Page 1

6951
PERSONAL DATA PROTECTION INSTITUTION ORGANIZATION REGULATION

History of the Council of Ministers Decision : 17/1/2018 No : 2018/11296
History of the Law Based on
: 24/3/2016 No : 6698
Date of Official Gazette Published: 26/4/2018 No: 30403
The Order of the Published Code
:5
Volume : 59

FIRST PART
Purpose, Scope, Basis and Definitions
Purpose and scope
ARTICLE 1- (1) The purpose of this Regulation; Organization of the Personal Data Protection Authority
structure, the duties, authorities and responsibilities of the service units and the working procedures and principles.
is to determine.
Rest
ARTICLE 2- (1) This Regulation is about Personal Data dated 24/3/2016 and numbered 6698.
It has been prepared on the basis of the fifth paragraph of Article 25 of the Law on the Protection of the Conservation.
Definitions
ARTICLE 3- (1) In the implementation of this Regulation;
a) Chairman: Chairman of the Personal Data Protection Authority,
b) Law: Law on Protection of Personal Data dated 24/3/2016 and numbered 6698,
c) Board: Personal Data Protection Board,
ç) Institution: Personal Data Protection Authority,
d) Member: Member of the Personal Data Protection Board,
means.
SECOND PART
Personal Data Protection Authority

Institution
ARTICLE 4- (1) The Institution consists of the Board and the Presidency.
(2) Service units of the Institution are organized in the form of departments.
(3) The Authority is associated with the Prime Ministry. The headquarters of the institution is in Ankara.
(4) The Institution, its financial resources allocated to it in the relevant legislation, duties and
freely within the procedures and principles determined in its own budget, to the extent required by its powers.
uses.
Duties of the institution
ARTICLE 5- (1) The duties and authorities of the Institution are as follows:
a) To follow the practices and developments in the legislation in terms of its field of duty,
to make evaluations and suggestions, to carry out research and examinations or to have them made.
b) In case of need, public institutions and organizations in matters falling within their scope of duty,
to cooperate with non-governmental organizations, professional organizations or universities.

Page 2

6952
c) To monitor and evaluate international developments related to personal data,
Collaborating with international organizations on issues within the scope of the project, participating in meetings.
ç) Submit the annual activity report to the Presidency of the Turkish Grand National Assembly.
To present their rights to the Investigation Commission and the Prime Ministry.
d) To perform other duties assigned by law.
THIRD PART
Personal Data Protection Board

Board
ARTICLE 6- (1) The Board is the decision making body of the Institution. Board; one President, one Vice President
consists of nine members. The Board elects the Chairman and the Deputy Chairman from among its members.
Duties and powers of the board
ARTICLE 7- (1) The duties and powers of the Board are as follows:
a) To ensure that personal data is processed in accordance with fundamental rights and freedoms.
b) To decide on the complaints of those who claim that their rights regarding personal data have been violated.
connect.
c) Upon a complaint or ex officio in case of learning about the alleged violation,
To examine whether personal data is processed in accordance with the law, and
to take temporary measures in this regard when necessary.
ç) Regulatory action to determine obligations regarding data security
make.
d) Adequate measures to be taken for the processing of sensitive personal data
to determine.
e) To ensure that the Data Controllers Registry is kept.
f) Procedure for deletion, destruction or anonymization of personal data
and set the fundamentals.
g) Necessary regulatory affairs regarding the duties of the Board and the functioning of the Agency.
make transactions.
ğ) Regarding the duties, powers and responsibilities of the data controller and its representative
take regulatory action.
h) Countries with and without adequate protection for data transfer abroad
determine and declare.
ı) Sectoral practice regarding the protection, processing and security of personal data
principles and procedures and procedures in accreditation, certification, training and guidance.
determine the fundamentals.
i) To inform institutions and organizations about the protection of personal data, and
to carry out awareness activities for the public.
j) Cooperation with universities and other relevant domestic and foreign institutions and organizations, and
carry out coordination work.
k) To decide on the administrative sanctions stipulated in the law.
l) Legislation prepared by other institutions and organizations and containing provisions regarding personal data
give an opinion on the drafts.

