Privacy and Data Protection Regulation

This chapter aims to provide an overview of data protection and privacy laws in Turkey, especially from the point of Turkish Data Protection Act No. 6698, which entered into force on April 7, 2016, and related secondary legislation. The Act is implemented by the Turkish Data Protection Authority, which is a public legal institution with administrative and financial autonomy. First, the legislative framework and legal sources for privacy and data protection are explained in this chapter. Second, the purpose and scope (material and territorial) of the law are clarified. Not only the fundamental concepts and general principles of Turkish data protection law are explained, but the requirements for lawful data processing, both for regular and sensible data, are briefly described. The legal framework and methods for cross-border transfer of personal data are analyzed, considering the recent developments and revisions of the law. Finally, the concept of data breach is defined, and the procedures and legal consequences are laid down in the chapter.