Data Controller

Under the KVKK, the data controller is “the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system” (Art. 3). Almost all obligations under the Law are addressed to the data controller, so correctly identifying who the controller is in a given processing activity is the first step towards compliance.

How to Identify the Data Controller

The decisive question is who decides why and how the data is processed. The controller is not the person who physically holds the data or runs the system, but the one who determines the purpose and essential means of the processing. For example, a company that has an accounting firm prepare its employees’ payroll is the controller of that data; the accounting firm is a data processor acting on the company’s behalf.

Within a company, the controller is the legal entity itself. Departments and employees are not separate controllers or processors; they act on the company’s behalf within its organisation. In a group of companies, each company is a separate legal entity and therefore a separate controller for the data it processes, and sharing data between group companies is a transfer.

Key Obligations

• Relying on a processing condition for each processing activity (explicit consent, legitimate interest, performance of a contract, legal obligation and others),
• Fulfilling the duty to inform when collecting data,
• Taking the necessary technical and organisational measures for data security and notifying data breaches to the Board and the data subjects,
• Registering with the Data Controllers’ Registry (VERBİS) where the thresholds are met,
• Responding to data subject applications within thirty days at the latest,
• Keeping data only for as long as the purpose requires and then erasing, destroying or anonymising it.

Data Controllers Abroad

The KVKK also applies to data controllers not established in Turkey to the extent they process the data of individuals in Turkey. When registering with VERBİS, such companies must appoint a data controller representative in Turkey.