Data Subject Rights

Article 11 of the KVKK gives the data subject a set of rights against the data controller. These rights are the main tool for individuals to control their own data.

The Rights

By applying to the controller, the data subject may:

• Learn whether their personal data is processed and request information if so,
• Learn the purpose of processing and whether data is used accordingly,
• Know the third parties in Turkey or abroad to whom data is transferred,
• Request rectification of incomplete or inaccurate data,
• Request erasure or destruction of data where the grounds for processing have ceased,
• Request notification of rectification, erasure and destruction to third parties to whom data was transferred,
• Object to an adverse outcome resulting from analysis of data exclusively by automated systems; see Automated Decision-Making,
• Claim compensation for damage caused by unlawful processing.

Application and Response

Applications may be made in writing, by registered electronic mail (KEP), secure electronic or mobile signature, or via an email address previously notified to and registered with the controller. The controller must respond within thirty days at the latest, as a rule free of charge. The applicant’s identity must be verified before responding; disclosing data to an unverified person may itself be a breach.

Complaints to the Board

The data subject cannot complain directly to the Board; they must first apply to the controller. If the application is rejected, the response is inadequate or no response is given in time, the person may complain to the Board within thirty days of learning of the response and in any event within sixty days of the application. The content of the response is therefore also the first defence in any Board investigation.