Data Subject

Under Article 3 of the KVKK, a data subject is the natural person whose personal data is processed. All KVKK obligations ultimately aim to protect the data subject.

Only Natural Persons

The KVKK only protects natural persons’ data. A company’s trade name, tax number or turnover is not personal data. By contrast, a company officer’s name, signature and contact details, or information about a sole proprietorship, are personal data, and those persons are data subjects.

Data Subject Categories

The data subject categories companies encounter most often are:

• Customers and prospective customers,
• Employees, interns and job candidates; see Employee Personal Data,
• Representatives and employees of suppliers and business partners,
• Visitors (physical and website visitors),
• Shareholders and board members.

Which categories of data subjects’ data are processed and for what purposes is shown in the personal data inventory and the VERBİS registration. Preparing a separate privacy notice for each category is the soundest approach in practice.

Children and Persons under Guardianship

Children and persons under guardianship are also data subjects, but the will of their legal representatives may be required for steps such as consent and applications. Proportionality of processing in services aimed at children should be assessed separately.

Rights

Data subjects may exercise rights such as requesting information, rectification, erasure and objection under Article 11 of the KVKK; see Data Subject Rights.