TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws The Right to Protection of Personal Data The right to protection of personal data is regulated under the Constitution of the Republic of Türkiye (the “Constitution”) as an individual right. According to Article 20 (3) of the Constitution, the right to protection of personal data includes the right to: • be informed about the processing of personal data; • have access to personal data; • rectification or deletion of personal data; and • be informed about whether personal data is used in accordance with the appropriate purposes. According to the same Article, personal data may be processed if the processing is allowed by the law, or if the data subject gives explicit consent. The Article finally states that the procedures and principles of processing personal data must be regulated by law. The Turkish Data Protection Law Pursuant to the Constitution, the Turkish Data Pro - tection Law (DP Law) was enacted, which is the first general law that regulates the rules for processing personal data in Türkiye. It entered into force on 7 April 2016. Although it came into force only one month before the European Union General Data Protection Regulation (GDPR), the DP Law was drafted considering only EU Directive 95/46/EC. Currently, efforts are underway to align the DP Law with the GDPR. As part of these efforts, the Law on Amendments to the Criminal Pro - cedure Law and Certain Laws, which also includes amendments to the DP Law (DP Law Amendments) was published on 12 March 2024. Upon the entry into force of the DP Law Amendments on 1 June 2024, these efforts were followed by the publication of the By-law on the Procedures and Prin - ciples Regarding the Transfer of Personal Data Abroad (By-law on Data Transfers Abroad) and the Guidelines on the Transfer of Personal Data Abroad (Guidelines on Transfers Abroad), refer to the European Data Pro -
tection Board’s (EDPB) guidelines in interpreting the new cross-border transfer rules. The DP Law does not expressly regulate its territo - rial scope. Nevertheless, the Turkish Data Protection Authority (DPA) has consistently taken the position that the DP Law may apply to data controllers estab - lished outside Türkiye where certain criteria are met. Although these criteria are not explicitly set out in the legislation, they can be inferred from the DPA’s deci - sions. In certain decisions, the DPA adopts an effects- based approach, pursuant to which the DP Law is applicable where processing activities are carried out or produce effects in Türkiye. In other instances, the DPA has also applied a targeting-based approach, where the DP Law applies when individuals in Tür - kiye are targeted through the provision of services or profiling activities. The DP Law establishes a framework by outlining the general obligations and principles for data process - ing activities. Its implementation is further supported by secondary legislation, resolutions and guidelines issued by the DPA, including: • the By-law on the Deletion, Destruction, or Anonymisation of Personal Data (By-law on the Disposal of Personal Data); • the By-law on the Registry of Controllers; • the By-law on Data Transfers Abroad; • the Communique on Principles and Procedures to Be Followed in Fulfilment of the Obligation to Inform (Communique on Obligation to Inform); and • the Communique on Principles and Procedures for The Turkish Cybersecurity Law (Cybersecurity Law) entered into force on 19 March 2025. Cybersecurity Law introduces a comprehensive legal framework governing cybersecurity in Türkiye and aims to estab - lish a centralised regulatory structure in a field that was regulated through dispersed legal instruments and sector-specific rules. Before the Cybersecurity Law, cybersecurity obliga - tions were addressed through various instruments which primarily applied to public institutions and criti - the Request to Controllers. Turkish Cybersecurity Law
512 CHAMBERS.COM
Powered by FlippingBook