As is known, pursuant to Article 18 of the Personal Data Protection Law No. 6698 dated 24 March 2016 (“Law”), titled “Misdemeanours”, the Personal Data Protection Board (“Board”) may impose administrative fines on data controllers and data processors in cases where the obligation to inform is not fulfilled, the obligations regarding data security are not complied with, the decisions rendered pursuant to Article 15 of the Law are not implemented, the obligation to register with and notify the Data Controllers Registry is violated, and the standard contracts—which must be among the appropriate safeguards required for the transfer of personal data abroad in certain circumstances—are not notified in accordance with the conditions set forth in the Law.
