TurkeyPersonal Data Protection Law (KVKK), data subject rights
Law No. 6698, Art. 11(1)(a)-(f) and (ğ)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must give a person in Turkey a way to learn whether their personal data is processed, access information about that processing, and request correction or erasure.
These lines are LexLint's reading of the law's text. Also read by: Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.kvkk.gov.tr/Icerik/2062/Basvuru-Hakki
- Guidance body
- Kişisel Verileri Koruma Kurumu (Personal Data Protection Authority of Türkiye)
- Open questions
- Must a controller that has prepared a retention and destruction policy erase personal data on a data subject's request under Article 11(1)(e) within the thirty days that Article 13(2) allows, or may it wait for the first periodic destruction run after the duty arose (ilk periyodik imha işleminde, "at the first periodic destruction run")?
What it makes you log
Logging duty
Article 11(1)(a) to (f) and (ğ) give the data subject the right to ask the controller whether data is processed, for what purpose, to whom it was transferred, to have it corrected or erased, and to claim compensation. They create rights of the data subject and name no record or log the controller must keep, no retention period and no inspector; the procedure for answering requests (Article 13) is not cited by this row.
- Kind
- None
- As of
What this law does
Art. 11 gives a data subject the right to learn whether their data is processed, to request information on processing, to learn its purpose and whether use matches that purpose, to know the data's domestic and foreign transferees, to request rectification, to request erasure or destruction under Art. 7, to have those operations reported to prior transferees, and, at Art. 11(1)(ğ), to claim compensation for damage from unlawful processing.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .