Turkey Adopts Data Protection Law, Taking A Big Step Towards Harmonization With Relevant Elements of Acquis Communautaire

After more than a decade of legislative proposals, the Grand National Assembly of Turkey has approved the Data Protection Law ("Law"). The next step is for the new law to receive approval or comments from Turkey's President, then eventually be published in the Official Gazette with the official text and an enforcement date. The Law addresses responsibilities of key actors, companies and data processing companies, as well as appropriate methods for processing and transmitting data. It introduces definitions for "Personal Data", "Sensitive Data", "Data Processor", "Data Controller" and "Explicit Consent", among others, as well as a general prohibition on processing or storing such data without express consent from the data subject. For personal data which is already stored or begun processing before the Law's enforcement date, data processors and data controllers have two years to ensure the data complies with the new requirements.