Page 3

6953
m) The Institution; to decide on the strategic plan, aims and objectives, service quality
set standards and performance criteria.
n) The budget proposal prepared in accordance with the strategic plan and objectives and targets of the institution.
discuss and decide.
o) Institution's performance, financial situation, annual activities and matters needed
Approving and publishing draft reports on
ö) Discussing and deciding on the proposals on the purchase, sale and lease of immovable
connect.
p) To perform other duties assigned by law.
CHAPTER FOUR
Presidency Organization
Presidential
ARTICLE 8- (1) Presidency; Vice President and service units under the President
occurs.
President
ARTICLE 9- (1) The Chairman is elected by the Board from among the members of the Board.
(2) The President is the highest supervisor of the Authority in the capacity of the Chairman of the Board and the Authority.
its services to the legislation, the objectives and policies of the Institution, its strategic plan, and performance criteria.
and in accordance with the service quality standards, conducts and maintains between service units.
provides coordination.
(3) The President is responsible for the general management and representation of the Institution. This responsibility is
organization, execution, supervision, evaluation and, where necessary,
public disclosure includes its duties and powers.
(4) The duties and powers of the President are as follows:
a) To conduct the meetings of the Board.
b) Notification of Board decisions and public announcement of those deemed necessary by the Board.
ensure and monitor their implementation.
c) To appoint the Vice President, the heads of departments and the Institution personnel.
ç) To present the suggestions coming from the service units to the Board by giving their final shape.
d) Ensuring the implementation of the strategic plan, in line with the service quality standards,
create resources and work policies.
e) With the annual budget of the Institution in accordance with the determined strategies, annual goals and targets.
preparing financial statements.
f) In a harmonious, efficient, disciplined and regular manner, the Board and service units
To provide coordination for work.
g) To carry out the relations of the institution with other institutions.
ğ) To determine the area of ​duty and authority of the personnel authorized to sign on behalf of the President of the Institution.
h) To perform other duties related to the management and operation of the Institution.

Page 4

6954
Deputizing for the President
ARTICLE 10- (1) The Board elects one of the members as the Deputy Chairman. your president
In the absence of the Vice-President, in his absence, a member appointed by the President
Deputizes for the President.
vice president
ARTICLE 11- (1) The Vice-President shall assist the President in his duties related to the Presidency.
To ensure that the duties assigned by the relevant legislation and Board decisions are fulfilled,
to ensure harmony and cooperation between service units and to other
responsible for carrying out their duties.
(2) of the Vice President; at least four years of higher education graduate and ten years
must have been in public service for a period of time.
Service unit managers
ARTICLE 12- (1) Managers of service units are appointed by the President.
(2) Heads of departments; at least a four-year higher education institution graduate and a ten-year period
must have been in public service.
(3) Service unit managers; laws, regulations, other relevant legislation and the Board
to fulfill the duties assigned to the unit with its decisions, to ensure harmony, cooperation and
They are responsible for ensuring the division of labor and performing other duties assigned by the President.
CHAPTER FIVE
Service Units and Duties

Service units
ARTICLE 13- (1) The service units of the Institution are as follows:
a) Data Management Department.
b) Department of Investigation.
c) Department of Legal Affairs.
ç) Department of Data Security and Information Systems.
d) Guidance, Research and Institutional Communication Department.
e) Department of Human Resources and Support Services.
f) Strategy Development Department.
Data Management Department
ARTICLE 14- (1) The duties of the Data Management Department are as follows:
a) Studies on the determination of the procedures and principles regarding the processing of personal data
execute.
b) Duties, powers and responsibilities of the data controller, representative and contact person
to carry out related business and transactions.
c) To carry out the works and transactions related to the Data Controllers Registry.
ç) Carrying out all kinds of informative studies regarding data controllers.
d) To carry out the works related to the exceptions to the obligation to register with the data controller registry.
e) Those who do not fulfill their obligations to register and notify the data controllers,
and to carry out business and transactions related to legal entities.
f) To carry out the works and transactions about those who do not fulfill their obligation to inform.

Page 5

6955
g) Data controllers' work and transactions related to the registry module Data Security and Information
Coordinate with the Systems Department.
ğ) To carry out studies on data deletion, destruction and anonymization procedures.
h) To perform other duties assigned by the President.
Department of Investigation
ARTICLE 15- (1) The duties of the Inspection Department are as follows:
a) To carry out the works and procedures regarding the application to the data controller and the complaint made to the Board.
b) To carry out preliminary examinations and fundamental examinations regarding the complaints made to the Board.
c) To carry out the works and transactions related to the examination upon complaint or ex officio.
ç) Business and transactions related to the complaint application and follow-up system Data Security and Information
Coordinate with the Systems Department.
d) Actions and transactions regarding those who do not fulfill the decisions given by the Board
execute.
e) The Board meeting, which includes the topics deemed appropriate to be included in the agenda by the Chairman.
preparing the agenda, presenting the agenda and the comments on the agenda items to the members of the Board.
distribute.
f) To keep and preserve the records of the Board meetings upon request.
g) Opening the resolutions taken by the Board for signature, following the completion of the signatures.
to send the decisions to the relevant units.
ğ) To ensure that the persons requested by the Board attend the meeting.
h) To record the decisions taken at the meetings of the Board in the minutes,
To have the page signed by the members attending the meeting.
ı) To make the correspondence of the Board, to create an archive regarding the decisions and correspondences and to
to preserve.
i) To publish the Board decisions requested to be published on the website of the Agency.
provide.
j) To perform other duties assigned by the President.
Department of Legal Affairs
ARTICLE 16- (1) The duties of the Department of Legal Affairs are as follows:
a) Representing the Institution in lawsuits and enforcement proceedings to which the Institution is a party ,
to follow up, to ensure that it is finalized, to freelance lawyers and/or when necessary
To carry out transactions regarding the conclusion of attorney contracts with attorney partnerships.
b) In legal matters related to the duties of the Institution; judicial and administrative courts, arbitrators,
enforcement offices, commissions and relevant public institutions and organizations and international arbitration
To represent the Institution before the courts.
c) Regarding the waiver of litigation or enforcement proceedings or application to legal remedy
settlement of disputes that have been brought to court or execution by means of amicable transactions or
to carry out the proceedings regarding the acceptance of the case.
ç) To give legal opinion on matters referred by the Chairman or the Board,
To make an assessment regarding the use of legal remedies.

