Page 1

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

LIGHTING
LIABILITY
IMPLEMENTATION
GUIDE

KVKK Data Management Department

Page 1

Page 2

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

GUIDE TO Fulfilling the LIGHTING OBLIGATION

April 2019, ANKARA
TR PERSONAL DATA PROTECTION AGENCY
ADDRESS: Nasuh Akar Mahallesi 1407 Sokak No: 4 Çankaya / ANKARA
Telephone: 0.312.216 50 00 www.kvkk.gov.tr

The text and other content in this guide, except for individual use, without permission.
partially or wholly copying, duplicating, using, publishing and
distribution is prohibited. Law no. 5846 on those who do not comply with this prohibition.
action will be taken. All rights of the product are reserved.

KVKK Data Management Department

Page 2

Page 3

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

SUMMARY
With Article 10 of the Personal Data Protection Law No. 6698 , data controllers
The obligation to inform the relevant persons whose personal data is processed has been brought for
While the obligation to inform is an obligation for data controllers,
It is also a right for real persons whose data is processed. Processed personal
clarification obligation, which means informing about data, personal data
It is an indispensable condition for the processing to be carried out in accordance with the law.
In order to fulfill the obligation of disclosure, the persons whose personal data are processed
as a minimum, they should be informed about the conditions listed in Article 10 of the Law. Promise
While fulfilling the lighting obligation in question, instead of the Lighting Obligation
The Communiqué on the Procedures and Principles to be Complied with in the Delivery of
However, while fulfilling the lighting obligation,
It is beneficial to consider suggestions, explanations and examples.

ABSTRACT
In accordance with the Article 10 of the Law on the Protection of Personal Data (Law
no. 6698), the data controllers are obliged to inform the data subjects whose personal data
are processed.
The obligation to inform which is a liability for the data controllers, is also a right for
natural persons whose personal data are processed. The informing obligation, which means
giving information about the processed personal data, is an essential requirement for the
lawful execution of personal data processing.
In order to fulfill the obligation of informing, the persons whose personal data are
processed must be informed at least as to the conditions listed in Article 10 of the Law.
While fulfilling the informing obligation in question, “Communique on the Procedures and
Principles to be Followed for the Fulfillment of the Obligation of Informing” must be
complied with.
However, it is useful to take into consideration the suggestions, explanations and
examples in this guideline when exercising the informing obligation.

KVKK Data Management Department

Page 3

Page 4

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

KEYWORDS
Personal Data, Disclosure Obligation, Data Controller, Relevant Person, Explicit Consent, Data
Registration System, Layered Lighting, Personal Data Processing Inventory

Keywords
Personal Data, Information Obligation, Data Controller, Data Subject, Open Consent, Data
Recording System, Layered Notice, Personal Data Processing Inventory

KVKK Data Management Department

Page 4

Page 5

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Contents
1. INTRODUCTION .................................................. .................................................................. .................................... 6
1.1 Purpose and Basis ................................................. .................................................................. ........................ 7
1.2 Content ................................................. .................................................................. .............................................. 7
1.3 Definitions .................................................. .................................................................. ............................... 8

2. SCOPE OF LIGHTING OBLIGATION ................................................. ....... 8
3. PROCEDURES AND PRINCIPLES TO BE FOLLOWED .................................................. ...................... 9
3.1. Clarification in the Case of Obtaining Personal Data from Relevant Persons ...................................... 9
3.1.1. Identity of the data controller and its representative, if any ............................................. ................... 9
3.1.2 The purpose for which personal data will be processed ............................................. .................................... 9
3.1.3 To whom and for what purpose personal data may be transferred .................................. ........ 10
3.1.4 Method and legal reason for personal data collection ............................................. ...................... 10
3.1.5 Other rights of the person concerned as listed in Article 11 of the Law .................................. ...... 11th
3.2. Clarification in case the Personal Data is not Obtained from the Relevant Person ..................................... 11
3.3. Circumstances in which the Liability of Lighting is not Fulfilled ............................................. ......... 12

4. RELATIONSHIP OF EXPRESS CONSENT AND THE LIABILITY OF INFORMATION.................................. 13
5. FULFILLING THE LIGHTING OBLIGATION .................. 14
5.1. Determination of the Method by which the Lighting Obligation will be Fulfilled ............. 14
5.2. Assignment of Person(s) to Carry out the Lighting Obligation Process .................. 14
5.3. Preparation of Personal Data Processing Inventory ............................................. .............................. 14
5.4. Stages of Illumination Text Preparation ................................................. ............................... 15

6. EXAMPLES OF LIGHTING TEXT ............................................. ........................... 18
6.1. Examples of Conforming Lighting Obligation .................................................. ............................. 18
6.2. Examples of Non-Compliance with the Lighting Obligation .................................................. .............. 22

