevant foreign country
data controllers must undertake in writing to provide adequate protection and that the permission of the Board must be obtained.
to be found,
may be transferred abroad without seeking the explicit consent of the person concerned, provided that the
(3) Countries with adequate protection are determined and announced by the Board.
12304
(4) The Board determines whether there is sufficient protection in the foreign country and whether the second paragraph (b)
whether it will be allowed in accordance with subparagraph;
a) International conventions to which Turkey is a party,
b) Reciprocity regarding data transfer between the country requesting personal data and Turkey
status,
c) Regarding each concrete personal data transfer, the nature of the personal data and the purpose of the processing
and its duration,
ç) The relevant legislation and practice of the country to which the personal data will be transferred,
d) Committed by the data controller in the country to which the personal data will be transferred.
measures,
to evaluate and, if needed, the opinion of the relevant institutions and organizations.
takes decision.
(5) Personal data, without prejudice to the provisions of international agreements,
In cases where the interest of the person concerned will be seriously harmed, only the relevant public institution
or by taking the opinion of its institution, with the permission of the Board.
(6) Provisions in other laws regarding the transfer of personal data abroad
reserved.
THIRD PART
Rights and Obligations
The obligation to inform the data controller
ARTICLE 10- (1) During the acquisition of personal data, the data controller or
authorized person, relevant persons;
a) Identity of the data controller and its representative, if any,
b) For what purpose the personal data will be processed,
c) To whom and for what purpose the processed personal data can be transferred,
ç) Method and legal reason for collecting personal data,
d) Other rights listed in Article 11,
responsible for providing information.
Rights of the person concerned
ARTICLE 11- (1) Everyone, by applying to the data controller;
a) Learning whether personal data is processed or not,
b) If personal data has been processed, requesting information about it,
c) The purpose of processing personal data and whether they are used in accordance with their purpose
learning not to use
ç) To know the third parties to whom personal data is transferred in the country or abroad,
d) In case of incomplete or incorrect processing of personal data, correcting them
don't want,
12305
e) Deletion or destruction of personal data within the framework of the conditions stipulated in Article 7
do not want to,
f) The transactions carried out pursuant to subparagraphs (d) and (e) are transferred to the third party to which the personal data is transferred.
requesting people to be notified,
g) By analyzing the processed data exclusively through automated systems
objecting to the emergence of a result against the person himself,
ğ) In case of loss due to unlawful processing of personal data
to demand compensation for the damage,
has rights.
Obligations regarding data security
ARTICLE 12- (1) Data controller;
a) To prevent the unlawful processing of personal data,
b) To prevent unlawful access to personal data,
c) To ensure the protection of personal data,
all necessary technical and administrative measures to ensure the appropriate level of security for
have to take measures.
(2) Data controller, another natural or legal person on behalf of the personal data
with these persons regarding the taking of the measures specified in the first paragraph.
jointly responsible.
(3) Data controller, in his own institution or organization, in accordance with the provisions of this Law.
It is obliged to make or have the necessary inspections made in order to ensure its implementation.
(4) Data controllers and data processors are entitled to collect the personal data they have learned in accordance with this Law.
They cannot disclose it to others in violation of its provisions and cannot use it for purposes other than processing. This
The obligation continues even after they leave office.
(5) Unlawful obtaining of processed personal data by others
In this case, the data controller informs the relevant person and the Board as soon as possible. board, need
In case of such a situation, it may announce this situation on its own website or by any other method it deems appropriate.
CHAPTER FOUR
Application, Complaint and Data Controllers Registry
Application to data controller
ARTICLE 13- (1) The person concerned shall submit his/her requests regarding the implementation of this Law in writing.
or by other methods to be determined by the Board, to the data controller.
(2) The data controller shall submit the requests included in the application as soon as possible and according to the nature of the request.
finalize it free of charge within thirty days at the latest. However, the process also has a cost.
If required, the fee in the tariff determined by the Board may be charged.
(3) The data controller accepts the request or rejects it by explaining its reason and gives its answer.
notifies the person concerned in writing or electronically. Acceptance of the request in the application
In the event of a request, the data controller will fulfill its requirements. Data controller of the application
In case of error, the fee will be returned to the person concerned.
