Türkiye

Art. 5 bars processing without explicit consent unless an exception applies (law, contract, legal obligation, legitimate interests and others). Art. 10 requires the controller to inform data subjects of its identity, purposes, recipients, collection method and legal basis, and Art. 11 gives rights of access, correction, erasure, objection and compensation.

Art. 12 requires the controller to notify the data subject and the Board 'within the shortest time' when processed data is obtained unlawfully by others. The Board's decision 2019/10 of 24.01.2019 interprets this as notice to the Board without delay and within 72 hours of learning of the breach, with reasons for any delay.

Arts 3-4 prohibit using crypto assets directly or indirectly in payments, developing payment or electronic money models that use them, and intermediating fund transfers to or from crypto trading, custody or issuance platforms.

Art. 14(1) requires payment institutions to obtain authorisation from the Bank and Art. 18(2) requires permission for electronic money institutions. Art. 22 covers safeguarding of funds under a Bank regulation, and Art. 20(3) requires funds collected for electronic money to be held in a separate bank account.

Operators must maintain an information security management system (Art. 6), run vulnerability scans at least six times a year and a penetration test at least once a year reported to the Bank (Art. 7), keep audit trails for at least ten years (Art. 8) and test the continuity plan annually (Art. 12(3)). The communiqué sets no hour limit for reporting incidents to the Bank.

Art. 13 lets operators outsource IT activities but keeps them responsible for information systems management. They must assess outsourcing risks, include minimum contract terms (service levels, termination and data destruction, subcontractors, Bank oversight access), and keep outsourced processing and storage on dedicated hardware.