KVKK Data Management Department

Page 5

Page 6

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

1.INTRODUCTION
Today, many companies, public institutions and organizations, foreign organizations or natural persons
obtains and uses a large amount of personal data within the scope of its own activities and
access more personal data to provide services or increase trade volume, and
It aims to share it with third parties. Turning to more personal data processing;
Economic contribution due to the convenience and advantages provided by the processed personal data
It also raises various risks and potential violations regarding data security.
brings.
Due to these risks and the possibility of violations, legal regulations regarding the protection of personal data
There was a need to establish an infrastructure and first of all, the Republic of Turkey
With the amendment made in the Constitution in 2010, the right to protection of personal data is constitutional.
has been secured. With the amendment made in the Constitution, the protection of personal data
It has been decreed that the procedures and principles should be regulated by Law. This provision
Pursuant to the Law on Protection of Personal Data No. 6698 (“Law”) by the Grand National Assembly of Turkey
It was accepted and entered into force by being published in the Official Gazette dated 07.04.2016.
The law is about the protection of fundamental rights and freedoms and the processing of personal data.
determined the procedures and principles to be followed by real and legal persons. However, in general
When evaluated, the Law does not limit the processing of personal data.
It disciplines its processing by binding it to certain rules.
One of the most important obligations of the law regarding data controllers is
lighting obligation. This obligation entails control over the personal data of the persons concerned.
and is the most important indicator of its control authority. On personal data
The relevant persons who have the authority to audit also determine the future of their personal data.
they can determine.
Illumination brought by Article 10 of the Law
obligation is an obligation for data controllers.
However, at the same time, personal data are processed.
It is also a right for real people. Aforementioned
The liability is essentially related to the personal data processed.

ARTICLE 10- (1) During the acquisition of personal data
data controller or the person authorized by him, to the relevant persons;
a) Identity of the data controller and its representative, if any,
b) For what purpose personal data will be processed,
c) To whom and for what purpose the personal data processed
can be transferred,
ç) Method and legal reason for personal data collection,
d) Other rights listed in Article 11,
responsible for providing information.

means information and personal data
It is an indispensable condition for the processing to be carried out in accordance with the law.
The obligation to inform is not an obligation based on the request of the person concerned. relevant
In case of explicit consent of the person or other personal data processing conditions, the data
The responsible person must fulfill his obligation to inform. Because the obligation to illuminate
regardless of both express consent and other personal data processing conditions in the Law.
It is an obligation that must be fulfilled.

KVKK Data Management Department

Page 6

Page 7

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

fulfilling the obligation to inform

ARTICLE 18 - (1) This Law;
a) Fulfilling the lighting obligation stipulated in Article 10
from 5,000 Turkish liras to 100,000 Turkish liras for those who do not bring
up to… an administrative fine is imposed.
(2) Administrative fines stipulated in this article,
applies to individuals and legal entities of private law.

18 of the Law in case of non-compliance.
held
sanction
in the article
is applied.

(3) The actions listed in the first paragraph are carried out by public institutions and organizations and public
In case it is processed within the body of professional organizations,
Upon the notification to be made by the Board, he/she can work in the relevant public institution and organization.
civil servants and other public officials and public institution
According to the disciplinary provisions about those who work in professional organizations
The process is done and the result is reported to the Board.

fulfilling the obligation to inform
proof of receipt is given to the data controller.
belongs.

Fulfilling the obligation to inform in accordance with the law; data
establishing a relationship of trust between those responsible and the people concerned, transparency and accountability
important for its principles.

1.1 Purpose and Basis
According to Article 10 of the Law, at the time of obtaining personal data, the data controller or
It is necessary to inform the relevant persons by the authorized persons.
Pursuant to this provision and subparagraph (e) of the first paragraph of Article 22 of the Law, Personal
Fulfillment of Disclosure Obligation by the Data Protection Board (“Board”)
A Communiqué (“Communiqué”) has been prepared on the Procedures and Principles to be Complied with.
The aforementioned communiqué was published in the Official Gazette dated 10 March 2018 and numbered 30356.
On the basis of this Communiqué on how to fulfill the said obligation
the Board in order to provide clarity in practice and to set good practice examples.
by “Guide to Fulfilling the Lighting Obligation” (“Guide”)
prepared and made available to the public.

1.2 Content
Your guide;
The first part is the introductory part and in this part, the purpose of preparing the guide,
basis, content and definitions are given.
In the second part, it is given to the relevant persons by the data controller or authorized persons.
The scope of the lighting to be made is included.
In the third part, the procedure to be followed while fulfilling the obligation to inform
and the fundamentals.

KVKK Data Management Department

Page 7

Page 8

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

In the fourth chapter, the relationship between explicit consent and enlightenment is mentioned.
In the fifth section, one of the stages related to the fulfillment of the lighting obligation
mentioned.
In the sixth section, within the scope of lighting obligation, appropriate and non-compliant
application examples are shared.

