Privacy Policy in Turkish Law
The Turkish Data Protection Law (“TDPL”) was drafted similar to the EU’s Directive 95/46/EC, which was abolished by the EU General Data Protection Regulation (“GDPR”).
The TDPL requires data controllers to register with the Turkish Data Protection Authority (“TDPA”) and to notify them of processing activities of their data subjects, including:
- The name and address of the controller and its representative, if any;
- The purpose or purposes of the processing;
- The recipients to whom the data might be transferred;
- The method and legal basis for the collection of personal data; and
- The data subjects’ rights.
As such, data controllers have an obligation to inform their data subjects about the processing operations they will carry out over the subject’s personal data, which is similar to the GDPR. Based on a recent decision by the TDPA, this processing requirement is also applicable to data controllers located outside of Turkey that carry out personal data processing activities in Turkey directly or through its branches or any of its associated offices.
The obligation to notify the TDPA under the TDPL is usually done by providing information to the data subjects by means of a privacy notice. The TDPA has taken an active role in publishing guidelines to complement the TDPL, including issuing a communiqué to elaborate the content of privacy notices, in that, privacy notices must be written in a way that they are easily understood by the intended audience.
Notably, even if a privacy notice may be compliant with the GDPR, it would not automatically be sufficient to meet the requirements of the TDPL as the TDPL is a bit more comprehensive with its additions and revisions. Therefore, the privacy notice would need to be amended in order to be presented to Turkish data subjects.
Accordingly, for data controllers that must comply with the TDPL, GDPR, or both, it would be prudent for them to adopt a data processing model that would meet the obligations of the relevant data protection authorities across multiple jurisdictions.