Under Turkish Data Protection Law No. 6698
("Law") which came into force on April
7, 2016, it is crucial to make the distinction between the terms
"data controller" and "data processor" in order
to determine the liabilities of the parties in a data processing
transaction.
According to the Law, data controller is defined as the real or
legal person which determines the purposes and means of processing
the personal data and liable for establishment and management of
the data retention system. Whereas, data processor is defined as
natural or legal person which processes personal data based on the
authority granted by and on behalf of the data controller. In
short, the party determining why and how the personal data will be
processed will be considered as data controller. For example; if a
company outsources the retention and operation of its customer
database to an IT service provider, it would be easy to say that
the company is acting as data controller and the IT