12306
complaint to the board
ARTICLE 14- (1) If the application is rejected, the answer given is insufficient or
In case of not responding to the application in due time; the person concerned, the reply of the data controller
to the Board within thirty days from the date of learning and in any case within sixty days from the date of application.
can make a complaint.
(2) Pursuant to Article 13, no appeal can be made before the remedy has been exhausted.
(3) The right to compensation according to the general provisions of those whose personal rights are violated is reserved.
Procedures and principles of examination upon complaint or ex officio
ARTICLE 15- (1) The Board, upon complaint or ex officio, in case it learns about the alleged violation,
makes the necessary examination on the matters falling within its scope of duty.
(2) Article 6 of the Law on the Use of the Right to Petition dated 1/11/1984 and numbered 3071
Notifications or complaints that do not meet the conditions specified in the article will not be examined.
(3) Except for information and documents that are state secrets; data controller, Board, review
to send the requested information and documents within fifteen days, and when necessary
must allow for on-site inspection.
(4) Upon the complaint, the Board examines the request and gives an answer to the relevant parties. From the date of the complaint
If no response is received within sixty days from the date of receipt, the request is deemed to have been rejected.
(5) As a result of the examination made upon the complaint or ex officio, it is understood that the violation exists
The Board decides that the illegalities it detects are eliminated by the data controller.
and notifies the relevant parties. This decision shall be made without delay and within thirty days at the latest from the notification.
is fulfilled.
(6) Upon the complaint or as a result of the examination made ex officio, it is determined that the violation is widespread.
If it is determined, the Board takes a resolution on this matter and publishes this decision. Board, policy decision
may also take the opinions of the relevant institutions and organizations, if he/she needs it before taking it.
(7) The Board, in the event of irreparable or impossible damage and clearly unlawful
may decide to stop the processing of data or the transfer of data abroad.
Data Controllers Registry
ARTICLE 16- (1) Under the supervision of the Board, the Data are publicly disclosed by the Presidency.
Those responsible are kept in the Register.
(2) Natural and legal persons processing personal data, before starting the data processing.
Those responsible must be registered in the Registry. However, the nature and number of the personal data processed, the data
by the Board, such as the processing arising from the law or transferring it to third parties.
Data Controllers, by the Board, taking into account the objective criteria to be determined.
An exception may be made to the registration requirement.
(3) The application for registration in the Data Controllers Registry must be submitted with a notification containing the following:
makes:
a) Identity and address information of the data controller and its representative, if any.
b) The purpose for which personal data will be processed.
12307
c) Information about the data subject group and groups and the data categories of these persons.
descriptions.
ç) Recipient or recipient groups to whom personal data can be transferred.
d) Personal data intended to be transferred to foreign countries.
e) Measures taken regarding personal data security.
f) The maximum period required for the purpose for which personal data is processed.
(4) Changes in the information given pursuant to the third paragraph are promptly
reported to the Presidency.
(5) Other procedures and principles regarding the Data Controllers Registry shall be regulated by regulation.
CHAPTER FIVE
Offenses and Misdemeanors
Crimes
ARTICLE 17- (1) In terms of crimes related to personal data, dated 26/9/2004 and 5237
The provisions of Articles 135 to 140 of the Turkish Penal Code No.
(2) Contrary to the provision of Article 7 of this Law; does not delete personal data or
Those who do not make it anonymous are punished according to Article 138 of the Law No. 5237.
misdemeanors
ARTICLE 18- (1) This Law;
a) Those who do not fulfill the obligation of enlightenment stipulated in Article 10
from 5,000 Turkish lira to 100,000 Turkish lira,
b) To fulfill the obligations regarding data security stipulated in Article 12
from 15,000 Turkish liras to 1,000,000 Turkish liras for those who do not bring,
c) Those who do not fulfill the decisions given by the Board in accordance with Article 15
from 25,000 Turkish lira to 1,000,000 Turkish lira,
ç) Registration and notification to the Data Controllers Registry stipulated in Article 16
from 20,000 Turkish liras to 1,000,000 Turkish liras for those who violate their obligations.
until,
administrative fine is imposed.
(2) Administrative fines stipulated in this article are imposed on real persons who are data controllers and private
law applies to legal persons.
