Turkiye: Adopted Information Note on Legal Conditions for Personal Data Processing

On 12 February 2024, the Personal Data Protection Authority (KKVK) published an information note outlining the legal conditions under which personal data may be processed without explicit consent, as stipulated in Article 5 of the Personal Data Protection Law No. 6698. Under Article 5, data can be processed if it is mandated by law, is essential for protecting the life or physical integrity of someone whose consent is not legally recognised, necessary for the performance of a contract, compliance with a legal obligation, the concerned individual has publicly disclosed the data, defend a right or legitimate interests of the data controller. In regards to processing, if mandated by law, the note clarifies that personal data protection rights, protected by the Turkish Constitution, cannot be limited by statute, regulation, or other administrative action. It also highlights that the basis for data processing activity must be clearly stated in law, recommendation, board decision, court decision, case law, or guide. Regulatory actions established by the administration are considered legal obligations if they have a legal basis. The note concludes that regulations, statutes, circulars, regulatory authority decisions, and similar legal regulations are binding and must be implemented unless cancelled by the Constitutional Court.