Personal data is any information relating to an identified or identifiable natural person. This may include identity details such as name and surname, as well as contact, financial, social, and similar types of information.
Special categories of personal data (sensitive personal data) are types of data that are subject to stricter protection under the law. These include data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, dress and appearance, membership of an association/foundation/trade union, health, sexual life, biometric and genetic data, and data concerning criminal convictions and security measures.
Processing of personal data refers to any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, transferring, taking over, or any other processing activities.
To ensure that personal data is processed lawfully, the following principles are observed:
Processing in accordance with the law and the rules of honesty
Being accurate and, where necessary, kept up to date
Processing for specific, explicit, and legitimate purposes
Being relevant, limited, and proportionate to the purpose of processing
Being retained for the period stipulated in the relevant legislation or as long as necessary for the purpose for which it is processed
As a rule, personal data cannot be processed without the explicit consent of the data subject. In order to obtain explicit consent, the data subject must be adequately informed about the process. However, under certain circumstances set out in Article 5 of the KVKK, personal data may be processed without explicit consent. These circumstances include:
Explicitly provided for by law,
Being necessary to protect the life or physical integrity of the person or another person where the data subject is unable to express consent due to actual impossibility or where consent is not legally valid,
Being directly related to the establishment or performance of a contract, provided that processing is necessary for the parties to the contract,
Being necessary for the data controller to fulfil its legal obligation,
Having been made public by the data subject,
Being necessary for the establishment, exercise, or protection of a right,
Being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
As a rule, special categories of personal data cannot be processed without explicit consent. Special categories of personal data other than health and sexual life may be processed without explicit consent only in cases explicitly provided for by law. Data relating to health and sexual life, however, may be processed without explicit consent only for purposes such as the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing, by persons or authorized institutions and organizations under a duty of confidentiality.
