IN FULFILLING THE OBLIGATION OF INFORMATION
COMMUNIQUE ON THE PROCEDURES AND PRINCIPLES TO BE FOLLOWED
Purpose and scope
ARTICLE 1 – (1) The purpose of this Communiqué is to determine the procedures and principles to be complied with within the scope of the obligation to inform data controllers or their authorized persons pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 dated 24/3/2016.
Base
ARTICLE 2 – (1) This Communiqué has been prepared based on subparagraphs (e) and (g) of the first paragraph of Article 22 of the Personal Data Protection Law No. 6698.
Definitions
ARTICLE 3 – (1) In this Communiqué;
a) Recipient group: The category of natural or legal persons to whom personal data are transferred by the data controller,
b) Relevant person: The natural person whose personal data is processed,
c) Law: Law No. 6698 on the Protection of Personal Data, dated 24/3/2016,
ç) Board: Personal Data Protection Board,
d) Institution: Personal Data Protection Authority,
e) Registry: Data Controllers Registry kept by the Presidency,
f) Data recording system: Any environment containing personal data processed by fully or partially automatic means or non-automatic means provided that it is part of any data recording system,
g) Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,
ğ) Data controller representative: A legal entity resident in Türkiye or a natural person who is a citizen of the Republic of Türkiye and is authorized to represent data controllers who are not resident in Turkey on the matters specified in the second paragraph of Article 11 of the Regulation on Data Controllers Registry published in the Official Gazette dated 30/12/2017 and numbered 30286.
expresses .
(2) For definitions not included in this Communiqué, the definitions in the Law shall apply.
Scope of the obligation to inform
ARTICLE 4 – (1) According to Article 10 of the Law, data controllers or their authorized persons must inform relevant persons when collecting personal data. In fulfilling this obligation, the information provided by data controllers or their authorized persons must, at a minimum, include the following:
a) The identity of the data controller and its representative, if any,
b) The purpose for which personal data will be processed,
c) To whom and for what purpose personal data may be transferred,
ç) The method and legal basis for collecting personal data,
d) Other rights of the relevant person listed in Article 11 of the Law.
Procedures and principles
ARTICLE 5 – (1) The following procedures and principles must be followed when fulfilling the obligation to inform by the data controller or the person authorized by him/her, whether verbally, in writing, using physical or electronic media such as voice recording or call center:
a) The obligation to inform must be fulfilled in all cases where personal data is processed based on the explicit consent of the relevant person or other processing conditions in the Law.
b) When the purpose of processing personal data changes, the obligation to inform for this purpose must also be fulfilled before the data processing activity.
c) If personal data is processed for different purposes in different units of the data controller, the obligation to inform must be fulfilled separately for each unit.
ç) In case of an obligation to register with the Registry, the information given to the relevant person within the framework of the obligation to inform must be compatible with the information disclosed to the Registry.
d) Fulfillment of the obligation to inform is not dependent on the request of the relevant person.
e) The burden of proof that the obligation to inform has been fulfilled rests with the data controller.
f) If personal data processing is carried out based on explicit consent, the obligation to inform and the process of obtaining explicit consent must be fulfilled separately.
g) The purpose of processing personal data to be disclosed within the scope of the disclosure obligation must be specific, clear, and legitimate. When fulfilling the disclosure obligation, general and vague expressions should not be used. Expressions that suggest that personal data may be processed for other purposes that may arise should not be used.
ğ) Within the scope of the obligation to inform, the notification to the relevant person must be made using understandable, clear and plain language.
h) The "legal reason" in subparagraph (ç) of the first paragraph of Article 10 of the Law refers to the processing conditions specified in Articles 5 and 6 of the Law, based on which personal data is processed within the scope of the obligation to inform. The legal reason must be clearly stated when fulfilling the obligation to inform.
ı) Within the scope of the obligation to inform, the purpose of transferring personal data and the recipient groups to be transferred must be specified.
i) Within the scope of the obligation to disclose, it must be clearly stated whether personal data is obtained fully or partially by automatic means or non-automatic means provided that it is part of the data recording system.
j) While fulfilling the obligation to inform, incomplete, misleading and incorrect information should not be included.
Obligation to inform if personal data is not obtained from the relevant person
ARTICLE 6 – (1) If personal data is not obtained from the relevant person;
a) Within a reasonable period of time after the personal data is obtained,
b) If personal data will be used for communication purposes with the relevant person, during the initial communication,
c) If personal data is to be transferred, at the latest at the time of the first transfer of personal data
The obligation to inform the relevant person must be fulfilled.
Effectiveness
ARTICLE 7 – (1) This Communiqué shall enter into force on the date of its publication.
Execution
ARTICLE 8 – (1) The President of the Personal Data Protection Authority shall enforce the provisions of this Communiqué.