1.3 Definitions
a) Recipient group: Real or legal entity to which personal data is transferred by the data controller
person category,
b) Relevant person: The real person whose personal data is processed,
c) Law: Law on Protection of Personal Data dated 24/3/2016 and numbered 6698 ,
ç) Layered lighting: During the acquisition of personal data, personal information is given to the person concerned.
By giving preliminary information about the data obtained, the person concerned is informed about the 10th article of the Law.
directing them to lighting in accordance with the article,
d) Board: Personal Data Protection Board,
e) Authority: Personal Data Protection Authority,
f) Registry: The Data Controllers Registry kept by the Presidency,
g) Data Recording System: Personal data is processed and structured according to certain criteria.
registration system,
ğ) Data controller: Data controller, which determines the processing purposes and means of personal data.
The natural or legal person responsible for the establishment and management of the registration system,
h) Data controller representative: Data controllers not resident in Turkey
Data Controllers Registry published in the Official Gazette dated 30/12/2017 and numbered 30286
In the matters specified in the third paragraph of Article 11 of the Regulation on
legal person resident in Turkey or a citizen of the Republic of Turkey, authorized to represent
the person,
means.
For definitions not included in this Guide, the definitions in the Law and the Communiqué are valid.
will be.

2. SCOPE OF LIGHTING OBLIGATION
The obligation to inform is the real person who processes personal data within the scope of its activities.
and legal entity data controllers. Therefore the lighting
liability covers data controllers.

KVKK Data Management Department

Page 8

Page 9

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

The obligation to inform is not an obligation based on the request of the person concerned. relevant
In case of explicit consent of the person or other personal data processing conditions, the data
The responsible person must fulfill his obligation to inform. Because the obligation to illuminate
regardless of both express consent and other personal data processing conditions in the Law.
It is an obligation that must be fulfilled.
ARTICLE 4- (1) Personal data can only be used in this Law and other
Lighting
your obligation
instead
can be processed in accordance with the procedures and principles stipulated in the laws.
(2) Compliance with the following principles in the processing of personal data
The proof that it has been brought in belongs to the data controller.
mandatory:
a) Compliance with the law and honesty rules.

obligation

Lighting
the general provisions in Article 4 of the Law.
principles must be taken into account.

b) Being accurate and up-to-date when necessary.
c) Processing for specific, explicit and legitimate purposes.
ç) Being connected, limited and proportionate to the purpose for which they are processed.
d) Necessary for the purpose for which they are processed or foreseen in the relevant legislation.
to be preserved for as long as possible.

instead

3. PROCEDURES AND PRINCIPLES TO BE FOLLOWED
3.1. Clarification in Case of Obtaining Personal Data from Relevant Persons
According to the law, during the acquisition of personal data, the data controller or
It is necessary to inform the relevant persons by the authorized persons. Lighting
According to Article 10 of the Law, which includes provisions regarding the liability of
While fulfilling the obligation to inform, the data controller or the persons authorized by him.
The information to be provided must contain at least the following conditions:
3.1.1. Identity of the data controller and its representative, if any

The data controller and his representative, if any, who reveal their identity during the disclosure
information and contact information that can be easily contacted by different methods.
should explain.
For example; If the data controller is a legal person, the title of the legal person, if it is a real person, the real person
name and surname of the person, if he is a data controller residing abroad, the assigned data controller
identification information such as the name / title of the representative, as well as telephone number, e-mail address, internet
contact information such as address or postal address should be specified.
3.1.2 For what purpose personal data will be processed
ARTICLE 5 – (1) The data controller or the person authorized by him
According to the first paragraph of Article 5 of the Communiqué;
physical or physical, such as verbal, written, sound recording, call center.
electronic

environment to be used

by means of

while fulfilling the lighting obligation
the procedure listed below during the fulfillment of the obligation
and the following principles must be followed:
the purpose of the processing is specific, clear and legitimate
g) Personal data to be disclosed within the scope of disclosure obligation
must. In addition, in the information; of a general nature,
other vague and likely to come up

lighting

The purpose of the processing must be specific, clear and legitimate. Lighting
obligation
instead
while bringing
general
quality
and ambiguous expressions should not be included. come to the fore
personal data may be processed for other possible purposes.
Expressions that arouse opinion should not be used.
ğ) To be made to the relevant person within the scope of the obligation to inform
using clear, understandable and plain language
needs to be carried out.
b) When the personal data processing purpose changes,
first, the obligation to inform for this purpose is also fulfilled.

purposes that lead to the opinion that it can be processed for
expressions should be avoided.

should be brought.

KVKK Data Management Department

Page 9

Page 10

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

For example, personal data belonging to an employee is part of a company's human resources process.
personal data of a symposium participant.
It should be clearly stated that it can be processed for purposes such as returning to the participant.
“We may use your personal data to develop new services” or “We may use your personal data to develop new services”.
Vague statements such as “we can use it for research purposes” should be avoided.

