Act 2016
Law on the Protection of Personal Data (Law No. 6698)
Plain-English summary
Ratified 24/3/2016 and published in Official Gazette No. 29677 on 7/4/2016; amended by Law No. 7499 of 2/3/2024 (Art. 6, 9, 18). Sets processing conditions (Art. 5), the duty to inform (Art. 10), data subject rights (Art. 11), security and breach notification (Art. 12) and administrative fines (Art. 18).
Who it applies to
All industries
Topics
Data Protection & Privacy
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Lawful basis, notice and data subject rights | At collection + on request | — | official | |
Art. 5 bars processing without explicit consent unless an exception applies (law, contract, legal obligation, legitimate interests and others). Art. 10 requires the controller to inform data subjects of its identity, purposes, recipients, collection method and legal basis, and Art. 11 gives rights of access, correction, erasure, objection and compensation. |
||||
| Personal data breach notification | Deadline Within 72 hours of learning of the breach (Board decision 2019/10) | — | official | |
Art. 12 requires the controller to notify the data subject and the Board 'within the shortest time' when processed data is obtained unlawfully by others. The Board's decision 2019/10 of 24.01.2019 interprets this as notice to the Board without delay and within 72 hours of learning of the breach, with reasons for any delay. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.