DSAR and Data Subject Rights Management

Under Turkish Data Protection Law w. no 6698 (“DPL”) and the Communique On The Principles And Procedures For The Request To Data Controller, data subjects may exercise their rights that are shown under Art. 11 of the DPL.

These rights are;

a) to learn whether his/her personal data are processed or not,

b) to demand for information as to if his/her personal data have been processed,

c) to learn the purpose of the processing of his/her personal data and whether these personal

data are used in compliance with the purpose,

d) to know the third parties to whom his personal data are transferred in country or abroad,

e) to request the rectification of the incomplete or inaccurate data, if any,

f) to request the erasure or destruction of his/her personal data under the conditions referred to in Article 7,

g) to request reporting of the operations carried out pursuant to sub-paragraphs (e) and (f) to third parties to whom his/her personal data have been transferred,

h) to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,

i) to claim compensation for the damage arising from the unlawful processing of his/her personal data.

In order to exercise these rights, data subjects must apply to the Controller first. Therefore, Controllers have an obligation to conclude data subject requests in an effective manner and as soon as possible with a deadline of 30 days as of receipt of a valid request.

Since DPL is different than the GDPR, it is important to differentiate between valid data subject requests with those that are not. That is where we come in.

As your Representative in Turkey, all data subject requests will be sent to our e-mail address (which we will provide to you to state in your privacy policy/notice). 

When we receive a valid data subject request, either through e-mail or other means, we will provide the request to you within 3 business days with English translation of the request, evaluation of the request and the deadline (30 days as of receipt) to comply/respond. 

We will then follow-up with you with weekly reminders regarding the response to be provided to the data subject, receive the response from you, translate the response into English and convey the response to the data subject.