(3) Public institutions and organizations and public institutions of the actions listed in the first paragraph
upon the notification of the Board,
civil servants and other public officials working in the relevant public institutions and organizations and public
According to the disciplinary provisions about those who work in professional organizations
action is taken and the result is reported to the Board.
12308

CHAPTER SIX
Personal Data Protection Authority and Organization
Personal Data Protection Authority
ARTICLE 19- (1) In order to carry out the duties assigned by this Law, it has administrative and financial autonomy.
and the Personal Data Protection Authority, which has a public legal personality, was established.
(2) The Institution is related to the minister to be appointed by the President. (one)
(3) The headquarters of the institution is in Ankara.
(4) The Institution consists of the Board and the Presidency. The decision body of the institution is the Board.
Duties of the institution
ARTICLE 20- (1) The duties of the Institution are as follows:
a) To follow the practices and developments in the legislation, to evaluate and
to make suggestions, to conduct research and investigations or to have them made.
b) In case of need, public institutions and organizations, non-governmental
To cooperate with organizations, professional organizations or universities.
c) To monitor and evaluate international developments regarding personal data,
To cooperate with international organizations on issues, to participate in meetings.
ç) Submit the annual report to the Presidency of the Turkish Grand National Assembly on Human Rights.
To submit (…) (2) to the Review Commission. (2)
d) Fulfilling other duties assigned by law.
Personal Data Protection Board (3)
ARTICLE 21- (1) The Board shall carry out the duties and authorities given by this Law and other legislation on its own.
performs and uses independently under his/her responsibility. Regarding the matters falling within the scope of his duty
No organ, authority, authority or person can give orders, instructions, advice or suggestions to the Board.
(2) The Board consists of nine members. Five members of the Board are the Turkish Grand National Assembly, four members
He is elected by the President. (3)
(3) In order to become a member of the Board, the following conditions are sought:
a) To have knowledge and experience in the field of duty of the institution.
b) The first paragraph of Article 48 of the Civil Servants Law No. 657 dated 14/7/1965
To have the qualifications specified in sub-paragraphs (1), (4), (5), (6) and (7) of paragraph (A).
c) Not to be a member of any political party.
d) To have completed at least four years of higher education at the undergraduate level.
d) (Repealed: 2/7/2018-KHK-703/163 art.)
–––––––––––––––––
(1) With Article 163 of Decree Law No. 703 dated 2/7/2018, the phrase “with the Prime Ministry” in this paragraph
It has been changed to "with the minister appointed by the President".
(2) With Article 163 of the Decree Law No. 703 dated 2/7/2018, the “and to the Prime Ministry” in this paragraph
phrase is repealed.
(3) With the article 163 of the Decree Law No. 703 dated 2/7/2018, the “two
member of the President, two members of the Council of Ministers” and “four members of the President”
has been changed.
12309
(4) (Repealed: 2/7/2018-KHK-703/163 art.)
(5) The Turkish Grand National Assembly elects members to the Board in the following manner:
a) For the election, the number of members to be determined in proportion to the number of members of the political party groups is doubled.
solid candidates are nominated and the Board members are among these candidates, and the number of members per political party group
It is elected by the General Assembly of the Turkish Grand National Assembly on the basis of However, the political party
groups, on whom to vote in the elections to be held in the Turkish Grand National Assembly.
No meeting or decision can be made.
b) The election of the members of the Board is made within ten days after the candidates are determined and announced.
Combined ballot papers in separate lists for candidates nominated by political party groups
is arranged. Votes are cast by marking the special place opposite the names of the candidates. Political
of the members to be elected to the Board from the quotas of the party groups determined according to the second paragraph.
Votes given more than the number of votes are considered invalid.
c) Candidates as many as the number of vacant members who received the most votes in the election, provided that there is a quorum for the decision.
gets selected.
ç) Two months before the end of the term of office of the members; memberships for any reason.
In case of ejaculation, the Grand National Assembly of Turkey, on the date of ejaculation or
If the Assembly is in recess, elections are held within one month following the end of the recess with the same procedure. This
distribution of vacant memberships to political party groups in the elections, political party groups in the first election
Considering the number of members selected from the quota and the current ratio of political party groups
is done by.
