Law No. 6698 on the Protection of Personal Data (KVKK) sets out the principles and conditions that must be complied with when processing personal data belonging to natural persons.
General Principles of Personal Data Processing
Under KVKK Art. 4, personal data must be processed in accordance with the law and the rules of good faith, for specified, explicit, and legitimate purposes, in a manner connected with, limited to, and proportionate to the purpose for which they are processed, and must be retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.
Cases Where Data May Be Processed Without Explicit Consent
As a rule, the explicit consent of the data subject is required for the processing of personal data; however, where one of the following circumstances listed in KVKK Art. 5/2 exists, data may be processed without seeking explicit consent:
- It is expressly provided for by law,
- It is directly related to the establishment or performance of a contract,
- It is mandatory for the data controller to fulfill their legal obligation,
- It has been made public by the data subject themselves,
- Data processing is mandatory for the establishment, exercise, or protection of a right,
- Data processing is mandatory for the data controller's legitimate interest (provided it does not harm the data subject's fundamental rights and freedoms).
Special Categories of Personal Data
As a rule, explicit consent is required for the processing of special categories of personal data such as health, sexual life, religion, sect, political opinion, and ethnic origin; special categories of data other than health and sexual life may also be processed without explicit consent in cases provided for by law.
Rights of the Data Subject
KVKK Art. 11 grants the data subject the following rights concerning themselves: to learn whether their data is being processed, to request information about it if it has been processed, to learn the purpose of the processing and whether it is used in accordance with that purpose, to know the third parties to whom the data is transferred domestically or abroad, to request correction if it has been processed incompletely or incorrectly, to request its erasure/destruction where the conditions provided for by law arise, and to request that these actions be notified to the third parties to whom the data has been transferred.
Conclusion
While KVKK provides data controllers with certain legal grounds on which they may process data even without explicit consent, it also grants data subjects strong rights to information and correction. Correctly determining the legal basis on which a data processing activity relies forms the foundation of KVKK compliance processes.
Lawyer Services processes user data in accordance with KVKK principles and does not use any data to train AI models.