Data Subject Applications and Board Investigations
A request from an employee, customer or former user about their personal data can easily turn into a complaint to the Board and an investigation if it is not handled properly. We set up the process for handling data subject requests and respond to the requests you receive; in investigations launched by the Personal Data Protection Board, we advise your company and represent you as counsel.
What is a data subject request?
A data subject request is a request made to the data controller by a person whose personal data is processed, in order to exercise their rights under Article 11 of the KVKK. Through it, the person can find out whether their data is being processed, request information, or ask for their data to be corrected or erased.
The data controller must conclude the request within thirty days at the latest and, as a rule, free of charge. If the request is rejected, the answer is found insufficient or no answer is given in time, the person may complain to the Board.
How does a Board investigation start?
The Board may open an investigation following a data subject’s complaint or of its own motion when it learns of an alleged breach. The investigation usually starts with a request for information and documents from the data controller, which must be answered within fifteen days. At the end of the investigation, the Board may order the breach to be remedied and impose an administrative fine.
Scope
- Handling data subject requests
- Advice and representation in investigations launched by the Board
- Preparing the request handling procedure and the request form
- Managing compliance with Board decisions
How We Work
- Identifying the channels through which requests arrive and who receives them within the company
- Setting the request handling procedure, responsibilities and response templates
- Legal assessment of each request and answering it within the time limit
- Answering the Board’s requests for information and documents with submissions and supporting documents
- Implementing instructions after the Board’s decision and, if necessary, moving to litigation
Team
Frequently Asked Questions
Can a data subject complain directly to the Board?
No. The person must first apply to the data controller. If the request is rejected, the answer is found insufficient or no answer is given within thirty days, the person may complain to the Board within thirty days of learning of the answer, and in any case within sixty days of the date of the request.
How can we be sure the request really comes from the data subject?
Identity must be verified before answering a request. Requests may be made in writing, by registered electronic mail (KEP), secure electronic signature, mobile signature, or through an e-mail address the person previously notified to the data controller and which is registered in its systems. Disclosing personal data to a person whose identity has not been verified may in itself be a breach.
How long do we have to answer the Board's request for information and documents?
Fifteen days from notification of the request. This answer is often the defence that determines the outcome of the investigation; so rather than simply sending the documents requested, the company should clearly explain the measures it has taken and the circumstances of the case.
What happens if we do not comply with a Board decision?
Board decisions must be implemented within thirty days of notification at the latest. Failure to implement them is a separate breach for which the KVKK provides an administrative fine.
Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.
Schedule a meetingRelated Publications
- Can the Corporate E-mail Histories of Employees Who Leave Their Jobs Be Made Available to Another Employee? – An Evaluation in the Context of the Law on the Protection of Personal Data 06.05.2024
- Deepfake Technology – Legal Challenges and Key Questions 17.11.2023
- Rights Over a Person’s Image and Photograph 15.10.2024
- Push Notifications in Turkish Law: Legal Obligations and User Rights 25.10.2023