THE REGULATION ON DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA
The Regulation on Deletion, Destruction and Anonymization of Personal Data is published in the Official Gazette on the 28th October 2017.
The Regulation is prepared based upon the Protection of Personal Data Law Nr. 6698 (“Law”)
The Purpose and Scope of the Regulation
The purpose of the Regulation is to determine the procedures and principles regarding deletion, destruction and anonymization of personal data. This Regulation is applied to the data supervisors.
The Policy on Storage and Extermination of Personal Data
The data supervisors who are obliged to register with the Data Supervisors Registry are responsible for drafting the policy on storage and extermination of the personal data in accordance with the inventory of personal data processing.
The obligations of the data supervisors who are not obliged to draft the policy on storage and extermination of the personal data shall also continue.
The Procedures on Deletion, Destruction and Anonymization of Personal Data
The personal data, ex-officio or on demand, is supposed to be deleted, destructed or anonymized by data supervisor in the event the conditions for processing of personal data disappear.
All the proceedings conducted with regards to the deletion, destruction and anonymization of personal data shall be recorded and preserved by the data supervisor at least for 3 years.
The Deletion of Personal Data
The deletion of the personal data is a proceeding which makes personal data inaccessible and re-utilizable for the related users under any circumstances.
The Destruction of Personal Data
The destruction of the personal data is a proceeding that makes personal data inaccessible, irrecoverable and re-utilizable by anyone under any circumstances.
The Anonymization of Personal Data
The anonymization of personal data is a proceeding that makes the personal data unlikely to be associated with an identified individual or any person under any circumstances.
The Time Period of for the Ex-Officio Deletion, Destruction and Anonymization of Personal Data
Data supervisor who is obliged to draft the Policy on Storage and Extermination of Personal Data shall delete, destruct and anonymize the personal data at the first periodic extermination proceedings following the date of occurrence of the obligation of the deletion, destruction or anonymization.
The time periods, in which the periodic extermination will be conducted shall be determined by the data supervisor in the Policy on Storage and Extermination of Personal Data. This time period cannot exceed six (6) months under any circumstances.
The data supervisors who have no obligation to draft the Policy on Storage and Extermination of Personal Data; shall delete, destruct and anonym the personal data within the 3 months following the date that obligation of deletion, destruction or anonymization have occurred.
The Time Periods for the Deletion, Destruction and Anonymization of Personal Data on Demand by Relevant Person
The data supervisor shall delete, destruct and anonym the relevant data within thirty (30) days at the latest upon demand by the relevant party if/when all criteria of the data processing is completed.
The data supervisor may reject the demand of the relevant person if/when the data processing procedure is not completed. In such case, the data supervisor is obliged to inform and notify the relevant person within thirty (30) days period at the latest in written or electronically.
The provisions of this Regulation shall enter into force on the 1 January 2018.