3.1.3 To whom and for what purpose personal data can be transferred

your communiqué
5.

to the article

by,

data

fulfill the obligation to inform

ARTICLE 5 – (1) The data controller or the person authorized by him
physical, such as verbal, written, audio recording, call center.
lighting using electronic media
in the performance of its obligation,
procedures and principles must be followed:

purpose of transferring personal data and
ı) Within the scope of disclosure obligation, personal data
Recipient groups to be transferred should also be clearly stated.the purpose of transfer and the recipient groups to be transferred should be specified.
Personal data domestically and internationally
8 and 9 of the Law.
regulated in the articles. data accordingly

ARTICLE 8 - (1) Personal data without the express consent of the person concerned
cannot be transferred.
(2) Personal data;
a) In the second paragraph of Article 5,
b) Provided that adequate measures are taken, in the third paragraph of Article 6,

responsible for the personal

express consent of the person concerned, in case one of the conditions specified
can be transferred without being searched.

transfer of data at home and abroad
ARTICLE 9 - (1) Personal data cannot be transferred to the dormitory without the express consent of the person concerned.
cannot be exported.
(2) Personal data, second paragraph of article 5 and article 6
The existence of one of the conditions specified in the third paragraph and the personal data
in the foreign country to which it will be transferred;
a) The availability of adequate protection,

act in accordance with these provisions
has to.

b) In the absence of adequate protection, in Turkey and the relevant
data controllers in a foreign country must provide an adequate protection in writing.
to undertake and to have the permission of the Board,
can be transferred abroad without seeking the explicit consent of the person concerned.

Business partner to these buyer groups,
supplier, affiliates, shareholders, by law

authorized public institutions and organizations, legally authorized private legal persons, community companies, etc.
can be given as an example.

3.1.4 Method and legal reason for personal data collection

According to Article 5 of the Communiqué; 5 and 6 of the Act.
ARTICLE 5 – (1) The data controller or the person authorized by him
from the personal data processing conditions listed in the articles
on the basis of which personal data is processed
must be clearly stated.
Again, according to this article; personal data completely
or partially automated means or data recording
non-automatic, provided that it is part of the system
clear indication of which of the methods

such as verbal, written, audio recording, call center
using physical or electronic media
during the fulfillment of the lighting obligation.
The following procedures and principles must be followed:
h) The first paragraph of Article 10 of the Law (ç)
What is meant by "legal reason" in the clause
5 and 5 of the Law on personal data within the scope of liability
stated
processing from the terms
in Articles 6
to which
based on
it is processed.
Lighting
in the performance of its obligation
The reason must be clearly stated.
i) Personal data within the scope of disclosure obligation,
fully or partially automated means or data recording
non-automatic, provided that it is part of the system
It is clearly stated by which method
should be specified.

It should be specified as well.

KVKK Data Management Department

Page 10

Page 11

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

For example, “these personal data are subject to the legal reason that it is expressly stipulated in the law.
It is processed by filling out the application form electronically on the basis of it.”
Information may be provided.
As an example of data collection methods; filling out a form, making a phone call,
obtaining personal data through website, data integration or camera shooting.
may be given.
The data controller will decide for himself the data collection method and tool.

3.1.5 Other rights of the person concerned as listed in Article 11 of the Law
ARTICLE 11- (1) Everyone is responsible for the data controller.
Data controller and its representative, if any, to the relevant person.
about himself by applying;

While providing information, in Article 11 of the Law

a) Learning whether personal data is processed,
b) If personal data is processed, information about it

must indicate that they have the above-mentioned rights. It

don't demand,
c) The purpose of processing personal data and their
whether it is used for its intended purpose
learning,
ç) Personal data at home or abroad
knowing the third parties to whom it is transferred,
d) Incomplete or incorrect processing of personal data
requesting their correction, if any,
e) Within the framework of the conditions stipulated in Article 7
deletion or destruction of personal data

information can be given by counting in a form or
refer to the article of the Law in question in the same form
can also be given.
Accordingly, everyone can apply to the data controller.

don't want,
f) Transactions made in accordance with subparagraphs (d) and (e),
to third parties to whom personal data is transferred

whether personal data related to him is processed
information about it, if personal data has been processed.
may request, the purpose of processing personal data and

request notification,
g) Exclusively automated systems of processed data
the person himself by analyzing it through
to object to the emergence of a result against him,
ğ) Unlawful processing of personal data
in case of damage due to

whether they are used for their intended purpose.

demanding removal,
has rights.

personal data in the country or abroad.
can learn the people to whom it is transferred, personal data is missing
ARTICLE 7- (1) This Law and other relevant laws
or correcting them in case of misoperation.
may want. Also, within the framework of Article 7 of the Law
deletion or destruction of personal data

processed in accordance with the provisions of
However, the reasons for its processing are eliminated.
personal data ex officio or related
by the data controller at the request of the person
deleted, destroyed or anonymized.
(2) Deletion, destruction or deletion of personal data
in other laws on anonymization

may request, if the incomplete or incorrect processing has been corrected,
The provisions
orcontained herein are reserved.
(3) Deletion, destruction of personal data
deletion, destruction or anonymization
or the procedure for making it anonymous, and
principles are regulated by regulation.

