Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik (Regulation on Deletion, Destruction or Anonymisation of Personal Data)

Overview

The regulation sets the procedures and principles for deleting, destroying or anonymising personal data once the conditions requiring its processing disappear. It was published in Resmî Gazete No. 30224 dated 28.10.2017. The record's related sources are Article 7 of Law No. 6698, ISO/IEC 27040 and NIST SP 800-88.

The retention and destruction policy must at least cover purpose, recording media, definitions, and the legal and technical reasons for retention and destruction (Article 6(1)). Controllers that have a policy delete, destroy or anonymise data at the first periodic destruction after the obligation arises (Article 11(1)).

The periodic destruction interval is set in the policy and may in no case exceed six months (Article 11(2)). This ceiling means deletion should be designed as a configurable scheduled job within a product or service. In addition, the definition of 'related user' excludes the person or unit responsible for technical storage, protection and backup of the data (Article 4(1)(b)).

For data center operations, the regulation raises how deletion and destruction apply to all copies including backups, and how media are disposed of at decommissioning. The content of this record is a summary of the regulation; for legal interpretation the official text governs.

Key points

1. The retention and destruction policy covers at least purpose, recording media, definitions and the legal and technical reasons for retention and destruction (Article 6).
2. Controllers with a policy delete, destroy or anonymise at the first periodic destruction after the obligation arises (Article 11).
3. The periodic destruction interval is set in the policy and may in no case exceed six months (Article 11).
4. 'Related user' excludes the person or unit responsible for technical storage, protection and backup (Article 4).
5. Resmî Gazete 30224, 28.10.2017.
6. Related: Law 6698 Article 7, ISO/IEC 27040, NIST SP 800-88.
7. Applies to controllers subject to registration.

Using it in design

• Implement scheduled purge or anonymisation jobs with a configurable interval not exceeding six months, including backups.
• Include certified media destruction in data center decommissioning checklists.
• Map purpose, recording media and retention reasons in the retention policy to product settings.
• When choosing destruction methods, refer to related media sanitisation guidance such as NIST SP 800-88.

Who should read it

Service providers handling personal data, data center operators, information security and compliance officers, and product teams.

Related standards

• 6698 sayılı Kanun Madde 7
• ISO/IEC 27040
• NIST SP 800-88

Publication details

Authors

Kişisel Verileri Koruma Kurumu (KVKK)

Publisher

Kişisel Verileri Koruma Kurumu (KVKK)

Year

2017

Document number

RG 30224 (28.10.2017)

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Bibliographic reference only — the document is not redistributed here; confirm reuse terms at the original source

Citation