Turkish DPA's Guidelines On Data Protection In The Banking Sector

Recent Developments

On 5 August 2022, the Turkish Personal Data Protection Authority (DPA) published the Guidelines on Protection of Personal Data in the Banking Sector ("Guidelines"). The Guidelines provide detailed explanations on data processing activities and give examples of good practices in the banking sector. The Guidelines are available online here (in Turkish).

What do the Guidelines say?

The Guidelines mainly cover the following areas:

• Data controller/data processor: The Guidelines initially evaluate the status of the banks as data controllers and data processors. In general, banks are considered data controllers in terms of their activities pursuant to Article 4 of the Banking Law. However, the status of banks must be evaluated on a case-by-case basis when determining whether they qualify as a data controller or data processor in terms of their agency; investment products; insurance, private pension, etc.; and operations. The Guidelines also