(6) After the expiry of the term of office of one of the members elected by the President (…) (1)
forty-five days ago or in case of termination of duty for any reason,
It is notified to the Presidency (…)(1) by the Institution. Term of office of the members
A new member is elected one month before the deadline. In these memberships, before the expiry of the term of office, any
In the event of a vacancy due to any reason, an election is held within fifteen days from the notification. (one)
(7) The Board elects the Chairman and the Deputy Chairman from among its members. Chairman of the Board, Institution
is also its president.
(8) The term of office of the members of the Board is four years. A member whose term has expired can be re-elected. Task
The person elected to replace the member whose term of office ends for any reason before the expiry of the term,
completes the remaining time of the member.
(9) The elected members were presented before the First Presidency Board of the Court of Cassation, “I have committed my duty to the Constitution and
in accordance with the law, with an understanding of complete impartiality, honesty, fairness and justice.
I swear on my honor and honour.” they take an oath. to the Supreme Court
An application for an oath is considered a hasty job.
––––––––––––––––
(1) With Article 163 of Decree Law No. 703 dated 2/7/2018, the “or Council of Ministers” in this paragraph
and “or the Prime Ministry to be submitted to the Council of Ministers” were removed from the text of the article.
12310
(10) Unless the members of the Board are based on a special law, their official duties in the Board
It cannot take on any official or private duties other than the execution of associations, foundations, cooperatives and similar
cannot be a manager in places, engage in trade, engage in self-employment activities,
They cannot act as arbitrators or experts. However, the members of the Board shall perform their duties in a manner that does not hinder their primary duties.
can publish for scientific purposes, give lectures and conferences and with the copyrights arising from them.
They can receive tuition and conference fees.
(11) Investigations regarding crimes alleged to have been committed by members due to their duties
On the Trial of Civil Servants and Other Public Officials, dated 2/12/1999 and numbered 4483
It is done according to the law and the permission to investigate them is given by the President. (one)
(12) In the disciplinary investigation and prosecution to be made against the members of the Board, 657
The provisions of Law No.
(13) Board members cannot be dismissed for any reason before their term expires.
Board members;
a) It is later understood that they do not meet the requirements for being elected,
b) Conviction given to them for the crimes they have committed in relation to their duties
finalization of the decision,
c) It is definitively determined by the health board report that they cannot fulfill their duties.
to be made,
ç) They can perform their duties for fifteen days without leave, excuse and uninterrupted, or in total in one year.
it is determined that they do not continue for thirty days,
d) A total of three Boards without permission and excuse within a month, and a total of ten Boards within a year.
it is determined that they did not attend the meeting,
In such cases, their membership ends with the decision of the Board.
(14) As long as those elected to the Board serve in the Board, their previous duties
ties are terminated. Those elected to membership while being a public officer, meet the conditions for entry to civil service.
on the expiration of their term of office or their request to resign, provided that they do not lose their
the competent authority to appoint if they are found and apply to their former institutions within thirty days.
are appointed to a suitable staff within one month by the Until the appointment is made,
All kinds of payments they receive shall continue to be paid by the Institution. A
among those who do not work in a public institution, they are selected for membership and their duty is terminated as stated above.
All kinds of payments they receive until they start any task or job.
It continues to be paid by the Institution and those whose membership is terminated in this way are paid by the Institution.
The payment to be made cannot exceed three months. The time they spend in the Institution, their personnel and other rights
It is deemed to have been passed in the previous institutions or organizations in terms of
Duties and powers of the board
ARTICLE 22- (1) The duties and powers of the Board are as follows:
a) To ensure that personal data is processed in accordance with fundamental rights and freedoms.
b) To decide on the complaints of those who claim that their rights regarding personal data have been violated.
connect.
––––––––––––––––
(1) With Article 163 of Decree Law No. 703 dated 2/7/2018, the phrase “Prime Minister” in this paragraph
Changed to "President".
12311
c) Upon a complaint or ex officio in case of learning about the alleged violation,
To examine whether personal data is processed in accordance with the law, and
to take temporary measures in this regard when necessary.
