Turkish Personal Data Protection Code no. 6698
("Code") entered into force on April 7th, 2016 and the
Data Protection Authority ("Authority")
was established at the end of 2016 as an independent authority to
fulfil the requirements under the Code.
According to the Code, processing the data is defined as any
operation which is performed on personal data, whether or not by
automatic means, such as collection, recording, retrieving,
retaining, and/or transmission, erasure or destruction. The Code
also regulated the legal grounds for processing the personal data
and explicit consent is introduced as one of the eight legal
grounds. Despite the general impression that the explicit consent
is superior to other legal grounds and a safer way of processing,
it is merely one of the eight legal grounds to process the personal
data as per the Code and requires a lot of hurdles to achieve.
