Comminuque On The Principles And Procedures For The Request To Data Controller

* This is an English translation. In case of any difference in meaning between the original Turkish text and the English translation, the Turkish text shall apply.

Purpose and Scope

ARTICLE 1 – (1) This Communiqué has been prepared in order to determine the principles and procedures for the request to be made to the data controller and fee to be charged in cases where the process requires additional costs.

Legal Basis

ARTICLE 2 – (1) This Communiqué has been prepared on the basis of  Article 13 and sub-paragraphs (e) and (g) of Article 22 (1) of Personal Data Protection Law No 6698 of 24/03/2016.

Definitions

ARTICLE 3 – (1) For the purposes of this Communiqué:

a) “Request” means request made within the scope of Article 13 of the Law,

b) “Secured Electronic Signature” means the electronic signature which exclusively belongs to the signatory, has been created by means of secured signature creation devices under exclusive disposition of the signatory, provides identification of the signatory via qualified electronic certificate, provides the determination whether any subsequent changes have been made in the signed electronic document,

c) “Data subject” (natural person concerned) means the natural person whose personal data are processed,

ç) “Law” means Personal Data Protection Law numbered 6698 of 24/03/2016,

ç) “Board” means the Personal Data Protection Board,

d) “Recording medium” means any type of environment that keeps the personal data, processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system,

e) “Registered electronic mail (KEP) address” means the qualified form of electronic mail which provides legal evidence for the use of it, including sending and delivering of electronic messages, 

f) “Board” means the Personal Data Protection Board,

g) “Authority” means the Personal Data Protection Authority,

ğ) “Mobile signature” means electronic signature created by using a mobile device,

(2) For the definitions not included in this Communiqué, the definitions in the Law shall apply.

Right to Request

ARTICLE 4 – (1) Natural persons whose personal data are processed have right to request to the data controllers.

(2) Data subjects may benefit from this right provided that they make the requests in Turkish.

Procedures of Request

ARTICLE 5 – (1) Data subjects may make requests to data controllers within the scope of their rights specified in Article 11 of the Law, in writing or by registered electronic mail (KEP) address, secured electronic signature, mobile signature or by the e-mail address which has been previously recorded in the data controller’s system or by means of a software or application designed for purposes of this request.

(2) The request must include the following;

a) Name, surname and signature, if the request is made in writing,

b) For Turkish Citizens, TC identity number; for foreigners, nationality, passport number or identity number if available,

c) Residential and business address subject to the notification,

ç) Electronic mail address, telephone, fax number subject to notification if available,

d) Subject of demand,

(3) Documents and information regarding the demand shall be attached to the request,

(4) In written request, the request date is the date that the document is notified to data controller or to its representative.

(5) In the case that the requests are made by other methods, requisition date is the date when the request is delivered to data controller.

Response to the Request

ARTICLE 6 – (1) The Data controller is obliged to take necessary organizational and technical measures to conclude the requests to be made by data subject within the scope of the Communiqué, effectively and in accordance with norms of lawfulness and fairness.

(2) The data controller shall act on the request or refuse it together with justified grounds.

(3) The data controller shall communicate its response to the subject in writing or by electronic means.

(4) Letter of response shall include the following:

a) Information regarding data controller or its representative,

b) The requester’s name and surname, for Turkish citizens, TC identity number; for foreigners nationality, passport number or identity number if available, residential and business address subject to the notification, electronic mail address, telephone and fax numbers subject to notification if available,

c) Subject of demand,

ç) Explanations of data controllers regarding the request,

(5) Data controller shall conclude the demands set forth in the request within the shortest time by taking into account the nature of the demand and at the latest within thirty days and free of charge. However, if process requires additional costs, fees laid down in Article 7 may be charged. If the Request is made due to the fault of the data controller, the fee is refunded to data subject.

(6) In the case that the demand of the data subject is accepted by the data controller, the demand shall be fulfilled by the controller within the shortest time and information is communicated to data subject.

Fee

ARTICLE 7 – (1) If the request of the data subject is to be responded in writing, no fee will be charged up to ten pages. 1 Turkish Lira may be charged per page over ten pages.

(2) In cases where the request is responded by means of recording medium like CD, flash memory, fee to be charged by data controller cannot exceed the cost of the recording medium.

Entry into force

ARTICLE 8 – (1) This Communiqué shall enter into force on date of issue in the Official Gazette.   

Enforcement

ARTICLE 9 – (1) The President of Personal Data Protection Authority shall enforce the provisions of this Communiqué.