Page 1

Saturday, March 10, 2018

Official newspaper

Number : 30356

NOTIFICATION
From the Personal Data Protection Authority:
IN FULFILLING THE LIGHTING OBLIGATION
COMMUNIQUÉ ON THE PROCEDURES AND PRINCIPLES TO BE COMPLIED
Purpose and scope
ARTICLE 1 – (1) The purpose of this Communiqué is the Law on Protection of Personal Data dated 24/3/2016 and numbered 6698.
Clarification that must be fulfilled by data controllers or authorized persons pursuant to Article 10
to determine the procedures and principles to be followed within the scope of its obligation.
Rest
ARTICLE 2 – (1) This Communiqué is based on the first article of Article 22 of the Law on Protection of Personal Data No. 6698.
It has been prepared based on subparagraphs (e) and (g) of the paragraph.
Definitions
ARTICLE 3 – (1) In this Communiqué;
a) Recipient group: The natural or legal person category to which personal data is transferred by the data controller,
b) Relevant person: The real person whose personal data is processed,
c) Law: Law on Protection of Personal Data dated 24/3/2016 and numbered 6698,
ç) Board: Personal Data Protection Board,
d) Institution: Personal Data Protection Authority,
e) Registry: The Data Controllers Registry kept by the Presidency,
f) Data recording system: Fully or partially automated or part of any data recording system
Any environment where personal data is processed by non-automatic means,
g) Data controller: The data recording system, which determines the purposes and means of processing personal data.
the natural or legal person responsible for the establishment and management of
ğ) Data controller representative: Data controllers who are not resident in Turkey, dated 30/12/2017 and 30286
The second article of the 11th article of the Regulation on the Data Controllers Registry published in the Official Gazette No.
Legal person residing in Turkey or the Republic of Turkey authorized to represent the minimum in the matters specified in the paragraph
citizen natural person
means.
(2) For definitions not included in this Communiqué, the definitions in the Law will be valid.
Scope of the obligation to inform
ARTICLE 4 – (1) According to Article 10 of the Law; data controllers during the acquisition of personal data
or by authorized persons, the relevant persons must be informed. While fulfilling this obligation, the data
The information to be made by the responsible or authorized persons should include at least the following subjects
required:
a) Identity of the data controller and its representative, if any,
b) For what purpose the personal data will be processed,
c) To whom and for what purpose personal data can be transferred,
ç) Method and legal reason for collecting personal data,
d) Other rights of the person concerned as listed in Article 11 of the Law.
Procedures and principles
ARTICLE 5 – (1) Verbal, written, audio recording, call center by the data controller or the person authorized by him.
During the fulfillment of the lighting obligation by using physical or electronic media such as
The following procedures and principles must be followed:
a) Every time personal data is processed depending on the explicit consent of the data subject or other processing conditions in the Law.
In this case, the obligation to illuminate must be fulfilled.
b) When the purpose of personal data processing changes, the obligation to inform for this purpose before the data processing activity
must also be fulfilled.
c) If personal data is processed for different purposes in different units of the data controller, the obligation to inform
must be fulfilled separately by each unit.
ç) If there is an obligation to register with the Registry, to the person concerned within the framework of the obligation to inform.
The information to be provided must be compatible with the information disclosed in the Registry.
d) The fulfillment of the obligation to inform is not dependent on the request of the person concerned.
e) The proof of fulfillment of the obligation to inform belongs to the data controller.
f) In case the personal data processing activity is carried out based on the condition of explicit consent, the clarification
Obligation and obtaining explicit consent must be fulfilled separately.
g) The purpose of processing personal data to be disclosed within the scope of the obligation to inform must be specific, clear and legitimate
must. While fulfilling the obligation to inform, general and vague expressions should not be used. on the agenda
Expressions that lead to the opinion that personal data can be processed for other possible purposes should not be used.
ğ) The notification to be made to the person concerned within the scope of the disclosure obligation must be in an understandable, clear and plain language
must be performed using
h) What is meant by “legal reason” in subparagraph (ç) of the first paragraph of Article 10 of the Law, illumination
Which of the processing conditions specified in Articles 5 and 6 of the Law
processed based on it. Clearly stating the legal reason during the fulfillment of the obligation to inform
required.
ı) Purpose of transfer of personal data and recipient groups to be transferred, within the scope of disclosure obligation
should be specified.
i) Within the scope of the disclosure obligation, the personal data may be fully or partially automated or
It should be clearly stated which of the non-automatic methods is obtained, provided that it is part of the registration system.
should be specified.
j) While fulfilling the obligation to inform, it contains incomplete, misleading and incorrect information to the relevant persons.
should not be given.
Obligation to inform if personal data is not obtained from the person concerned
ARTICLE 6 – (1) In case the personal data is not obtained from the person concerned;
a) Within a reasonable time from the acquisition of personal data,
b) In case the personal data will be used for communication with the person concerned, the first contact should be made.
during,
c) If personal data is to be transferred, at the latest at the time of the first transfer of personal data.
The obligation to inform the person concerned must be fulfilled.
Force
ARTICLE 7 – (1) This Communiqué enters into force on the date of its publication.
Executive
ARTICLE 8 – (1) The provisions of this Communiqué are executed by the President of the Personal Data Protection Authority.

