Lawful Data Processing


Processing Personal Data

In principle, personal data can be processed with the explicit consent of the data subject. On the other hand, personal data can be processed without explicit consent in the following circumstances:

  • If processing is clearly proposed under the laws;
  • If processing is mandatory for the protection of life, or to prevent the physical injury of a person, in cases where that person cannot express consent, or whose consent is legally invalid due to physical disabilities;
  • If processing is necessary for and directly related to the establishment or performance of a contract, and limited to the personal data related to the parties to the contract;
  • If processing is mandatory in order for a data controller to fulfil its legal obligations;
  • If the data is made manifestly public by the data subject;
  • If processing is mandatory for the establishment, exercise, or protection of certain rights; and
  • If processing is mandatory for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject or any related person are not compromised.

Processing Sensitive Personal Data

The Data Protection Law divides sensitive personal data into two categories:

  • Personal data on health or sexual orientation; and
  • “Other” sensitive personal data.

Personal data related to health or sexual orientation is protected more strictly than other sensitive data, as the scope of the additional legal grounds for processing is very limited. Reserving the requirement to obtain explicit consent of the data subject, personal data related to health or sexual data can only be processed by persons under an obligation of confidentiality, or by authorized institutions and establishments, for the purposes of protection of public health, protective medicine, medical diagnosis, treatment and care services.

For other types of sensitive personal data, these can only be processed with the explicit consent of the data subject, or if such processing is required by law.

Processing sensitive data, especially health data must be diligently handled in Turkey under the current legal backdrop. We have specific industry knowledge in health care where we frequently advise our clients in processing health data in different fields and for various purposes, including new technologies, quality services, pharmacovigilance or clinical trials.

Find more insights

Share