Personal Data Protection Law

The Law, which has been drafted taking into account international instruments, comparative legal practices and the needs of our country, aims to ensure that personal data is processed and protected in accordance with contemporary standards. In this context, the purpose of the Law is to regulate the conditions for the processing of personal data, the protection of individuals’ fundamental rights and freedoms in the processing of personal data, and the procedures and principles to be followed by natural and legal persons processing personal data. The protection of an individual’s privacy and the assurance of data security are also addressed within this framework. The Act seeks to prevent the infringement of personal rights resulting from the unrestricted and arbitrary collection of personal data, unauthorised access, disclosure, or the misuse or processing for purposes other than those intended.

Who is Covered by the Law?

The Law applies to natural persons whose personal data is processed, as well as to natural and legal persons who process such data, whether by fully or partially automated means or by non-automated means provided that such processing forms part of a data filing system (a system in which personal data is processed in a structured manner according to specific criteria). In this regard, no distinction is made between organisations operating in the private sector and public institutions and organisations; it has been established that the procedures and principles set out in the Law apply to all institutions and organisations. As the Law refers to natural persons whose data is processed, everyone with legal capacity falls within the scope of the Law.