Page 6

6956
d) Requesting opinions on legal issues that are hesitant by the units of the Institution.
in the framework of the legislation and general law rules regarding the questions asked.
To notify the relevant unit of legal opinion regarding the issue.
e) Other public institutions and organizations in relation to the Authority's field of duty or the Authority's
To give legal opinion on the legislative drafts prepared by the service units.
f) In exceptional cases that require special specialization, the expert person and
To carry out procedures regarding obtaining legal opinions from institutions.
g) Countries where there is adequate protection for the transfer of personal data abroad
carry out the determination process.
ğ) To perform other duties assigned by the President.
Data Security and Information Systems Department
ARTICLE 17- (1) Duties of the Data Security and Information Systems Department
are:
a) To carry out works and transactions related to data security.
b) To ensure the appropriate level of security in order to ensure the protection of personal data.
To carry out the procedures for taking all necessary measures to prevent
c) Obtaining personal data by others illegally
To carry out the actions related to the measures to be taken regarding the situation.
ç) To determine the measures to be taken for the processing of sensitive personal data.
carry out related work.
d) Business and transactions related to those who do not fulfill their obligations regarding data security
execute.
e) To determine the security measures to be taken regarding data transfer.
f) To meet the information processing and automation needs of the units of the institution and to ensure their operation.
To provide information processing services of the Institution.
g) In accordance with the information infrastructure of the Institution, the relevant department
To ensure that it is designed and implemented together with the departments, to follow the technological developments.
to take the measures required by the information and data security, to take the policies and principles
To determine, to produce solutions in accordance with public informatics standards.
ğ) The establishment, maintenance, supply, development and improvement of the existing information infrastructure of the institution.
to carry out works related to updating, to ensure communication security and to undertake duties in these matters.
in-service regularly in parallel with the developments in information technologies.
to provide them with an education.
h) With applications such as the institution's web pages, electronic signature and electronic document
to carry out relevant technical studies.
ı) To carry out studies to ensure the cyber security of the institution.
i) To collect information about the services of the institution and to collect data in cooperation with the relevant units.
build the bases.
j) To perform other duties assigned by the President.
Department of Guidance, Research and Institutional Communication
ARTICLE 18- (1) Department of Guidance, Research and Institutional Communication
their duties are:
a) Determining the standards for the protection of personal data, authorization and
executing certification processes.

Page 7

6957
b) Public institutions and organizations operating in the fields of duty of the Authority,
Plans and programs to guide natural and legal persons and voluntary organizations in their activities
create and guide
c) To carry out research and projects on the subjects that the institution may need related to its field of duty,
to get them out of commission work, by proposing the establishment of specialized commissions when necessary.
present the results to the Board.
ç) National and international institutions and organizations, universities
and to cooperate with non-governmental organizations; collaboration with them, research, education
arranging programs.
d) Documentation, publication and archive services related to the educational activities of the institution.
To carry out the library services of the institution.
e) To provide, develop and carry out relations with public institutions and private institutions.
f) Developing cooperation at the national and international level of the Institution and promoting the Institution.
to carry out related works.
g) To report and archive the domestic and international duties and activities of the Institution.
ğ) In line with corporate objectives and policies, the communication strategy of the Institution
To ensure the establishment and execution of the press, in line with these purposes and policies.
and to carry out relations with broadcasting organizations.
h) Press in order to inform the public about the activities of the institution.
To prepare announcements, bulletins, news and announcements.
ı) In the press and social media about the subjects falling within the scope of the Authority,
following news, articles and programs and creating their archive,
to inform, to prepare or have media analysis reports prepared when necessary,
To ensure that the relevant news is announced to the relevant units and all personnel.
i) To be made within the scope of the Law No. 4982 on the Right to Information dated 9/10/2003
the proceedings regarding the finalization of the applications and other applications of this nature.
ensure coordination.
j) To perform other duties assigned by the President.
Department of Human Resources and Support Services
ARTICLE 19- (1) Duties of the Department of Human Resources and Support Services
are:
a) Determining the human resources policy of the institution, career and education of the personnel
preparing and implementing plans.
b) To determine personnel needs, to use human resources effectively and efficiently.
To ensure the use of staff, to make the distribution and allocation of the staff of the Institution.
c) Determination and development of the qualifications and competencies of the personnel of the Authority.
To establish policies for this purpose, to cooperate with relevant units, institutions and organizations.
ç) To prepare the in-service training plan of the institution and to organize training programs.
d) Carrying out general paperwork.
e) The President, by accruing the financial and social rights of the members and the personnel of the Agency.
ensure payment; assignment, transfer, performance, promotion, personnel, retirement, property declaration and similar
to carry out transactions.