ç) To determine the adequate measures sought for the processing of sensitive personal data.
d) To ensure that the Data Controllers Registry is kept.
e) Necessary regulatory affairs regarding the duties of the Board and the functioning of the Agency.
make transactions.
f) To take regulatory action in order to determine the obligations regarding data security.
g) Regarding the duties, powers and responsibilities of the data controller and its representative
take regulatory action.
ğ) To decide on the administrative sanctions stipulated in this Law.
h) Prepared by other institutions and organizations and containing provisions regarding personal data
to give an opinion on draft legislation.
i) The Institution; to decide on the strategic plan, aims and objectives, service quality
set standards and performance criteria.
i) The budget proposal prepared in accordance with the strategic plan and objectives and targets of the institution.
discuss and decide.
j) Institution's performance, financial situation, annual activities and matters needed
Approving and publishing draft reports on
k) Discussing and deciding on the proposals on the purchase, sale and lease of immovable.
connect.
l) To perform other duties assigned by law.
Working principles of the board
ARTICLE 23- (1) The Chairman determines the meeting days and agenda of the Board. Minister
may call an extraordinary meeting of the Board when necessary.
(2) The Board convenes with at least six members, including the chairman, and with the absolute majority of the total number of members.
takes a decision. Board members cannot vote abstaining.
(3) Board members; themselves, blood to the third degree and bereaved to the second degree
concerning their relatives, adopted children, and their spouses even if the marriage bond between them has been terminated.
cannot participate in the meeting and voting on the issues.
(4) The members of the Board have learned the secrets of the related and third parties during their work.
they cannot disclose it to anyone other than the authorities authorized by law in this regard, and for their own benefit
they cannot use it. This obligation continues even after they leave office.
(5) The matters discussed in the Board are recorded in the minutes. Decisions and grounds for dissenting votes, if any.
written within fifteen days at the latest. The Board makes the decisions it deems necessary to the public.
announces.
(6) Unless otherwise agreed, discussions at Board meetings are confidential.
(7) Working procedures and principles of the Board, writing of resolutions and other matters shall be regulated by regulation.
is arranged.
12312
Minister
ARTICLE 24- (1) The Chairman is the highest supervisor of the Institution in the capacity of the Chairman of the Board and the Institution.
Institutional services to the legislation, the Institution's goals and policies, strategic plan, performance
organizes, executes and service units in accordance with the criteria and service quality standards
provides coordination between
(2) The President is responsible for the general management and representation of the Institution. This responsibility is
organization, execution, supervision, evaluation and, where necessary,
public disclosure includes its duties and powers.
(3) The duties of the President are:
a) To conduct the meetings of the Board.
b) Notification of Board decisions and public announcement of those deemed necessary by the Board.
ensure and monitor their implementation.
c) To appoint the Vice President, the heads of departments and the Institution personnel.
ç) To present the suggestions coming from the service units to the Board by giving their final shape.
d) Ensuring the implementation of the strategic plan, in line with the service quality standards,
create resources and work policies.
e) With the annual budget of the Institution in accordance with the determined strategies, annual goals and targets.
preparing financial statements.
f) In a harmonious, efficient, disciplined and regular manner, the Board and service units
To provide coordination for work.
g) To carry out the relations of the institution with other institutions.
ğ) To determine the area of duty and authority of the personnel authorized to sign on behalf of the President of the Institution.
h) To perform other duties related to the management and operation of the Institution.
(4) In the absence of the President of the Institution, the Vice President shall deputize for the President.
Composition and duties of the Presidency
ARTICLE 25- (1) Presidency; It consists of the Vice President and service units.
The Presidency is a service organization whose duties listed in the fourth paragraph are organized in the form of departments.
through its units. The number of heads of departments cannot exceed seven.
(2) A President shall be appointed by the President to assist him in his duties relating to the Corporation.
Assistant is appointed.
(3) Vice President and heads of departments; at least four years of higher education institution
graduates are appointed by the President from among those who have served in the public service for ten years.
(4) The duties of the Presidency are as follows:
a) Keeping the Data Controllers Registry.
b) To carry out the bureau and secretariat operations of the Institution and the Board.
c) Representing the Institution through lawyers in lawsuits and enforcement proceedings to which the Institution is a party.
to follow the lawsuits or have them made, to carry out legal services.
