Page 1

PERSONAL DATA
PROCESSING CONDITIONS

Page 2

Processing of personal data, Article 3 of the Law
has been defined. According to this; personal data completely
or partially automatic or any data recording
non-automatic, provided that it is part of the system
acquisition, recording, storage,
preservation, modification, reorganization,
disclose, transfer, take over, obtain
making, classifying or using
performed on data such as blocking
All kinds of transactions are considered as processing of personal data.
has been done.
The conditions for the processing of personal data are 5 of the Law.
listed in the article, accordingly the following
In case of at least one of the conditions, personal
data processing is possible.
• Existence of the explicit consent of the person concerned,
• It is clearly stipulated in the laws,
• Will not be able to express consent due to actual impossibility
legal validity of the situation or consent
unknown person himself or another person

one

Page 3

for the preservation of life or bodily integrity
be mandatory,
• Directly with the conclusion or performance of a contract
parties to the contract, provided that it is directly related
It is necessary to process personal data of
• Fulfilling the legal obligation of the data controller
mandatory to bring
• The person concerned has been made public by himself,
• For the establishment, exercise or protection of a right
data processing is mandatory,
• Damage to the fundamental rights and freedoms of the person concerned.
legitimate data controller, provided that
The necessity of data processing for their interests.
Conditions for the processing of personal data, that is, compliance with the law
cases have been determined by counting in the Law,
Terms cannot be extended.

2nd

Page 4

Personal data processing, other than express consent in the Law
if it is based on one of the conditions, then from the person concerned
express consent is not required. Data processing
carrying out its activity on a basis other than express consent
based on explicit consent whenever possible, deceptive and
would constitute an abuse of right. Indeed, the relevant
In case of revocation of the explicit consent given by the person
from other personal data processing conditions of the data controller.
to continue processing data based on one
Acting against the law and honesty rules
will mean.
In this context, personal data is collected by the data controller.
express consent of the purpose of the processing
whether it is based on one of the processing conditions other than
should be evaluated, if this purpose
does not meet at least one of the conditions other than consent,
In this case, the person is open for the continuation of the data processing activity.
consent should be sought.
Terms of processing personal data
the purpose of the processing activity in terms of the Law
forms the legal basis. Personal data processing
more than one personal data for the purpose of its activity

3

Page 5

processing conditions. For example, payroll
personal data of employees in order to regulate
legal basis of processing, personal data processing
performance of the contract and data controller
fulfillment of its legal obligation.

4

Page 6
Table-1 shows the processing conditions of personal data other than express consent:

Processing
Conditions
Provision of Law

of the contract
its execution

Actual Impossibility

Scope

Sample

Tax Laws, Business
Law, Turkish Trade

Personnel of the employee
law of information

Law etc.

keeping up

Employment Contract, Sales Contract,
Making a delivery
Contract of Carriage, Work
for the company
Contract etc.

address information
recording.

Due to the actual impossibility

unconscious person

who cannot consent
or the power of discrimination

personal health information.
Kidnapped or lost

non person.

location information of the person.

Data

Financial Audits, Security
of the person in charge Legislation, Sector Oriented

banking, energy,
capital markets

Legal

specific to areas such as
information on audits

Compliance with Regulations.

Responsibility

making sharing.
publicity
earning

owned by the person concerned
information to the public

wanting to sell their house
in the sales advertisement

to present.

place for contact information
to give

Establishment of Right,filing, registration

a quitter

protection,
Using

transactions, any
deed transaction etc. in the works

required by the employee
time of litigation

mandatory to use
data.

over the course of
storage.

Legitimate Interest

employee engagement
damage to their rights
data, provided that

increasing reward and
premium application

legitimate person responsible
compulsory for the sake of

data for the purpose
processing.

data if
processing

5

Page 7

I. Explicit Consent
Explicit consent is one of the personal data processing conditions.
Data processing activity by the data controller
other data processing
whether one of the conditions can be sustained
should be evaluated, if none of these
express consent should be sought.

6

Page 8

II. Explicitly in Laws
foresight
One of the data processing conditions is in the laws.
clearly foreseen. Personal data in laws
a provision regarding the processing of the data
will create. For example, a crime by law enforcement
Due to the investigation, Police Duty No. 2559 and
Pursuant to Article 5 of the Entitlement Law (PVSK)
taking fingerprints of suspects; Judicial No. 5352
In accordance with the Registry Law, the Ministry of Justice
processing of criminal convictions
is in scope.

7

Page 9

III. Actual Impossibility
Will not be able to express consent due to actual impossibility
legal validity of the situation or consent
the life of the unrecognized person, his own or someone else's
or it is necessary for the protection of bodily integrity
personal data of the person concerned may be processed.
In case of actual impossibility according to the law, personal data
for the processing of the relevant person or a third party
for the protection of life or bodily integrity
must be mandatory. For example, a restricted
himself or the suspect in order to save the person
phone, computer, credit card, bank
location via card or other technical means.
such as processing this data to determine

8

Page 10

IV. of the contract
For Establishment and Execution
Being Necessary
directly by the conclusion or performance of a contract.
pertaining to the parties to the contract, provided that it is directly related
In case the processing of personal data is mandatory
personal data of the persons concerned, limited to this purpose.
processing is possible. For example, under a contract
the creditor's account number for payment of the money
obtaining a loan or making a loan agreement with a bank
the bank's payroll, title deed
obtaining the records, the document stating that there is no enforcement debt
as. In addition, in accordance with the contract, the seller owes the delivery of the goods.
register the recipient's address to fulfill or
to pay the employer's salary
employees' possession of bank information, this
scope can be evaluated.

