KVKK article 10: The data controller is obliged to inform the relevant person during the acquisition of personal data.
What Should Be Included in the Information Text
- Identity of the data controller
- Purpose of processing
- Data categories
- To whom the transfer will be made
- Data collection method and legal reason
- Rights of the person concerned (KVKK article 11)
- Contact information
Method of Disclosure
- Written (on the screen)
- Oral (in phone calls)
- Accessible (large font, clear language)
- Pre-information (data) without collecting)
Rights of the Relevant Person (KVKK article 11)
- Learning whether their data is being processed or not
- Requesting information if it is being processed
- Learning whether it is suitable for its purpose and use
- Learning about third parties transferred domestically or internationally
- Requesting correction/deletion
- Requesting destruction
- Requesting the destruction of the transaction Objection to a negative result to the person
- Compensation if harm is incurred
Sectoral Examples
- Employer-employee: payroll, monitoring purpose
- Hospital-patient: medical record, insurance
- E-commerce: customer profile, marketing
- Bank: KKB, MASAK, contract
KVKK Board Decision
The KVKK Board imposes administrative fines on companies with incomplete/misleading information text, and also requests that the information text be presented in a visible place.
KVKK expert lawyer have a compatible text prepared.