If the data is transferred, this situation will be taken into account by the third party to which the data is transferred.
may request to be notified to the persons or the unlawful processing of personal data
In the event that he suffers a loss due to this reason, he may request the compensation of the damage.

3.2. Not Obtaining Personal Data from the Related Person
In-State Lighting
Processing personal data in accordance with the Law
First of all, obtaining personal data from the relevant person
required. However, Article 6 of the Communiqué
KVKK Data Management Department

ARTICLE 6 – (1) Related to personal data
if it is not obtained from the person;
a) From obtaining personal data
within a reasonable time from
b) Communication of personal data with the person concerned
for the purpose of to be used
to be
in case of initial communication
during,
c) Personal data will be transferred
in case of personal data for the first time at the latest.
of the transmission
to be done
while
lighting
contact person
fulfillment of its obligation
must.

Page 11

Page 12

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

how to fulfill the obligation to inform if it is not obtained from the person concerned.
arranged.
According to this; Personal data due to actual impossibility or inability to reach the relevant person
cannot be obtained directly from the person concerned;
- Within a reasonable time from the acquisition of the personal data,
- In case the personal data is to be used for communication with the relevant person, the first
during communication,
- In case personal data is to be transferred, at the latest, the personal data must be transferred for the first time.

During the transfer,
The obligation to inform the relevant person must be fulfilled.

3.3. Circumstances in which the Lighting Obligation is not Fulfilled
Article 10 of the Law states that the data controller or
the provision that the person authorized by him must inform the relevant persons.
has brought. Therefore, as a rule, data controllers who process personal data
must fulfill its obligation to illuminate.
However, the activities specified in Article 28 of the Law titled "Exceptions"
In case of personal data processing within the scope of the
is not mandatory. These are also exceptions to the obligation to inform.
assessable.

3.3.1. First paragraph of Article 28 of the Law;

Cases in which the provisions of this Law will not be applicable
ARTICLE 28- (1) The provisions of this Law are as follows:
not applicable in cases:
a) Not to give personal data to third parties, and
In the first paragraph of Article 28 of the Law
comply with obligations regarding data security
has been arranged. Therefore, in this paragraph
fully by real persons, provided that
or related to family members living in the same residence
personal data being processed within the scope of activities
processing within the scope of activities.
b) Anonymization of personal data with official statistics
research, planning and statistics
processing for such purposes.
c) Personal data on national defense, national security,
public safety, public order, economic
security, privacy or personal rights
provided that it does not violate or constitute a crime,
for artistic, historical, literary or scientific purposes, or
processing within the scope of freedom of expression.

provisions of the Law will not be applied. It
to mention the obligation of illumination in case of
will not be possible.
For example, within the scope of official statistics or
research, planning and

ç) Personal data on national defense, national security,
public safety, public order or economic
duties and obligations by law to ensure security
by authorized public institutions and organizations
preventive, protective and intelligence activities carried out
scope of processing.
d) Investigation, prosecution, trial of personal data
or judicial authorities with respect to execution proceedings
or processing by enforcement authorities.

a company that processes personal data for purposes such as statistics
data controller, to be specific only to this data
any lighting provided
other activities (e.g. human

KVKK Data Management Department

Page 12

Page 13

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

resources, accounting, information processing, public relations, support services)
fulfill its obligation to inform the relevant persons in terms of the personal data it processes.
required.

3.3.2 The second paragraph of Article 28 of the Law;

Some provisions of the law cannot be applied.

ARTICLE 28- (2) Purpose and fundamental basis of this Law
data provided that it is in accordance with the principles and proportionate
regulating the responsibility of the responsible person to inform
10th, except for the right to demand the compensation of the damage,
11th and Data, which regulates the rights of the person concerned
Regulating the obligation to register with the Responsible Persons Registry
Article 16 shall not be applied in the following cases:
a) Preventing personal data processing from committing a crime
or necessary for criminal investigation.
b) Made public by the person concerned
processing of personal data.
c) Personal data processing is authorized by law
responsible and authorized public institutions and
profession as a public institution

activities in the second paragraph of Article 28 of the Law.
has been arranged. According to this article, in the relevant paragraph
within the scope of the activities listed
Article 10 of the Law for personal data
will not be applied. For example, security units
prevention of crime or crime by
necessary for the investigation

by their establishments, check
or
arrangement
carrying out their duties, disciplinary investigation or
necessary for prosecution.
ç) Personal data processing is related to budget, tax and financial issues.
the economic and financial interests of the State with regard to
necessary for its protection.

traffic or traffic
If MOBESE records are processed, the relevant
It is not obligatory to illuminate people.