9

Page 11

V. Data Controller
Legal Obligation
Ability to Fulfill
Mandatory for
Fulfilling the legal obligation of the data controller
data processing is necessary in order to
In such cases, the personal data of the person concerned may be processed. One
bank account so that the company can pay salary to its employee
number, whether he is married, his dependents
persons, whether the spouse is working, social security number
obtaining and processing data such as
example can be given. During the employer's tax audit
information of its employees or customers to the relevant public
In this context, submitting it to the examination of the officials
assessable.

10

Page 12

VI. Your Personal Data
By Relevant Person
Being Public
made public by the person concerned, another
made public in any way
personal data can be processed. Example of this situation
as a means of contacting a person in certain situations.
publicly disclose contact information for the purpose of
may be declared. On corporate websites,
workplace phone numbers of employees and corporate
access of e-mail addresses by third parties.
without making it public, even if it is shared openly.
can be mentioned.
However, in order for personal data to be publicly accepted,
He must want the person he is to be public. Another
In other words, in order to realize the publicization
There must be a will to make it public. Or a person
Having your personal data in a place where everyone can see it
does not make it public. Also, in the case of publicizing
not to use personal data other than for the purpose
required. For example, used car sales
the person who wants to sell his vehicle on the websites
use of contact information for marketing purposes
It is not possible.
11th

Page 13

VII. Your Personal Data
You Have a Right to Process
Plant, Use or
Mandatory for Protection
to be
For the establishment, exercise or protection of a right
personal data of the person concerned, if necessary
processing is possible. For example, a company's own
some data for proof in a lawsuit filed by an employee
use or the protection of the rights of a restricted person
the financial information of the guardian or trustee, the restricted person for the purpose of
like holding it. In addition, after the contract has expired, possible
until the end of the statute of limitations against legal proceedings
documents such as invoices, contracts, sureties
storage will be considered in this context.

12

Page 14

VIII. Related to Data Processing
Fundamental Rights of the Person and
Harm to their Freedom
Data Not to be Provided
Legitimate of the Responsible
Mandatory For Their Interests
to be
Not to harm the fundamental rights and freedoms of the person concerned
for the legitimate interests of the data controller
If data processing is mandatory, personal
data processing is possible.
Legitimate interest of the data controller in some cases
data processing may be involved.
For example, a company owner's employee's basic rights and
their promotion, without prejudice to their freedom,
in the regulation of salary increases or social rights
or in the process of restructuring the business
employees to be taken as a basis in the distribution of duties and roles.

13

Page 15

The processing of personal data is legitimate by the owner of the company.
included in its interests.
In order for data to be processed based on this condition, the data
the person in charge has a legitimate interest and
not harming the fundamental rights and freedoms of the person
required.
The legitimate interest of the data controller
the interest to be obtained as a result of the processing and
is for the benefit. The data controller will obtain
benefit; legitimate, with the fundamental rights and freedoms of the person concerned
sufficiently effective, specific and already
must be related to an existing interest. Data
related to the current activities carried out by the supervisor
and be a transaction that will benefit him in the near future.
required.
The sale, acquisition or ownership of a company
In the event of a change, such as
The buyer has knowledge of the current situation of the company.
including personal data, in order to be
a set of information measured and necessary security measures
and the cases of examination by taking it within the scope of legitimate interest.

14

Page 16

can be obtained. However, it should be noted here
The issue is that the legitimate interest of the data controller
interpreted in accordance with its purpose and spirit.
Besides having a legitimate interest of the data controller
infringement of the fundamental rights and freedoms of the person concerned.
should not be given. Therefore, the data controller
Once it has been determined whether it has a legitimate interest,
fundamental rights and obligations of the data subject whose personal data will be processed.
It is necessary to determine what freedoms are. This
the legitimate interest of the data controller is very strong and
if it is not effective, the rights and interests of the person concerned,
legitimate but less important data controller
may outweigh his interests. Accordingly,
the legitimate interest to be dealt with is serious, substantial and
must already be available.
Competing for data processing based on this condition
assessment between interests.
As a result of this provision, personal data
It has to be decided whether it can be processed or not.
Therefore, the relevant provision provides unlimited data processing.
It cannot be considered an authority. On the contrary, matter
with the benefit of the data controller specified in the scope of

15

Page 17

a reasonable compromise between the fundamental rights and freedoms of the person concerned.
requires a balance.
The implementation of this provision is a two-stage evaluation.
requires. At the first assessment
determining the existence of legitimate interests of the data controller
secondly, it must be ensured that this interest is fundamental to the person concerned.
should be determined not to harm their rights and freedoms.
While making this evaluation, the data controller's legitimate
interests and the purpose of processing personal data are interconnected.
should not be mixed. Although these two terms are related
even mean different. Processing personal data
The purpose is specifically related to the reason for the processing of the data.
However, the legitimate interest of the data controller is wider.
should be interpreted. Legitimate interest of the data controller,
resulting from the processing to be carried out
is for the benefit. The data controller will obtain
benefit; legitimate, with the fundamental rights and freedoms of the person concerned
competitively effective, specific and already existing
must be of interest.
In this context, the first thing to consider
Among the issues; legitimate interest of the data controller,
on the fundamental rights and freedoms of the person concerned

16

Page 18

the effect of the processing of the data and the situation and the event.
balances that will differ according to their nature
(evaluation of the prevailing interest and right)
exists.
It should also be noted that; legitimate interest requirement
If the other conditions in the article are not applicable
last resort for data processing
as well as being able to include everything within its scope and
activities related to the processing of all personal data
It's not an arrangement that will make it happen.

17

Page 20
19

Nasuh Akar Mah. 1407. Street No:4 06520
Balgat-Çankaya/Ankara // www.kvkk.gov.tr
Tel: 0 (312) 216 50 50 // Fax: 0(312) 216 50 52

