Data protection — frequently asked questions

The data controller must notify the Personal Data Protection Board within 72 hours of learning of the breach. The individuals concerned must also be notified as soon as reasonably possible. Late notification markedly increases the risk of an administrative fine.

Go to the IT Lawyer in Istanbul and Information Technology Law page →

The evidence should first be secured with a screenshot of the content, the URL and the date. An interim injunction can then be sought from the civil court of first instance for the content to be removed or access to it blocked; Article 9 of Law No. 5651, which governed the criminal judgeship of peace route, has not been in force since 10 October 2024. For content concerning private life, an application can be made to the Cybersecurity Directorate. A criminal complaint for insult and an action for non-pecuniary damages for the attack on personality rights can also be brought.

Go to the IT Lawyer in Istanbul and Information Technology Law page →

You must first make a written application to the organisation processing the data, that is, the data controller; if this stage is skipped, the complaint is dismissed on procedural grounds. If the data controller does not reply within thirty days or the reply is inadequate, you can complain to the Personal Data Protection Board within thirty days of learning of this and in any event within sixty days of the application.

Go to the IT Lawyer in Istanbul and Information Technology Law page →

For content that is out of date and serves no public interest, you can apply to the search engine under the right to be forgotten and ask for the result not to be shown in searches for your name. If the application is refused or not answered within 30 days, a complaint can be made to the Personal Data Protection Board. Having the news story itself taken down is a separate request; if personality rights are infringed, an injunction must be sought from a civil court.

Go to the IT Lawyer in Istanbul and Information Technology Law page →

As a rule, every natural and legal person processing personal data is obliged to register. However, data controllers with fewer than 50 employees a year and an annual balance sheet total of less than 100 million TL, whose main activity is not processing special categories of data such as health data, are exempt. For those whose main activity involves special categories of data, the threshold is much lower. The exemption does not remove the obligations to inform and to ensure data security; the 2026 minimum fine for breaching the registration obligation is 341,809 TL.

Go to the IT Lawyer in Istanbul and Information Technology Law page →

Since 1 June 2024, administrative fines imposed by the Personal Data Protection Board are challenged not before the criminal judgeship of peace but by filing an action in the administrative court. Under the general rule, the time limit for filing is 60 days from service of the decision. In the action, besides whether the breach occurred, whether the amount of the fine is proportionate can also be argued; in 2026 the fines range from 85,437 TL to 17,092,242 TL.

Go to the IT Lawyer in Istanbul and Information Technology Law page →