Personal Data

The Turkish Personal Data Protection Law No. 6698 (the “KVKK”) defines personal data as “any information relating to an identified or identifiable natural person” (Art. 3). The definition is deliberately broad: information does not need to contain a person’s name to be personal data; it is enough that, on its own or combined with other information, it can identify a person.

The Identifiability Test

Information is personal data if, when matched with other information by reasonable means, it can single out an individual. Customer numbers, licence plates, IP addresses, location data or an employee ID may therefore be personal data even without a name next to them. By contrast, information about legal entities, such as a company’s trade name, tax number or turnover, is not personal data under the KVKK.

Common Examples

• Corporate e-mail addresses: A corporate address containing an employee’s first name and surname identifies a specific person and is personal data; generic addresses such as “info” or “support” that are not linked to a person are, as a rule, not. See our article on the corporate e-mail histories of employees who leave.
• Photographs and images: Photographs and camera recordings that allow a person to be recognised are personal data. When processed through specific technical means such as facial recognition, they may become biometric data, a special category of personal data. On rights over one’s image, see Rights Over a Person’s Image and Photograph.
• Voice recordings, messages and behavioural data: Call centre recordings, message contents, and browsing and purchase histories are personal data to the extent they can be linked to an individual.

Is Anonymous Data Personal Data?

Data that has been anonymised, meaning that it can no longer be associated with an identified or identifiable person in any way, is no longer personal data and falls outside the KVKK. However, simply deleting a name or replacing it with a code is often not enough: where the data can be linked back to the individual by combining it with other sources, it remains personal data.

Why It Matters

Whether information is personal data is the starting point for every obligation under the KVKK: the processing condition, the duty to inform, data security, retention periods and the rules on cross-border data transfers apply only when personal data is processed. Identifying which information falls within this scope is also the first step in preparing a personal data inventory.