12313
ç) To carry out the personnel procedures of the members of the Board and those working in the Institution.
d) To perform the duties assigned to the financial services and strategy development units by law.
e) Establishing an information system in order to carry out the business and transactions of the Institution, and
ensure its use.
f) Draft reports on the annual activities of the Board or on the matters needed.
to prepare and present to the Board.
g) To prepare the strategic plan of the institution.
ğ) To determine the personnel policy of the institution, to determine the career and training plans of the personnel.
prepare and implement.
h) The appointment, transfer, discipline, performance, promotion, retirement and similar transactions of the personnel.
execute.
ı) To determine the ethical rules to be followed by the personnel and to provide the necessary training.
i) Within the framework of the Public Financial Management and Control Law No. 5018 dated 10/12/2003
Any kind of purchase, rental, maintenance, repair, construction, archive, health, social
and performing similar services.
j) To keep the records of the movable and immovable properties of the Institution.
k) To perform other duties assigned by the Board or the President.
(5) Service units and the working procedures and principles of these units, as specified in this Law.
by the President upon the proposal of the Authority in accordance with the field of activity, duties and authorities.
determined by the regulation enacted. (one)
Personal Data Protection Specialist and assistant specialists
ARTICLE 26- (1) Personal Data Protection Specialist and Protection of Personal Data in the Institution
Assistant Specialist can be employed. Of these, additional article 41 of the Law No. 657
For one time only for those appointed to the Personal Data Protection Expert staff within the framework of
A degree increase is applied.
Provisions regarding personnel and personal rights
ARTICLE 27- (1) Personnel of the Authority, except for the issues regulated by this Law,
It is subject to law.
(2) Law No. 375 of 27/6/1989 to the Chairman and members of the Board and the personnel of the Authority.
In accordance with the additional article 11 of the Decree-Law, the financial and
Payments made within the scope of social rights are paid within the framework of the same procedures and principles. precedent
Those who are not subject to tax and other legal deductions from payments made to personnel are also subject to this Law.
not subject to taxes and other deductions.
(3) Board Chairman and members and Institution personnel
Subparagraph (c) of the first paragraph of Article 4 of the Insurance and General Health Insurance Law
subject to its provisions. Regarding the retirement rights of the Chairman and members of the Board and the Institution personnel
It is also considered equivalent to the personnel determined as a precedent. Article 4 of Law No. 5510
–––––––––––––––––
(1) With Article 163 of the Decree Law No. 703 dated 2/7/2018, the “Council of Ministers” in this paragraph
by decision of the President” was replaced by “by the President”.
12314
Among those appointed to the Chairman and membership of the Board while insured under subparagraph (c) of the first paragraph
those who have terminated their duties or who wish to leave their duties
The elapsed service periods are taken into account in the determination of the earned right monthly, degree and levels.
During these duties, they are covered by the provisional article 4 of the Law No. 5510.
The term of the employees who have passed in these duties, the authority compensation and the representation compensation must be paid.
is considered time. 4 of Law No. 5510 in public institutions and organizations
While insured under subparagraph (a) of the first paragraph of the article, the Chairman and members of the Board
severance pay for those appointed
or termination of employment compensation. In this case, severance pay or employment
The terms of service for which the end of compensation must be paid, the Chairman of the Board and the membership of the Board.
are combined with the terms of service and the retirement bonus is considered as the period to be paid.
(4) In public administrations within the scope of central government, social security institutions,
local administrations, administrations affiliated to local administrations, local administration unions, revolving fund
institutions, funds established by laws, institutions with public legal personality,
More than fifty percent of them are in public institutions, economic state enterprises and public economic enterprises.
institutions and their subsidiaries, officials in the institutions and other public
monthly, with the consent of their institutions, judges and prosecutors with their own consent,
appropriations, all kinds of raises and compensations and other financial and social rights and aids by their institutions.
