Data Protection
Data inventories, information and consent structures, breach notifications and proceedings before the Board.
The firm’s data protection practice covers a compliance project as a whole: the preparation of the data inventory, registration with the data controllers’ registry (VERBİS), information notices and explicit consent structures, retention and destruction policies, data processor agreements, and the arrangements required for transfers of personal data abroad.
We advise data controllers on the establishment and periodic review of that structure, and represent them in applications, complaints and investigations before the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
Under Personal Data Protection Law no. 6698, an application by a data subject is answered as soon as possible and within thirty days at the latest, and a personal data breach is notified to the data subject and to the Board as soon as possible; under a principle decision of the Board, notification to the Board is made within seventy-two hours of the breach becoming known.
What we do
- Preparation of the data inventory and records of processing activities
- Registration with and updating of the data controllers’ registry (VERBİS)
- Drafting of information notices and explicit consent structures
- Arrangements for employee, customer, supplier and visitor data
- Retention and destruction policies
- Data processor agreements
- Structures for transfers of personal data abroad
- Handling of data subject applications
- Preparation of data breach notifications and conduct of proceedings before the Board
- Applications and actions against decisions of the Board