Page 1

PERSONAL NO. 6698
DATA PROTECTION
PURPOSE OF THE LAW AND
SCOPE

Page 2

GOAL
In 2010, with the Law No. 5982, the 20th Amendment of the Constitution.
With the paragraph added to the article, everyone is related to himself.
The right to demand the protection of personal data is a constitutional
is guaranteed as a right. In this context,
on personal data concerning individuals.
what rights and authorities it has and personal data
in which cases it can be processed, personal
procedures and principles regarding data protection.
is anticipated to take place.
As a matter of fact, the purpose of the Law is clearly stated in Article 1 of the Law.
specified as follows. Pursuant to this provision, the purpose of personal data is
privacy, in particular the privacy of
protect the fundamental rights and freedoms of individuals and
with the obligations of natural and legal persons processing the data
to regulate the procedures and principles that they will comply with.
As stated in the justification of the article, the Law
The purpose is to discipline the processing of personal data.
and the privacy of private life envisaged in the Constitution.
protection of fundamental rights and freedoms. Law
privacy of the person, which has gained importance in recent years with
ensuring data security and personal

one

Page 3

Obligations of natural and legal persons processing data
arranging the procedures and principles that they will comply with
evaluated in scope.
By law, personal data is unlimited and arbitrary.
collection, making it accessible to unauthorized persons,
as a result of disclosure or misuse or misuse.
prevention of violation of personal rights
is intended.
Subject to which rules, under which conditions personal data
the purpose of controlling the
The law governing the control over the processing of personal data
by introducing mechanisms, these data can be illegally
aims to prevent its processing. Also, personal
with the obligations of natural and legal persons processing the data
Regulation of the procedures and principles to be followed by the Law
among its objectives.
Pursuant to this article, the purpose of the Law is:
• In the processing of personal data, the fundamental rights and
protect their freedom,
• Natural and legal persons processing personal data
obligations and procedures and principles that they will comply with
to regulate (discipline),
• To protect the privacy of individuals,
• Ensuring personal data security,
can be counted as
2nd

Page 4

SCOPE
I. SCOPE OF THE LAW
In Article 2 of the Law, the scope of the Law is specified.
According to this article, the Law, the real data whose personal data are processed,
with persons who have this data fully or partially automated.
or be part of any data recording system
real and non-automatic
apply to legal persons.
In terms of public institutions and private organizations in the law
no distinction is made. The procedures and principles determined by the law
As a rule, it applies to all institutions and organizations.
Therefore, personal data processed by public institutions
The provisions of this Law shall apply to
protected under the Law No. 6698.
personal data belonging to real persons only
data, and those belonging to legal entities are under protection.
not available. However, if the data belonging to the legal person
identification of one or more natural persons
such data should also be

3

Page 5

It may be possible to benefit from the protection of the law.
In this case, the protected, real person
are personal data.
In the law, personal data is partially or completely automated.
being part of any data recording system
for processing by non-automatic means, provided that
No difference was anticipated. In this direction
in a way that facilitates access to personal data,
any system structured according to a criterion Law
will be evaluated within the scope of
Today, personal data is largely automated.
ways are processed. not automatic before
data processed in many ways, in many places
appears to have been transmitted electronically. It depends on this
processed by fully or partially automated means.
data” and “part of any data recording system”
data processed by non-automatic means”
It has been taken under protection under the Law No. 6698.
Therefore, the Act committed by non-automatic means
does not exclude the data completely.
What is important here is processed by non-automated means.
whether the data is part of the data recording system.
For example, regardless of any criteria, people
the place of the first and last names on the paper in a random way
Although it is not within the scope of the Law,

4

Page 6

the names in question on a piece of paper according to a certain criterion
In case of recording, this data recording is within the scope of the Law.
will be evaluated. In this context:
• In the law, “partly or fully automatically
clarification of what the term "processing" means
has not been achieved. Council of Europe No. 108
In its contract, from the expression "automatic processing";
record of data, logical and/or arithmetic
execution of transactions, modification of data,
deletion, retrieval or distribution
automatic or partially automatic
expression that can be realized by means of
has been done.
• Being part of any data recording system
data processed by non-automatic means
It is also protected under the Law No. 6698.
The data recording system is defined in Article 3 of the Law as “personal
data is processed and structured according to certain criteria.
registration system”. Hence
hand-processed (manual) data to any criteria
inclusion in a registration system structured according to
6698 regarding such data.
The law will be applied.

5

Page 7

• Personal data processed by non-automatic means is a data
Covered by law if not part of the registration system
will not be evaluated. But this is about
Since it will not affect the personal data quality of the data, this
Unlawful actions regarding data, numbered 5237.
to constitute a crime under the Turkish Penal Code.
will continue.

6

Page 8

II. TO THE SCOPE OF THE LAW
CASES NOT INCLUDED
The law applies only to data related to natural persons.
Data related to legal entities is not within the scope of this Law.
Because in the 1st article of the Law, “personal data are processed
real persons”.
In addition, the Law regarding the processing of personal data
physically recorded and data
personal data that are not part of the registration system.
not applicable. As a matter of fact, Article 1 of the Law
“fully or partially automatic or any
automatically, provided that it is part of a data recording system.
processing by unlawful means” was used.
On the other hand, in Article 28 of the Law, wholly or
cases that are partially out of scope have been adjudicated.
Full exceptions in paragraph 1 of this article, paragraph 2
Partial exceptions have been made. in full exception
The provisions of the law will not be applied in any way. Partial
In exceptional cases, only some provisions of the Law
will not be applied.

