Turkish Legal Framework For The Retention Of Rejected Employee Candidates' Personal Data And Recent Developments

I. Introduction

Under the Turkish data protection legislation, namely the Law on the Protection of Personal Data numbered 6698 ("LPPD"), its secondary regulations and the decisions of the local Data Protection Authority ("DPA"), there are no pre-defined general periods envisaged for the retention of specific categories of data. Thus, the main rules and principles set forth regarding data processing activities within the LPPD must be taken into consideration in order to determine lawful retention periods for the processed personal data, which are as follows:

• Personal data processing must be relevant, limited and proportionate to the purpose for which data are processed ( 4 of the LPPD),