TurkeyCommuniqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation (Resmî Gazete 10 March 2018, No. 30356)
In force since .
A privacy notice rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects personal data of a person in Turkey must tell the person, when it collects the data, who the controller is (and its representative, if any), why the data is processed, to whom and why it may be transferred, how and on what legal basis it is collected, and the person's other rights under Article 11 of Law No. 6698.
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
The Communiqué requires a notice to be given and proof that it was given, and names no log of processing events or retention period for one.
- Kind
- None
- As of
What this law does
Article 4(1) requires a controller's notice to the data subject to state, at a minimum, the controller's identity and its representative's, the purpose of processing, to whom and for what purpose the data may be transferred, the method and legal basis of collection, and the data subject's other rights under Law No. 6698 Art. 11. Article 5(1)(f) requires a controller that processes personal data on the basis of explicit consent to give the notice and to obtain the consent as two separate steps.
Article 5(1)(e) places the burden of proving that the notice was given on the controller. Article 5(1)(ğ) requires the notice to be given in clear, plain and understandable language. Article 6(1)(a) requires a controller that did not obtain the data from the data subject to give the notice within a reasonable time after obtaining the data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .