hat are the key acts and regulations governing data protection in Turkey? The Law on the Protection of Personal Data No. 6698 (DP Law) is the most significant law in Turkey on the protection of personal data. Enacted in 2016, the DP Law is mostly based on the EU Directive 95/46/EC. Before the DP Law was enacted, in 2010, the Turkish Constitution was amended, and protection of personal data was enshrined as a right in Article 20 of the Constitution. Unlawful processing, transfer, and acquisition of personal data are regulated as crimes in the Turkish Penal Code, carrying prison sentences of up to eight years. There are also sectoral regulations, which include terms on data protection, most notably in the areas of electronic communications (involving internet traffic and location data), eCommerce (involving electronic commercial communications) and banking (involving customers’ private data). What major challenges have data privacy matters presented to the Turkish corporate and legal sectors in the past decade? Since the DP Law was the first general law on data protection in Turkey, knowhow and awareness of data privacy among public and business was fairly limited during the early days of its enactment. The transition period envisaged in the Law further complicated the matter. The fact that some terms of the Law came into effect immediately with the enactment of the Law, such as terms on data processing principles and lawfulness of processing, made it challenging for many companies to comply with the Law, especially in the early days. Over the six years of the enactment of the DP Law, knowhow and awareness of data privacy have increased. Furthermore, the Personal Data Protection Authority was established in 2017 and has been preparing secondary regulations and guidelines, which have helped companies Turkey’s Challenges WithData Privacy Compliance with Turkey’s ‘DP Law’ requires several challenging criteria to be met in order to ensure the lawful transfer of personal data. In this feature, HHK partner Batu Kınıkoğlu explores these conditions and how they are expected to develop as Turkey brings the law more in line with GDPR. What should firms with Turkish operations keep in mind? W EXPERT INSIGHT
RkJQdWJsaXNoZXIy Mjk3Mzkz