Protection of Personal Data
Protection of Personal Data
Within the scope of the Law on Protection of Personal Data No. 6698, companies operating in Turkey and processing personal data of citizens of the Republic of Turkey are subject to important legal obligations. At this point, every company has to follow a certain roadmap and comply with the legal regulations brought by the Law No. 6698.
It is sufficient for natural and legal persons who process personal data, called data controllers, to process the personal data of the citizens of the Republic of Turkey, to be within the scope of the Law No. 6698; It does not matter whether the data controller is located in Turkey or not.
With the Law No. 6698, the collection, processing, sharing or transfer of personal data, including general personal data such as name, contact and identity information, and sensitive personal data such as health, ethnicity, religion, sexual life, by natural and legal persons is legally regulated. In this context, especially commercial companies are obliged to fulfill some technical and legal requirements regarding the personal data they process on behalf of their employees and customers. In addition, companies that meet certain criteria must be registered in the Data Controllers Registry Information System (VERBIS) run by the Authority.
In order to ensure that personal data is processed in accordance with the law, the Personal Data Protection Authority was established within the scope of Law No. 6698. The Institution is obliged to ensure that personal data is processed in accordance with the law; has the power to impose serious administrative sanctions. Penalties for each company by 2023 can range from $1,500 to $315,000, depending on the severity of the violation.
The concept of personal data processing refers to all kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, classifying or preventing its use in accordance with the law.
What Does Personal Data Processing Mean?
The concept of personal data processing, in legal terms, refers to all kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosure, transferring, taking over, making available, classifying or preventing the use of personal data.
KVKK Uyum Projeleri Yol Haritası
Scoping
It is the stage of determining the business processes of the company and determining the personal data processed in these processes. The personal data being processed are categorized separately within the scope of business processes.
Data Inventory
Categorized personal data is inventoried within a certain template. Whether or not VERBIS is obligatory, every company has to create an inventory of the personal data it processes.
Awareness Raising
The first thing to do is to instill the awareness that personal data has value and they have rights over this value to all staff that make up the company, with a human-oriented mindset.
Reconstruction
Due to the regulations on the protection of personal data, there will be a need for regulations in the structure of the company, especially at the point of storage and transfer of data, in line with the determined scope and the data inventory created.
Legal Texts
It will be necessary to prepare policy and procedure texts, especially information texts, for the persons whose data are processed. In the process of personal data processing, lighting is a must in terms of transparency.
VERBIS REGISTRATION
In the presence of certain conditions, there is a liability for registration in the registry kept at the institution. Based on the data inventory created, the personal data being processed are recorded in categories.
Trainings
The protection of personal data is shaped around the human factor. Therefore, according to the new regulations, it is important to provide the necessary information and training to the personnel.
conclusion
Data protection compliance should be seen as a project with a beginning but no end. In this context, it would be appropriate to conduct complementary trainings according to current situations and to receive consultancy services from lawyers.
