Home

Internal

Global

Contatto

Rödl & Partner Italia e Studio Gottardo per la partnership tra Officine MTM S.p.A. e Gruppo Dawang Metals |

In tutto il mondo

Utilizziamo cookie tecnici per personalizzare il sito web e offrire all’utente un servizio di maggior valore. Chiudendo il banner e continuando con la navigazione verranno installati nel Suo dispositivo i cookie tecnici necessari ai fini della navigazione nel Sito. L’installazione dei cookie tecnici non richiede alcun consenso da parte Sua. Ulteriori informazioni sono contenute nella nostra Cookie Policy.

Sensitive Personal Data: issues to be considered in Turkey

published on 26 February 2025 | reading time approx. 3 minutes

Sensitive personal data refers to information that may lead to discrimination or is considered more delicate, necessitating stricter protective measures. Under Article 6 of the Turkish Personal Data Protection Law (“KVKK”), sensitive personal data is explicitly defined as data relating to race, ethnic origin, political opinion, philosophical beliefs, religion, sect, attire, association, foundation and trade union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

The amendments introduced by Law No. 7499, which was published in the Official Gazette on 12.03.2024 and entered into force under the KVKK, have established clearer rules regarding the processing of sensitive personal data and have facilitated the processing procedures. In particular, data related to health and sexual life may only be processed by persons under an obligation of confidentiality (e.g., doctors, workplace doctors) or by authorized institutions and organizations. Furthermore, the processing of such data is permitted solely for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare financing. Similarly, data concerning criminal convictions and security measures (e.g., criminal record) may only be processed if explicitly stipulated in the relevant legislation.

The processing of sensitive personal data must strictly comply with the purposes and rules set forth in the applicable legislation, and utmost diligence must be exercised to ensure data security throughout the process. In this regard, the Personal Data Protection Authority (“Authority”) has reiterated its decision dated 31.01.2018 and numbered 2018/10 by re-publishing it on 20.02.2025, to remind data controllers of the key considerations they must observe when processing sensitive personal data.

The fundamental points to be considered in line with this decision are summarized below:

A distinct and explicit security policy must be established for sensitive personal data;
Employees must receive regular training, sign confidentiality agreements, and have their data access privileges restricted and regularly monitored. The access rights of employees who resign or change assignments must be revoked immediately;
Data stored in electronic environments must be protected through cryptographic methods, secure logging systems must be utilized, and if remote access is required, at least two-factor authentication must be implemented;
Data stored in physical environments must be safeguarded against risks such as fire, theft, and flooding, and unauthorized access must be prevented;
Secure communication methods must be used for data transfers. If data is transferred via email, encryption and Registered Electronic Mail (KEP) should be preferred. When using portable storage devices such as USBs, CDs, or DVDs, the data must be encrypted, and the encryption key must be kept separately. Physical documents must be transmitted in a classified document format;
All security measures specified in the Personal Data Security Guide published by the Authority must be fully implemented.

We emphasize the necessity of exercising the highest level of diligence in processing sensitive personal data.

DATA PROTECTION BITES

Read all releases »

author

Contact Person Picture

Bortecine Gultekin

+90 212 3101 434

Invia richiesta

RÖDL & PARTNER TURKEY

Discover more about our offices in Turkey.