7

Page 9

A) Completely Covered by Law
Conditions Excluded
In the first paragraph of Article 28 of the Law,
Cases not included in the scope are counted one by one. These:
• Personal data not to be given to third parties and data
provided that the obligations regarding safety are complied with
by natural persons wholly with himself or herself or
activities related to family members living in the same residence
processing under
• Anonymization of personal data with official statistics
research, planning and statistics
processing for purposes such as
• Personal data can be used to protect national defense, national security, public
security, public order, economic security,
Violation of privacy or personal rights
art, provided that it does not constitute a crime or
for historical, literary or scientific purposes or for expression
processed within the scope of freedom,
• National defense, national security of personal data,
public safety, public order or economic
duties and obligations by law to ensure security

8

Page 10

by authorized public institutions and organizations
preventive, protective and intelligence activities carried out
processing under
• Investigation, prosecution, trial of personal data
or judicial authorities with respect to execution proceedings
or by execution authorities.

Personal data itself or the same
pertaining to family members living in the residence
Processing within the scope of activities:
Personal data not to be given to third parties and data
provided that the obligations regarding safety are complied with
by natural persons wholly with himself or with the same
within the scope of activities related to family members living in the residence
In case of processing, the provisions of the Law do not apply.
Within the scope of this paragraph; family members living in the same residence
Exceptions to the processing of data within the family
subject. For example, on special occasions such as birthdays
Photographs taken within the family are within the scope of this Law.
is not. However, sharing this data with third parties
or if it is made public, for example on a birthday
on social media so that the photos taken are public
In case of sharing, no exception will be mentioned.

9

Page 11

Anonymous with official statistics of personal data
research by making
for purposes such as planning and statistics
processing:
Anonymization of personal data with official statistics
research, planning and statistics
Provisions of the Law in case of processing for purposes such as
not applicable. Accordingly, the official statistics of personal data
in case of processing within the scope of the law provisions
will not be applied.
On the other hand, it is used for purposes such as research, planning and statistics.
Anonymity of data after personal data collection
are also covered by the exception. For example, a
in a survey conducted by the public opinion research organization
the subsequent anonymization of the personal data contained therein.
“Like research, planning and statistics”
The word “like” indicates that these are examples.
states. Therefore, similar methods
may be included in the scope. important here
What matters is that this information is anonymized.

10

Page 12

art, history, literature or
for scientific purposes or freedom of expression
processing within the scope of :
National defense, national security, public
security, public order, economic security, private
not to violate the privacy or personal rights of life, or
art, history, literature or
for scientific purposes or within the scope of freedom of expression
In case of processing, the provisions of this Law do not apply.

National defense of personal data, national
security, public safety, public
order or economic security
by law to provide
public institution authorized
and organizations carried out by
preventive, protective and intelligence activities
Processing within the scope of:
National defense, national security, public
security, public order or economic security
mandate and authority by law to provide
preventive, carried out by public institutions and organizations,
processing within the scope of protective and intelligence activities
In this case, the provisions of this Law do not apply. According to this
11th

Page 13

national defense, public security,
national security, public order and economic security
data processed within the scope of activities aimed at providing
are excluded from the scope of the law. Same way,
money laundering for the stated purposes, terrorism
prevention of financing and investigation of financial crimes
activities carried out by authorized units
Data processed within the scope of this exception are also included.

Judicial and enforcement authorities of personal data
processed by:
investigation, prosecution, trial or
judicial authorities or execution
In case of processing by the authorities, this Law
provisions do not apply.

12

Page 14

B) Partially Scope of Law
Conditions Excluded
In the second paragraph of Article 28 of the Law, only certain
in the scope of some articles of the Law in the circumstances and conditions.
non-regulated cases. According to this; of the law
be in accordance with its purpose and basic principles and be proportionate
provided that the data controller is responsible for disclosure.
Article 10, which regulates
Article 11, which regulates the rights of the person concerned, except for the right of
Regulating the obligation to register with the Data Controllers Registry
The provisions of Article 16 are limited to the following fields of activity
does not apply, including:
• Prevention of crime by processing personal data
or necessary for criminal investigation. (For example,
personal data of a suspect in connection with a crime
can be evaluated in this context.
Because what personal data the police process or
tell the suspect for what purposes
if the suspect destroys the relevant data or
There will be a risk of deletion.)
• Personalized personal information made public by the person concerned.
processing of data. (For example, everyone
openly on social media

13

Page 15

processing of data in case of sharing personal data.)
In order to apply this provision, personal data
manifestation of the will to make it public by the person concerned
to be placed and processed in accordance with this will.
must be done.
• Personal data processing is authorized by law.
responsible and authorized public institutions and
organizations and public institutions
institutions, control or regulation
disciplinary investigation or
necessary for prosecution.
• Budget, tax and financial issues of personal data processing
the economic and financial interests of the State with regard to
necessary for its protection. specified in the law
for the non-application of Articles 10, 11 and 16, such as
the occurrence of one of the situations specified in the article
must. However, it should be noted that in any case
In accordance with the purpose and basic principles of the law and proportionally
must be.

14

Page 16

Nasuh Akar Mah. 1407. Street No:4 06520
Balgat-Çankaya/Ankara // www.kvkk.gov.tr
Tel: 0 (312) 216 50 50 // Fax: 0(312) 216 50 52