Page 8

6958
f) The theses that need to be prepared in order for assistant experts to become experts and the
To carry out the work and procedures related to the exams.
g) Public Financial Management and Control Law No. 5018 dated 10/12/2003
within the framework of all kinds of purchase, rental, maintenance, repair, construction, archive,
to carry out health, social and similar services.
ğ) To keep records of movable and immovable properties belonging to the Institution.
h) To perform other duties assigned by the President.
Strategy Development Department
ARTICLE 20- (1) The duties of the Strategy Development Department are as follows:
a) Law No. 5018, Public Financial Management and Control dated 22/12/2005 and numbered 5436
About Making Amendments to the Law and Some Laws and Decrees
to strategy development and financial services units with Article 15 of the Law and other legislation.
to do the assigned tasks.
b) The Institution; to prepare the strategic plan, to set its goals and objectives, service quality standards
and set performance criteria.
c) To submit the budget proposal in accordance with the strategic plan and objectives and targets of the institution.
prepare.
ç) Institution's performance, financial situation, annual activities and matters needed
to prepare a report on
d) To prepare the financial reports and final account of the Institution.
e) The budget, annual business plan, income-expenditure final accounts, annual report and
to carry out transactions related to other reports, transferring between budget items when necessary
to carry out the work to be done.
f) Consolidated income statements, balance sheets and annual statements of the previous financial year
to prepare the annual report containing the comprehensive financial statements based on the activities and, at the latest, to the next
their efforts to send them to the relevant places for information until the end of April of the year, and
To carry out the procedures related to the release of the budget.
g) To carry out the transactions related to the collection and follow-up of the Institution's revenues,
managing and maintaining its existence.
ğ) Institutional expenditures, within the framework of the approved budget and in accordance with the expenditure procedures and principles.
to ensure its realisation.
h) To carry out the transactions related to the chart of accounts and accounting records of the Institution.
ı) To keep and publish statistical information about the works falling within the scope of the Agency's duties.
i) To ensure the implementation of the legislation on financial issues.
j) To perform other duties assigned by the President.
CHAPTER SIX
Institution Staff
Title and numbers
ARTICLE 21- (1) Not to exceed the total number of staff, dated 13/12/1983 and numbered 190
Staff in the tables annexed to the Decree-Law on General Staff and Procedure
changing titles and degrees, adding new titles and vacancies, limited to their titles.
Cancellation of positions is made by the decision of the Board.

Page 9

6959
(2) The President is authorized to distribute the personnel by service units.
Personnel employment
ARTICLE 22- (1) Institution personnel are appointed by the President.
(2) Providing advisory services to the President and other duties assigned by the President.
Advisor to the President, the number of which should not exceed ten in total, according to the need, in order to
assignable. At least the head of department or the person to be appointed from the Institution to the positions of advisor to the Presidency
Having served as a member of the Board; Those who will be appointed from outside the institution are in the public service for at least ten years
they must have professional experience or an academic title of doctoral degree.
(3) Organizing and executing the President's program, making official and private correspondence,
A meeting is held by the President to ensure the representation of the President and the members in meetings and organizations.
The Clerk of the Private Office is appointed.
CHAPTER SEVEN
Miscellaneous and Final Provisions
Internal audit
ARTICLE 23- (1) Internal audit, examination and investigation procedures are carried out by the President.
carried out by the appointed officials. From these transactions and results, the Board's duties and
It is obligatory to submit the matters falling under its jurisdiction to the Board.
regulatory authority
ARTICLE 24- (1) Regarding the issues that are not included or are not clear in this Regulation,
to decide, regulate and direct the implementation within the framework of the provisions of the legislation.
The board is authorized.
Force
ARTICLE 25- (1) This Regulation enters into force on the date of its publication.
Executive
ARTICLE 26- (1) The provisions of this Regulation are executed by the President.