may be appointed to the Institution temporarily, provided that the payment is made. The demands of the institution in this regard,
are finalized primarily by the relevant institutions and organizations. Personnel assigned in this way,
considered to be on paid leave from their institutions. The involvement of these personnel in their civil service as long as they are on leave
and personal rights continue, these periods are also taken into account in their promotion and retirement, and
elevations are made on time without the need for any other operation. Within the scope of this article
The periods of time spent by the appointed persons in the Institution shall be deemed to have been spent in their own institutions. This
Number of persons appointed Personal Data Protection Specialist and Personal Data Protection
Assistant Expert cannot exceed ten percent of the total number of staff and the assignment period is two years.
cannot pass. However, in case of need, this period can be extended in one-year periods. (one)
(5) The titles and numbers of the staff to be employed in the Institution, numbered (I) in the annex
shown in the chart. Not to exceed the total number of staff, dated 13/12/1983 and numbered 190
Staff in the tables annexed to the Decree-Law on General Staff and Procedure
changing titles and degrees, adding new titles and vacancies, limited to their titles.
Cancellation of positions is made by the decision of the Board.
CHAPTER SEVEN
Miscellaneous Provisions
Exceptions
ARTICLE 28- (1) The provisions of this Law shall not be applied in the following cases:
a) Not to give personal data to third parties and regarding data security
provided that the obligations are complied with, by real persons completely with himself or with the same
processing within the scope of activities related to family members living in the residence.
_________________
(1) With the 119th article of 28/11/2017 dated and 7061 numbered Law, “other public
"consent of their institutions", judges and prosecutors
their consent” has been added.
12315
b) Research, planning by anonymizing personal data with official statistics
and processing for statistical purposes.
c) Personal data shall include national defense, national security, public security, public order,
not to violate economic security, privacy or personal rights or to constitute a crime.
for purposes of art, history, literature or science, or freedom of expression
scope of processing.
ç) Personal data protect national defense, national security, public security, public order.
or public institution authorized by law to ensure economic security.
within the scope of preventive, protective and intelligence activities carried out by
processing.
d) Regarding the investigation, prosecution, trial or execution of personal data
processed by judicial authorities or enforcement authorities.
(2) Data provided that it is in accordance with the purpose and basic principles of this Law and is proportional
10th, which regulates the liability of the responsible person to inform, to demand the compensation of the damage.
Registration in the 11th and Data Controllers Registry, which regulates the rights of the data subject, except for the right of
Article 16, which regulates the liability, shall not be applied in the following cases:
a) Personal data processing is necessary for the prevention of crime or criminal investigation.
to be.
b) Processing of personal data made public by the person concerned.
c) Personal data processing based on the authority given by the law and authorized public authorities
institutions and organizations and professional organizations in the nature of public institutions, auditing or
necessary for the execution of regulatory duties and for disciplinary investigation or prosecution.
to be.
ç) State economics regarding the budget, tax and financial issues of personal data processing.
and necessary for the protection of its financial interests.
Institution's budget and revenues
ARTICLE 29- (1) The budget of the Institution is determined in accordance with the procedures and principles determined in the Law No. 5018.
prepared and accepted.
(2) The revenues of the institution are as follows:
a) Treasury aids to be made from the general budget.
b) Revenues from movable and immovable properties belonging to the Institution.
c) Donations and aids received.
ç) Incomes from the evaluation of their income.
d) Other income.
Amended and added provisions
ARTICLE 30- (1) (Related to the Law No. 5018 dated 10/12/2003 and replaced
processed.)
(2) to (5) – (Related to Law No. 5237 of 26/9/2004 and has been replaced.)
(6) (Related to the Health Services Basic Law No. 3359 dated 7/5/1987 and
processed instead.)
12316
(7) (Organization of the Ministry of Health and its Affiliates, dated 11/10/2011 and numbered 663
It is related to the Decree-Law on the Law and its Duties.)
regulation
ARTICLE 31- (1) Regulations regarding the implementation of this Law shall be issued by the Authority.
is put into effect.
Transitional provisions
PROVISIONAL ARTICLE 1- (1) Within six months from the date of publication of this Law, Article 21
Members of the Board are elected in accordance with the procedure stipulated in the article and the Presidency organization is formed.
(2) Data controllers, within the period determined and announced by the Board,
Responsible Persons must be registered in the Registry.
(3) Personal data processed before the publication date of this Law,
shall be brought into compliance with the provisions of this Law within two years from the date of Contrary to the provisions of this Law
Personal data that are determined to be confidential are immediately deleted, destroyed or anonymized. However, this
The consents obtained in accordance with the law before the publication date of the law, on the contrary, within one year.
