TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Kübra İslamoğlu Bayer, Simge Yüce and Yiğit Aktimur, YAZICIOGLU Legal
The Course of an Investigation The DPA may request information and/or docu - ments from controllers during its investigations. Controllers are required to provide requested information and/or documents within 15 days unless they constitute a state secret. The DPA may also request additional information and/or documents and conduct an on-site inspection during an investigation. Administrative Fines The DP Law outlines five types of violations, each subject to administrative fines that are adjusted annually. As of 2025: • failure to inform data subjects of process - ing activities (between TRY68,083 and TRY1,362,021); • failure to take the necessary technical and organisational measures (interpreted very broadly, including unlawful data transfer abroad and breach of fundamental principles) (between TRY204,285 and TRY13,620,402); • failure to comply with the decisions issued by the DPA (between TRY340,476 and TRY13,620,402); • failure to comply with the obligation to regis - ter with VERBIS and failure to submit informa - tion to VERBIS (between TRY272,380 and TRY13,620,402); and • failure to notify the DPA within five business days following the signature of the standard contracts (SCCs) (between TRY71,965 and TRY1,439,300). Unlike other failures stipulated in the DP Law, for which only the controller is responsible, both controllers and processors can be held liable for failing to notify the DPA regarding SCCs. As per the Misdemeanours Law, the DPA must consider the severity of the breach, the fault of
the breaching party, and the party’s economic condition when determining fines. Administrative Orders The DPA may also order controllers to bring their processing activities into compliance with the DP Law. When the DPA issues such an order, this decision must be implemented without any delay and, at the latest, within 30 days upon receipt of the notification by the controller. The DPA is also entitled to cease certain person - al data processing activities or transfers abroad if it finds that such activities result in damages that are difficult or impossible to compensate for and if the act is clearly unlawful. Appeal Mechanisms Controllers have the right to appeal against the DPA’s decisions. They may object to such deci - sions before the administrative courts within 60 days of receiving the DPA’s decision. The decisions of the administrative courts can be appealed to the Regional Administrative Courts, and the decisions of the Regional Administrative Courts can be further appealed to the Council of State, provided that the administrative fine exceeds the applicable thresholds. On the other hand, if the DPA’s decision includes only an administrative measure rather than an administrative fine, decisions of both the admin - istrative courts and Regional Administrative Courts can be appealed, regardless of the rel - evant minimum thresholds. 1.4 Data Protection Fines in Practice In recent years, the DPA has been reluctant to publish its decisions. Practitioners often learn about these decisions through press coverage
478 CHAMBERS.COM
Powered by FlippingBook