Law No. 6698 on the Protection of Personal Data imposes on every data controller that processes personal data an obligation to inform the data subject when obtaining the data. This obligation applies in all cases, whether or not the legal basis for the processing is explicit consent.

The content of the information

Under Art. 10 of the Law, the data subject must be given at least the following information:

• The identity of the data controller and of its representative, if any
• The purpose for which the personal data will be processed
• To whom and for what purpose the processed data may be transferred
• The method and legal basis of the collection of personal data
• The data subject’s rights listed in Art. 11 of the Law

Informing is not the same as explicit consent

Informing is an act of providing information; explicit consent, by contrast, is consent relating to a specific matter, based on information and given of one’s own free will. Under the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, these two acts must be carried out separately. Placing a consent checkbox inside the information notice, or tying the two texts to a single signature, breaches this rule.

The rights of the data subject

Under Art. 11 of the Law, everyone has the following rights in relation to data concerning them:

• To learn whether personal data is being processed and, if so, to request information about it,
• To learn the purpose of the processing and whether the data is being used in accordance with that purpose,
• To know the third parties to whom the data has been transferred, in Türkiye or abroad,
• To request rectification if the data has been processed incompletely or inaccurately, and erasure or destruction under the conditions laid down in the Law,
• To object to a result to their detriment arising from analysis exclusively by automated systems,
• To claim compensation for damage suffered as a result of unlawful processing.

These rights are exercised by applying to the data controller.

Time limits for applications and complaints

• The data controller concludes the application as soon as possible and at the latest within thirty days (Art. 13). As a rule, this is free of charge; if the process entails an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board.
• If the application is rejected, the response is found insufficient or no response is given in time, the data subject may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any event within sixty days of the date of application (Art. 14).
• A complaint cannot be lodged with the Board before the remedy of applying to the data controller has been exhausted.

Consequences of breaching the obligation

A data controller that fails to fulfil the obligation to inform is subject to an administrative fine under Art. 18 of the Law. The amounts of the fines are updated every year by the revaluation rate.