Turkish DPA's Guidelines on the Erasure, Destruction or Anonymization of Personal Data

I. Introduction

The Regulation on the Erasure, Destruction or Anonymization of Personal Data ("Regulation") was published on the Official Gazette of October 28, 2017, as the first phase of the belated secondary legislation. Although the Regulation provided more specific and explicit provisions pertaining to the erasure, destruction or anonymization of personal data in comparison to the Law No. 6698 on the Protection of Personal Data, the practical uncertainty regarding the implementation of these provisions was unfortunately not resolved and the technical methods that could be used to fulfill the obligations set forth under these provisions still remained unclear.

Hence, a pressing need for guidance emerged with respect to the methods that could be used to comply with the legislation in terms of the erasure, destruction or anonymization of personal data. Accordingly, the Turkish Data Protection Authority ("DPA") published the Guidelines on the Erasure, Destruction