PDPL

PERSONAL DATA PROTECTION LAW
Law Number: 6698
Approval Date: 3/24/2016
Published in the Official Gazette: Date: 7/4/2016 Number: 29677
Law: Published in Sequence: Volume 5 Number: 57

SECTION ONE
Purpose, Scope, and Definitions

Purpose

ARTICLE 1 – (1) The purpose of this Law is to protect the fundamental rights and freedoms of individuals, particularly the privacy of their private lives, in the processing of personal data, and to regulate the procedures and principles that natural and legal persons processing personal data must comply with.

Scope

ARTICLE 2 – (2) The provisions of this Law shall apply to natural persons whose personal data are processed and to natural or legal persons who process such data by fully or partially automated means or by non-automated means provided that they form part of a data recording system.

Definitions

ARTICLE 3 – (1) For the purposes of this Law

(a) “Explicit consent” means freely given, specific, and informed consent,

(b) “Anonymization” means rendering personal data incapable of being associated with any identifiable or identifiable natural person, even when combined with other data,

(ç) “Data subject” (the relevant natural person) means the natural person whose personal data is processed,

(d) “Personal data” means any information relating to an identified or identifiable natural person,

(e) “Processing of personal data” means means any operation performed on personal data, such as collection, recording, storage, retention, alteration, adaptation, disclosure, transfer, acquisition, making available, classification, or restriction of use, whether fully or partially automated or non-automated provided it is part of a data recording system,

(f) “Board” means the Personal Data Protection Board,

(g) “Authority” means the Personal Data Protection Authority,

(h) “Data Processor” means a natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,

(i) “Data recording system” means a system in which personal data is processed according to specific criteria,

(j) “Data Controller” means a natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.