COMMUNIQUÉ ON THE PROCEDURES AND PRINCIPLES OF APPLICATION TO THE DATA CONTROLLER
Purpose and Scope
ARTICLE 1 – (1) This Communiqué has been prepared to determine the procedures and principles on the application to the data controller and the fee to be paid if the procedure requires any fee.
Base
ARTICLE 2 – (1) This Communiqué has been prepared based upon Article 13 and Article 22, paragraph one, subparagraphs (e) and (g) of the Law on Personal Data Protection No 6698 and dated March 24, 2016.
Definitions
ARTICLE 3 – (1) In this Communiqué;
a) Application means the application made as per Article 13 of the Law,
b) Secured Electronic Signature means the electronic signature which is exclusively connected to the signatory, can only be used by the signatory, is formed to make a secured electronic signature, helps to determine the identity of the signatory based on the qualified electronic certificate, helps to find out if any change has been made in the signed electronic data,
c) Related person means the real person, whose data is being processed,
ç) Law means the Law on Personal Data Protection No 6698 and dated March 24, 2016
d) Registration Media means any media where the personal data is processed via fully or partially automatic means or non-automatic means provided that it is part of a data registry system,
e) Registered electronic mail (REM) address means a qualified version of electronic mail that provides legal evidence for use of electronic messages, including their transmission and delivery,
f) Board means the Board of Personal Data Protection,
g) Authority means the Authority of Personal Data Protection,
ğ) Mobile signature means the electronic signature created by using a mobile device,
(2) The definitions in the Law shall apply to any terms that are not defined in this Communiqué.
Application right
ARTICLE 4 – (1) Real persons whose data are registered have the right to apply to the data controller.
(2) Related persons may enjoy this right provided they make the application in Turkish.
Application Procedure
ARTICLE 5 – (1) Related person, within the scope of his/her rights in Article 11 of the Law, conveys his/her requests to the data controller in writing or via registered electronic mail (REM) address, secured electronic signature, or mobile signature, or by using the electronic mail address that has been previously notified to the data controller and is registered with the system of the data controller or via a software or application that has been developed for the purposes of the application
(2) In the application following items must exist;
a) Name, surname, and if it is a written application, signature
b) Turkish Republic ID number for Turkish citizens and passport number and nationality for foreigners or ID number if any,
c) Residence and work address for notification.
ç) If any electronic mail address, telephone and fax numbers for notification purposes.
d) It is obligatory that the subject matter of request must exist.
(3) Information and documents relating to the subject matter are attached to the application.
(4) In written applications, the date on which the document is delivered to the data controller or representative is considered the application date.
(5) In applications made via other means; the date on which the application is delivered to the data controller is considered the application date.
Response to the Application
ARTICLE 6 – (1) Data controller is obliged to take any necessary administrative and technical measures in order to conclude the applications of a related person effectively, in compliance with law and the rule of honesty.
(2) Data controller either accepts or rejects the application by giving the reasoning thereof.
(3) Data controller delivers his/her response to the related person in writing or via an electronic media.
(4) It is obligatory that the response letter includes;
a) Information of the data controller or representative,
b) Applicant’s name and surname, Turkish Republic ID number if Turkish citizen, and passport number and nationality if a foreigner or ID number if any, residence or work address for notifications, electronic mail address, telephone and fax numbers for communication,
c) Subject matter of the request,
ç) Explanations of the data controller regarding the application.
5) Data controller concludes the requests in the application as soon as possible and no later than thirty days free of charge, depending on the type of the request. However, if the transaction requires any further costs, the transaction may be charged with the fee in Article 7. If the application is made due to the mistake of the data controller, the fee is paid back.
(6) In the event that the request of the related person is accepted, the request is fulfilled by the data controller as soon as possible and the fulfilment is notified to the related person.
Fee
ARTICLE 7 – (1) If the response to the related person will be in writing, it will be free of charge up to ten pages. After ten pages, every page may be charged with a fee of 1 Turkish Lira.
(2) In the response to the application will be provided in a recording media such as CD and flash memory, the data controller may not charge more than the cost of the recording media.
Effectiveness
ARTICLE 8 – (1) This Communiqué enters into force on the date it is published.
Enforcement
ARTICLE 9 – (1) The provisions of this Communiqué are enforced by the Head of the Authority of Personal Data Protection.
