Cybersecurity and data privacy

The Turkish Data Protection Law (the “Law”) regulates the transfer of personal data outside of Turkey in detail.

Service providers who wish to use electronic messaging for commercial purposes are required to register with the Commercial Electronic Communication Management System (“CMS”, İleti Yönetim Sistemi).

On 2 November 2020, a federal trial court in New York issued a ruling regarding the use of a photograph taken from a social media post (Boesen v United Sports Publications, Ltd., 20-CV-1552 (ARR) (SIL) (E.D.N.Y. Nov. 2, 2020).

In July, the CJEU gave judgment in the case known as Schrems II, a landmark data protection case about how companies can lawfully transfer personal data around the world.

The COVID-19 pandemic has transformed the way in which many businesses operate.

The Data Controllers' Registry or VERBİS is a publicly available database kept by the Data Protection Board (the “Board”), the decision-making body of the Turkish Data Protection Authority (the “DPA”). Unless exempt from the requirement, all data controllers (individuals and legal entities) who process personal data in Turkey must be recorded with VERBİS prior to processing any personal data.

The COVID-19 pandemic is affecting daily life in an unprecedented way.

Personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, clothing and appearance, membership in associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, biometric and genetic data are defined as sensitive data in Turkish data protection legislation.