Erasure of Personal Data

Also known as: Data Deletion, Erasure Request, Right to Be Forgotten, Kişisel Verilerin Silinmesi

In short

Rendering personal data whose processing grounds have ceased inaccessible and unusable in any way for the relevant users; one of the three disposal methods under the KVKK.

Under Article 7 of the KVKK, personal data processed lawfully but whose processing grounds have ceased must be erased, destroyed or anonymised by the controller on its own initiative or at the data subject’s request. The procedure is set out in the Regulation on Erasure, Destruction or Anonymisation of Personal Data.

What Is Erasure?

Erasure means rendering personal data inaccessible and unusable in any way for the relevant users. In erasure, the data may still technically exist for authorised persons such as system administrators, but access by the users concerned is completely removed. In this respect erasure differs from destruction, where the data cannot be recovered by anyone.

Erasure Methods

Deleting files on servers and removing access rights,
Deleting the relevant rows in databases with appropriate commands,
Blacking out data on paper,
Identifying and deleting copies in applications and backup environments.

Erasure Requests

When a data subject requests erasure and all processing grounds have ceased, the controller must comply within thirty days and inform the person; see Data Subject Rights. If the data has been transferred to third parties, they must also be notified. If a statutory retention obligation continues, the request may be refused with reasons.

Erasure on the Controller’s Initiative

The controller must erase data whose retention period has expired without waiting for a request. Which data is erased when is set in the retention and destruction policy. Breach of the erasure obligation is subject to administrative fines under the KVKK; failing to destroy data after statutory periods is also a criminal offence; see Data-Related Offences.

Frequently Asked Questions

Must data in backups also be erased?

Yes. Data whose retention period has expired should be erased from all environments including backups, or it should be documented that backups will be disposed of within their own retention cycle.

Can we refuse an erasure request?

If a processing ground continues, for example a retention obligation under employment or tax law, the request may be refused with reasons. The refusal must also be given within thirty days.

← Glossary A–Z