Communique On Principles And Procedures To Be Followed In Fullfillment Of The Obligation To Inform

* This is an English translation. In case of any difference in meaning between the original Turkish text and the English translation, the Turkish text shall apply.

Purpose and Scope

ARTICLE 1 – (1) The purpose of this Communiqué is to determine the procedures and principles to be followed within the scope of the obligation to inform to be fulfilled by data controllers or persons authorized by them, pursuant to Article 10 of the Personal Data Protection Law No. 6698 of 24/3/2016.

Legal Basis

ARTICLE 2 – (1) This communiqué has been prepared on the basis of sub-paragraphs (e) and (g) of Article 22 (1) of the Personal Data Protection Law No. 6698.

Definitions

ARTICLE 3 – (1) For the purposes of this communiqué:

a) “Recipient group” means the category of natural and legal person to which the personal data are transferred by the data controller,

b) “Data subject (Natural person concerned)” means the natural person whose personal data are processed,

c) “Law” means Personal Data Protection Law No. 6698 and of 24/3/2016,

ç) “Board” means the Personal Data Protection Board,

d) “Authority” means Personal Data Protection Authority,

e) “Registry” means Data Controllers’ Registry kept by Presidency,

f) (Amendment: OG-28/4/2019-30758) “Data filing system” means filing system where personal data are processed by being structured according to specific criteria.

g) “Data controller” means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishment and management of the data filing system.

ğ) (Amendment: OG-28/4/2019-30758) “Representative of the data controller” means a legal person established in Türkiye or a natural person who is citizen of Republic of Türkiye, minimum authorized to represent data controllers not established in Türkiye on issues specified in the third paragraph of Article 11 of By-law on Data Controllers’ Registry.

(2) For the definitions not included in this Communiqué, the definitions in the Law shall apply.

Scope of the Obligation to Inform

ARTICLE 4 – (1) Pursuant to Article 10 of the Law; data subjects shall be informed by data controllers or the person authorised by them at the time when personal data are obtained.

At the time when this obligation is being fulfilled, information to be given by data controllers or the person authorised by them shall at least include following issues:

a) the identity of the data controller or its representative, if any,

b) the purpose of processing of personal data,

c) to whom and which purposes personal data may be transferred,

ç) the method and legal basis of collection of personal data,

d) other rights of data subject referred to in Article 11 of the Law.

Principles and procedures

ARTICLE 5 – (1) The following procedures and principles shall be followed at the time of the fulfilment of the obligation to inform by the data controller or the person authorized by it by using physical or electronic media such as oral or written statement, voice recording, call centre:

a) The obligation to inform shall be fulfilled in any case of processing depending on the explicit consent of data subject or other conditions for processing in the Law.

b) In case the purpose of personal data processing changes, the obligation to inform shall be fulfilled for this purpose prior to data processing operation, as well.

c) (Repealed: OG-28/4/2019-30758)

ç) If the data controller is obliged to register with the Registry, information to be given to data subject within the scope of the obligation to inform shall conform to those given in the Registry.

d) Fulfilment of the obligation to inform does not depend on the request of data subject.

e) Proof of fulfilment of the obligation to inform shall be under responsibility of the data controller.

f) In the event that processing personal data is on the basis of explicit consent, procedures of the obligation to inform and obtaining explicit consent shall be performed separately.

g) The purpose of processing personal data to be explained within the scope of the obligation to inform shall be specified, explicit and legitimate. While the obligation to inform is being fulfilled, general and ambiguous statements should be avoided. Statements which may raise opinions on processing of personal data for other possible purposes shall not be used.

ğ) The notification to be given within the scope of the obligation to inform shall be performed by using intelligible, clear and plain language

h) “Legal basis” mentioned in sub-paragraph (ç) of Article 10(1) of the Law means that personal data are processed on the basis of which processing conditions determined in the Article 5 and 6 of the Law within the scope of the obligation to inform. Legal basis shall be explicitly provided at the time of fulfilment of the obligation to inform.

ı) Within the scope of the obligation to inform, the purpose of processing of personal data and recipient group to which personal data will be transferred shall be stated.

i) Within the scope of the obligation to inform, it shall be clearly stated by which method personal data are obtained from wholly or partially by automated means or by non-automated means which provided that form part of a data filing system.

j) At the time of fulfilment of the obligation to inform; information that is incomplete, incorrect and misleading the data subjects shall not be used.

The Obligation to Inform in cases where personal data are not obtained directly from data subject

ARTICLE 6 – (1) In cases where personal data are not obtained directly from data subjects; the obligation to inform shall be fulfilled:

a) within a reasonable time following the obtainment of the personal data,

b) at the first instance of communication in case personal data are used to communicate with the data subject,

c) at the time of the first transfer of personal data at the latest in case personal data are to be transferred.

Entry into force

ARTICLE 7 – (1) This Communiqué shall enter into force on the date of issue in the Official Gazette.

Enforcement

ARTICLE 8 – (1) The President of Personal Data Protection Authority shall enforce the provisions of this Communiqué.

 

 

	The Communiqué published in the Official Gazette
	Date	Number
	10/03/2018	30356
	Communiqués making amendments on the Communiqué published in the Official Gazette (s)
	Date	Number
1.	28/4/2019	30758
2.