Pursuant to Article 7 of the Law despite being processed in compliance with the provisions of this Law and other relevant laws, personal data shall be erased, destructed or anonymized by the data controller, ex officio or on the request of the data subject, in the event that all of the conditions for processing laid down in pursuant to Article 5 and Article 6 of the Law no longer exist.

The Board issued BY-LAW ON ERASURE, DESTRUCTION OR ANONYMIZATION OF PERSONAL DATA to determine principles and procedures regarding erasure, destruction and anonymization of personal data processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system .

•  Erasure of personal data is the process of rendering personal data inaccessible and non-reusable for the users concerned, by no means.
• Destruction is the process of rendering personal data inaccessible, irretrievable or non-reusable by anyone, by no means.
• Anonymization is the process of rendering personal data impossible to link with an identified or identifiable natural person, even though matching them with other data.
• Data controllers who are obliged to registered with Data Controllers’ Registry system, pursuant to Article 16 of the Law, shall issue personal data storage and disposal policy in accordance with personal data processing inventory. 
• Data controller, who has issued data storage and disposal policy pursuant to the By Law on Erasure, Destruction or Anonymisation of Personal Data, shall erase, destruct or anonymize the personal data in the first periodic disposal process following the date for obligation of erasure, destruction or anonymization of personal data arises.
• The Data controller is obliged to take any type of technical and organizational measures related to erasure, destruction or anonymization of personal data.
• Data controller is obliged to describe the methods used for the erasure, destruction and anonymization operations of personal data in the relevant policies and procedures.
• All operations relating to erasure, destruction and anonymization of personal data shall be recorded and those records shall be stored for minimum three years excluding other legal obligations.
• Unless otherwise decided by the Board, the data controller may choose one of the appropriate methods for periodic erasure, destruction or anonymization of personal data ex officio. Upon request of data subject, data controller may choose appropriate method with justified grounds.

In addition, a Guide on Erasure, Destruction or Anonymisation of Personal Data ("Guidelines") has been prepared by the Board to draw attention to various topics in order to clarify the application and how to create good practice examples based on the Regulation .