4. RELATIONSHIP OF EXPRESS CONSENT AND THE LIABILITY OF ENLIGHTENING
The details specified in Article 3 of the Law
ARTICLE 3- (1) In the implementation of this Law;
a) Explicit
Regarding a specific subject,
Consent is a personal data processing condition. express consent; of
the consent:
person
informed and free will
voluntarily or voluntarily, to the processing of the data it has

declared consent,
means.

approval upon request from the other party.
means. With the person's express consent; regarding the processing of their personal data
notifies the data controller of its decision. For this reason, one of the processing conditions
in case of processing personal data based on express consent (before starting personal data processing)
before) the obligation to illuminate must also be fulfilled.
However, pursuant to Article 5 of the Communiqué,

ARTICLE 5 – (1) The data controller or the authorized person
such as verbal, written, voice recording, call center, etc.
using physical or electronic media
during the fulfillment of the lighting obligation.
The following procedures and principles must be followed:
f) The personal data processing activity is based on the condition of explicit consent.
as
realization
in case of,
lighting
liability and the procedures of obtaining express consent
must be performed separately.

the personal data processing activity of the person concerned
the data controller, if it is subject to his consent
Obtaining explicit consent with the obligation to inform
operations must be performed separately.

KVKK Data Management Department

Page 13

Page 14

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

5. FULFILLING THE LIGHTING OBLIGATION
5.1. The Method of Fulfilling the Lighting Obligation
detection
According to Article 5 of the Communiqué, the data controller
or
ARTICLE 5 – (1) The data controller or the person authorized by him
physical, such as verbal, written, audio recording, call center.
lighting by the authorized person
lighting using electronic media
in the performance of its obligation
obligation; verbal, written, voice recording, call center
The following procedures and principles must be followed:
f) The personal data processing activity is based on the condition of explicit consent.
obligation to inform
and the processes of obtaining express consent separately.

physical or electronic media such as
can be fulfilled by data controller
or the person authorized by him, which of these methods
You must decide for yourself what to use.

must be brought.

As an example of these methods; verbally by the data controller or the person authorized by him.
(such as face-to-face, verbal lighting), written (text on the web page, building
such as a wall-hung sign at the entrance, a wall-mounted information board under a camera),
audio recording (such as listening to the person concerned), call center (without talking to the operator)
physical or electronic media (such as playing an audio file first)
layered lighting in a document that takes place, a pop-up window appears,
fulfilling the lighting obligation by using mobile applications (such as mobile applications)
delivery can be given.
In addition, in the relevant legislation, in order for the visually impaired to access the aforementioned lighting,
(Law No. 5378 on the Disabled, Accessibility Monitoring and Inspection Regulation
etc.) it is important to carry out the foreseen applications.
In this way, the people concerned can understand what they read, see or hear.
Lighting that is as clear, simple, understandable and leaving no room for hesitation can be made.
will be possible.

5.2. Person(s) who will carry out the Lighting Obligation Process
Assignment
A ydınlat obligations, the data itself will be responsible for or authorize persons / persons
must be fulfilled by About the Law and Communiqué of the person / persons to be authorized
It is necessary to consider whether they have detailed and up-to-date information.

5.3. Preparation of Personal Data Processing Inventory
Depending on what type of business processes the data controllers processing personal data
reveal that they are processing personal data for the personal data processing activities they carry out.
must put.

KVKK Data Management Department

Page 14

Page 15

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Data
Responsibles
track record
About
The first paragraph of Article 4 of the Regulation
Personal data processing inventory in subparagraph (h)
defined, the first paragraph of Article 5 (d)
instead of the obligation to inform
included in the personal data processing inventory
information should be based on
specified.

ARTICLE 4 – (1) In this Regulation;
h) Personal data processing inventory: Data controllers
personal data that they carry out depending on their processes
processing activities; personal data processing purposes and legal
reason, data category, transferred recipient group, and data subject
and personal data they created by associating with the group
maximum retention necessary for the purposes for which they are processed.
period of time, personal data intended to be transferred to foreign countries, and
explaining the measures taken regarding data security
their detailed inventory,
ARTICLE 5 – (1) Creation, administration and supervision of the registry
The following principles, procedures and principles are complied with:
d) As stated in Article 10 of the Law for data controllers,
in the obligation to inform, in Article 13 of the Law
responding to the applications of the relevant persons and
The scope of the express consent to be disclosed by the persons
based on personal data processing inventory

personal
data
processing of the inventory
The information submitted to the Registry and published in the Registry is taken as basis.
preparation, fulfilling the obligation to inform
It will provide a significant convenience for data controllers at the point of
However, the obligation to prepare a personal data processing inventory is only registered with the Registry.
valid for data controllers responsible for registration. However, the obligation to inform
Even if it is not obliged to register in the Registry in order to fulfill it in accordance with the law, all
It is recommended to prepare a personal data processing inventory by data controllers.
In the final analysis, preparing the personal data processing inventory of the data controller
The obligation to inform continues regardless of the obligation.

