TurkeyRegulation on Erasure, Destruction or Anonymization of Personal Data (Resmî Gazete 28 October 2017, No. 30224)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes personal data of a person in Turkey must erase, destroy or anonymize the data, on its own initiative or at the person's request, once all the conditions for processing under Articles 5 and 6 of Law No. 6698 have ceased.
These lines are LexLint's reading of the law's text.
What record it asks for
Log retention
Three years is the minimum for records of erasure, destruction and anonymization; other legal obligations may require longer.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 7(3) requires every erasure, destruction or anonymization to be recorded and the records kept for at least three years, subject to other legal obligations.
- Kind
- Explicit
- As of
- Provision
- Regulation on Erasure, Destruction or Anonymization of Personal Data, Art. 7(3)
- Trigger
- personal_data_processing
What this law does
Article 7(1) requires a controller to erase, destroy or anonymize personal data, on its own initiative or at the data subject's request, once all the conditions for processing under Law No. 6698 Arts. 5 and 6 have ceased. Article 7(3) requires a controller to record every erasure, destruction or anonymization and to keep those records for at least three years, subject to other legal obligations.
Article 5(1) requires a controller that must register in the Data Controllers Registry to prepare a retention and destruction policy that matches its processing inventory. Article 11(2) caps the interval between periodic destructions set in that policy at six months. Article 11(3) requires a controller without such a policy to erase, destroy or anonymize the data within three months after the duty arose.
Article 12(1)(a) requires a controller to conclude a data subject's erasure request within thirty days at the latest and to inform the data subject.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .