Data protection for businesses: notice and explicit consent

The Personal Data Protection Law No. 6698 concerns almost every business that holds information on customers, employees, tenants or guests. In Bodrum, hotels, guesthouses, estate agents and rental businesses handle large amounts of personal data every day.

General principles

Under Article 4, personal data must be processed lawfully and fairly, be accurate and kept up to date where necessary, be processed for specified, explicit and legitimate purposes, be relevant, limited and proportionate, and be kept only as long as necessary.

Is explicit consent always required?

Under Article 5, personal data may not in principle be processed without explicit consent. Consent is not required, however, where processing is expressly provided for by law, directly related to concluding or performing a contract, necessary to meet a legal obligation, necessary to establish or protect a right, or necessary for legitimate interests. The most common mistake is asking for consent where one of these grounds applies.

The duty to inform

Separately from consent, under Article 10 the data controller must inform data subjects when collecting their data: who is processing it, for what purpose, on what legal basis and to whom it may be transferred. Article 11 grants rights such as access, correction and erasure. The privacy notice and the consent form should be separate documents.

Security and registration

Under Article 12, the controller must take the technical and administrative measures needed to prevent unlawful processing and access; if data is obtained unlawfully by others, the data subject and the Board must be notified as soon as possible. Under Article 16, controllers must register with the Data Controllers' Registry unless an exemption set by the Board applies.

Breaches of these obligations are subject to administrative fines under Article 18.

Our view

Compliance is not form-filling; it is about seeing where the business gets data, where it keeps it and who it shares it with. Once that inventory is right, the documents can be short and realistic, and training staff keeps compliance from staying on paper.

Related reading: Commercial and company law; Corporate counsel.