Turkey Announces Rules and Processes for Data Subjects to Exercise their Rights, Plus Corresponding Requirements for Data Controllers

Turkey has announced rules and processes for data subjects to exercise their rights regarding personal data, as well as corresponding requirements for data controllers which process the information. Accordingly, data subjects can apply to data controllers via a range of methods, provided the application includes certain specified information. Minimum requirements have also been announced for data controllers’ response and related fees.

The Communiqué on Principles and Procedures for Application to Data Controller (“Communiqué“) was published in Official Gazette number 30356 on 10 March 2018, entering into effect on the same date.

Notable provisions in the Communiqué include:

• Data subjects can apply to the data controller via:
  • Writing to the postal address of the data controller.
  • Secure electronic signature to registered e-mail address of the data controller.
  • Mobile signature.
  • e-mail from e-mail addresses of the data subjects which are registered in the data controller’s system to the data controller’s e-mail address.
  • Software or applications developed for this purpose.
• Detailed rules for the information which must be included in:
  • The data subject’s application, such as:
    • Name, surname and signature, if the application is made in writing.
    • Turkish ID number (for Turkish citizens).
    • Nationality, passport number or identity number, (for non-Turkish data subjects).
    • Residential or work address for notification.
    • E-mail address (if any), phone and fax number.
    • Subject of the application.
• The data controller’s response, such as:
  • The matters mentioned under the application.
  • Information about the data controller or its representative.
  • Explanations about the data controller related to the application.
• For written applications, the application date is the date which the related document was notified to the data controller or its representative.
• For applications made by other methods defined in the Communiqué, the application date is the date which the application reached the data controller.
• If the response exceeds ten pages, the data controller can charge 1 Turkish Lira per page.
• If the response is given through a data recorder (such as CD, flash memory) then the data controller can charge the cost of the data recorder as a maximum price.

Please see this link for full text of the Communiqué (only available in Turkish).