5.4. Lighting Text Preparation Stages
Regardless of the methods used to fulfill the obligation to inform, first of all,
it is useful to prepare it in the form of a written document.
Using a clear, understandable and plain language in the lighting texts to be prepared
must. It is not difficult to understand the lighting texts and it is completely technical knowledge and
Do not get bogged down in terminology.
In addition, if possible, the text of the clarification based on the feedback received from the relevant persons.
re-evaluation, updating in accordance with changing conditions and correcting errors and omissions, if any.
elimination is important.
The following steps can be followed in the lighting text preparation process:
1) First of all, the data controller should determine well what type of data he is processing.
required.
2) Data controllers in accordance with the basic principles in Article 4 of the Law,
the personal data processed within the scope of its activities, on the basis of which processing purpose it processes.

KVKK Data Management Department

Page 15

Page 16

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

determining on the basis of personal data and clearly stating this purpose in the lighting texts
required.
3) If a transfer will be made in the country or abroad, the purpose of the transfer is
should be specified in the text. In addition, the real or legal person to whom this transfer will be made
It should also be stated who they will be.
4) Data controllers, from the processing conditions in Articles 5 or 6 of the Law.
determine on which basis they collect personal data and determine this in the lighting text.
must be specified. Apart from this, the personal data collection method is also absolutely necessary.
should be detected.
5) The data controller must comply with the rights specified in Article 11 of the Law.
must be specified in some way.
In addition, the following table should be taken into account when fulfilling the obligation to enlighten.
It is beneficial to have:
TABLE - 1:
Your Personal Data
Relevant Personal Data
From Directly Related Person Not Obtained from Person
In case of obtaining
In case of

Giving While Lighting
Required Information
data controller and
the identity of the representative

√

√

For what purpose personal data
will be processed

√

√

To whom and which personal data
to be transferred for

√

√

Method of personal data collection
and legal reason

√

√

11 of the Law of the person concerned.
rights of numbers

√

√

The table below should be taken into account when deciding when to do the lighting.
It is beneficial to have:

KVKK Data Management Department

Page 16

Page 17

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

TABLE - 2:
Personal Data Directly
Obtaining from the Relevant Person During obtaining personal data from the person concerned
In case of
A reasonable period of time from the receipt of the personal data
in
Personal Data Directly
Personal data will be used for communication with the person concerned.
Not Obtained From Relevant Person
in case of initial communication
In case of
If personal data is to be transferred, at the latest,
at the time of data transfer for the first time.

KVKK Data Management Department

Page 17

Page 18

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

6. EXAMPLES OF LIGHTING TEXT
6.1. Examples of Conforming Lighting Obligation
Example 1. Illumination Text
KVKK Hello 198 Hotline Call Center
Personal Data Protection Authority; information hotline
name-surname, contact information shared by the callers and
personal data of the voice recording;

In Law and Communiqué
"Data
of the person in charge
with "ID"
are personal data

a) To be able to address the caller correctly,
b) Confirmation of the call and the number of calls for statistical purposes
Place in Law and Communiqué

detection,
field “Personal data
c) The process of providing information consultancy service of our institutionwhich
for the purpose
will be processed” information
execution,
ç) To be used as evidence in disputes that may arise
operates on a limited basis.
Place in Law and Communiqué
field “Personal data
to whom and for what purpose
information that can be transferred

These personal data are not shared with third parties.
These personal data are “relevant data” specified in Article 5 of the Law.
not to harm the fundamental rights and freedoms of the person
compulsory for the legitimate interest of the data controller, provided that
by telephone, based on legal reason

Place in Law and Communiqué
domain “personal
data
method of collection and
“legal reason” information

is processed automatically.
Article 11 of the Law “regulating the rights of the person concerned”
Place in Law and Communiqué
your requests within the scope of “Application to Data Controller”
domain "about
of the person
Personal Data in accordance with the "Communiqué on Procedures and Principles"
of the law
11th.
Nasuh Akar Neighborhood of the Conservation Authority 1407 street
in the article
counted
No: 4 Çankaya / Ankara in writing
"other rights" information
you can send

KVKK Data Management Department

Page 18

Page 19

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Example 2. Layered Lighting Text

Data
of the person in charge
id

IN OUR BUILDING,
SAFETY
IN ORDER TO PROVIDE,
7 DAYS 24 HOURS
lighting front

WITH CAMERA SYSTEMS

information

MONITORING AND
REGISTERED
AVAILABLE.

For detailed information
www.kvkk.gov.tr/.. ..

KVKK Data Management Department

Detailed
lighting
access to text
provide
is used.

for

page 19

Page 20

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Example 3. Illumination Text
.............. ........... Located Inside the Service Building
Clarification Text About Security Cameras
This illumination text, Protection of Personal Data No. 6698
In Law and Communiqué
With the 10th article of the Law, the Liability of Illumination
place domain "Data
About the Procedures and Principles to be Followed in the Fulfillment
of the person in charge
"ID" information
In the capacity of data controller within the scope of the Communiqué .............................
Prepared by ...............
Entrance doors in our service building, building exterior,
dining hall, cafeteria, visitor waiting hall, parking lot,
security booth and floor corridors are located in the service area.
in total ... by means of security cameras and the building
Video recording is made to ensure security.
and registration process by the unit of .......... ..............