In case the declaration of will is not made, it is considered in accordance with this Law.
(4) The regulations stipulated in this Law are valid for one year from the date of publication of this Law.
into effect.
(5) Within one year from the date of publication of this Law, public institutions and organizations
a senior manager to coordinate the implementation of this Law.
determined and reported to the Presidency.
(6) First elected President, Second President and two members determined by lot for six years; the other five members
He serves for four years.
(7) Until the budget is allocated to the Institution;
a) The expenses of the Institution are met from the budget of the Prime Ministry.
b) Buildings, tools, equipment, furnishings and
All necessary support services such as hardware are provided by the Prime Ministry.
(8) Secretariat services until the service units of the institution become operational
It is carried out by the Prime Ministry.
PROVISIONAL ARTICLE 2- (Annex: 28/11/2017-7061/120 art.)
(1) Political sciences, economics and administrative sciences, economics, which have at least four years of undergraduate education,
law and business faculties, engineering faculties electronics, electrical-electronics,
from the departments of electronics and communication, computer, information systems engineering or
higher education at home and abroad, the equivalence of which is accepted by the Council of Higher Education
from graduates of their institutions; profession entered with a special competition exam for the profession and for a certain period of time
After the in-house training and a special proficiency exam, Article 36 of the Law No. 657 “Common
Regarding the titles specified in subparagraph (11) of paragraph (A) of the section titled "Provisions"
appointed to the cadres belonging to the central organizations of the institutions and excluding the unpaid leave periods in these cadres.
Those who have been at least two years and those who have been in teaching staff, Foreign Language Knowledge
To have received at least seventy points from the Placement Exam and to be over the age of forty as of the date of appointment.
within one year from the effective date of this article, provided that
They can be appointed as Data Protection Specialists. The number of those to be appointed in this way cannot exceed fifteen.
12317
Force
ARTICLE 32- (1) This Law;
a) Articles 8, 9, 11, 13, 14, 15, 16, 17 and 18
six months after its publication,
b) Other articles on the date of publication,
enters into force.
Executive
ARTICLE 33- (1) The provisions of this Law are executed by the Council of Ministers.
SCHEDULE NO (I)
PERSONAL DATA PROTECTION INSTITUTION STAFF LIST
CLASS TITLE GRADE TOTAL
GİH Vice President 1 1
Head of GİH Department 1 7
GİH Legal Counsel 1 1
GİH Legal Counsel 3 3
AH Lawyer 6 4
GİH Personal Data Protection Specialist 5 10
GİH Personal Data Protection Expert 7 20
GİH Assistant Personal Data Protection Expert 9 60
GİH Financial Services Specialist 6 2
GİH Financial Services Assistant Specialist 9 2
GİH Officer 5 5
GİH Officer 7 5
GİH Officer 9 5
GİH Officer 11 5
GİH Officer 13 5
GİH Computer Operator 7 5
GİH Data Preparation and Control Operator 6 5
GİH Data Preparation and Control Operator 7 5
GİH Data Preparation and Control Operator 8 5
GİH Data Preparation and Control Operator 9 5
GİH Data Preparation and Control Operator 10 5
GİH Secretary 5 3
GİH Secretary 8 7
GİH Central Officer 9 1
GİH Driver 11 4
TH Technician 6 3
YH Assistant Technician 9 2
YH Maid 11 10
TOTAL 195
12318
ADDITIONAL AND AMENDMENT TO THE LAW NO 6698
CANCELLATION BY LEGISLATION OR CONSTITUTIONAL COURT
THE DATE OF ENTRY INTO FORCE OF THE PROVISIONS
SHOW LIST
changing
of the Law/Decree Law/
Abrogated Constitution
court of law
of your decision
Its number
Amending the Law No. 6698 or
canceled items
Effective Date
7061 27, PROVISIONAL ARTICLE 2 5/12/2017
Decree/703
19, 20, 21, 25
together on 24/6/2018
Made in Turkey Big
National Assembly and
Presidency
as a result of the elections
President's
he took his oath
on the date (9/7/2018)