🇹🇷Law on the Protection of Personal Data No. 6698
Law on the Protection of Personal Data No. 6698
Law No. 6698 governs the processing of personal data of natural persons and applies to natural and legal persons that process those data wholly or partly by automatic means or as part of a filing system.
Core controller duties
Principles and grounds: Articles 4-6 require fair and lawful processing, accuracy, specified purposes, relevance, limited retention, a processing condition and the amended conditions for special categories.
Deletion and rights: Article 7 requires deletion, destruction or anonymisation when processing grounds cease. Articles 10-11 require notice and provide access, correction, deletion, objection and compensation-related rights. Article 13 gives the controller 30 days to answer an application.
Security and incidents: Article 12 requires appropriate technical and organisational measures, processor oversight and notification to the person and Board as soon as possible after unlawful acquisition. The Law itself does not state a 72-hour deadline.
Transfers and registration: The amended Article 9 provides adequacy, approved appropriate safeguards and limited derogations; standard contracts must be notified to the Authority within five business days. Article 16 governs the Data Controllers Registry.
Before making personal data accessible abroad, record the Article 9 route, complete the required instrument and make any mandatory standard-contract notification within five business days.
Articles 4-7 - principles, processing conditions, special categories and deletion.
Articles 9-13 - transfers, notices, rights, security and applications.
Article 16 - Data Controllers Registry.