Place in Law and Communiqué
field “Personal data
which
for the purpose
will be processed” information

is inspected.
The personal data in question is referred to as “data data” in Article 5 of the Law.
ability of the responsible person to fulfill his legal obligations
Place in Law and Communiqué
domain “personal
data
to be mandatory” and “the fundamental rights and obligations of the person concerned”.
method of collection and
provided that they do not harm their freedom, the data controller
“legal reason” information
Data processing is mandatory for legitimate interests”
It is processed automatically based on legal reason.
Place in Law and Communiqué
The personal data in question is resolved to resolve legal disputes.
field “Personal data
or, upon request, in accordance with the relevant legislation, judicial authorities or to whom and for what purpose
information that can be transferred
may be transferred to the relevant law enforcement authorities.

Article 11 of the law regulating the rights of the person concerned
your requests within the scope of the "Application Procedure to the Data Controller"
Place in Law and Communiqué
According to the Communiqué on the Principles and Principles of .........
domain "about
of the person
District, ...... Street ..... Street No: ...... .......... / .........
in writing to the address or where your membership is confirmed.
via e-mail to ........... com.tr e-mail address

of the law
11th.
in the article
counted
"other rights" information

you can send

KVKK Data Management Department

Page 20

Page 21

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Example 4. Illumination Text
(Layered Lighting Using Symbols, Signs and Icons)

KVKK Data Management Department

Page 21

Page 22

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

6.2. Examples of Non-Compliance with the Lighting Obligation
Example 1. Illumination Text
Call center
The name shared by those who call our information hotline
personal data such as surname, contact information and voice recording;
a) To be able to address the caller correctly,
b) Confirmation of the call and the number of calls for statistical purposes

In the Law and Communiqué
“The data controller
"ID" information
not available. processed
generalization in data
has been done.

detection,
c) The process of providing information consultancy service of our institution
execution,
ç) To be used as evidence in disputes that may arise
operates on a limited basis.
These personal data are shared with the shareholders.

For what purpose personal data
place to be transferred
not given.

This personal data is automatically sent via the phone.
is being processed.

In the Law and Communiqué
Legal reason information is missing.

Send your feelings and thoughts to ornek@ornek.com.tr mail

11 of the Law of the person concerned.
the rights enumerated in

You can send it to our address.

information about
not given.

EXPLANATION
In the text of the clarification, at least Article 10 of the Law and Article 4 of the Communique
It must meet the conditions. In the evaluation of this text;
- The identity of the data controller and its representative, if any, is missing and generalization in the processed personal data
has been done.
- It is specified to whom the personal data will be transferred, but for what purpose it will be transferred
not specified.
- The method of collecting personal data is stated, but the legal reason is not specified.
- No information has been given about the rights of the person concerned as listed in Article 11 of the Law.

KVKK Data Management Department

Page 22

Page 23

GUIDE FOR Fulfilling OBLIGATION TO LIGHTING

Example 2. Illumination Text
Date of Birth: 10.10.1978
Profession: ……………
Address: ……………….. Mahallesi
…….. Street No:……
………. / ANKARA Postal Code: ………….
Confusing and full of legal terms
Legal Notice:
language used, text too small
X Limited Company is located in Turkey and belongs to X Retail Group (Group)
font, light gray and italicized.
is a member. The Group also owns Y Limited Liability Company and Z Limited Liability Company and
includes their subsidiaries. What you give can be diagnosed
This information is publicly available
Personal data is in compliance with Law No. 6698 and other applicable laws.
is not meaningful.
will be processed. your information to process your order.
we will use This is your bank and credit card details.
realization, use for the delivery of purchased products,
includes fraud detection and prevention. your information with you
act in this direction within the framework of our agreement or within the framework of the legislation Here, the person concerned can communicate with him.
automatic consent to be passed
to the person to whom we have transferred our rights and obligations.
an assumption that
we can give. Market research and our products and services
subject. Open
your consent in law
We will use it for marketing. This is if our number 0 312 XXX XXX
stated
elements
in terms of
mail, telephone, e-mail and SMS, unless you declare otherwise by calling
Considering this situation, it is a true
may include contacting you via Your information, credit bureau
It's not an approach. Lighting with open consent
We will use it to research files. This information, other debt
should not be combined in the same text.
It can be used by lenders when making credit decisions about you.
The records kept about you at the credit bureau
your link
found
of persons
with the records more
previously
may be linked. For credit research purposes
You will be considered together with the records and financially connected.
Share your information with other companies, market research and their products and services.
Confusing language is used.
for marketing purposes, if you call 0 312 XXX XXX
If you do not declare it, it will be shared. By signing this form,
One for many different processing purposes
have consented to the processing of your information for the above purposes
an improper consent
you will be.
is an example.

Customer Signature:

Signature:

KVKK Data Management Department

Page 23

