An Overview of Turkish Data Protection Rules from Criminal Law Perspective

When the Turkish Data Protection Act entered in force back in 2016, it provided a two-year period for data controllers to bring their data protection policies in conformity with the new law. Since the April 7 expiry of this transition period there has been a boom in the area of data protection similar to what has recently happened in Europe with the General Data Protection Regulation's entry into force.

Although it seems for the time being that the focus is mostly on this conformity process, there is also the criminal law aspect of the matter to which one should not turn a blind eye. As a matter of fact, criminal sanctions on data protection breaches date back further than the DPA as illegal recording, distribution, receipt, transfer and non-destruction of personal data were already criminalized under the Criminal Code. Now, with the newborn provisions of the DPA that introduce the rules and principles for processing personal data and also refer to criminal liability