What is General Data Protection Regulation (GDPR)?

EU General Data Protection Regulation (GDPR) is the latest and most significant implementation change to ensure the personal data protection of EU residents and citizens by dictating organizations to reshape their privacy and security policies.

It aims persons to have more control over their personal data, as well as to make personal data processing purposes more transparent by receiving the consent of data subjects.

Personal Data; is considered as any information which causes an individual being identifiable or identified. (Name, surname, address, e- mail address, IP address of your computer, vehicle plate and such are the data than can be related to an individual.)

Sensitive Personal Data; is the information as health, race, sexual life of individuals. (In case of any sensitive personal data obtained by an organization, as well as processing them in accordance with the law, the precautions stated by Turkish Personal Data Protection Board should also be taken.)

What is Personal Data Protection Law (KVKK)?

KVKK regulates all methods and principles which both natural and legal persons are obliged to protect, process, destroy, anonymize and keep all personal data up to date in compliance with the law.

General Overview on the Turkish Personal Data Protection Law

From Information to Transformation

Technological improvements and the increase in storage of personal data digitally have created the need for regulation on national information security in Türkiye. In addition, personal data protection needs in international area, integration process with European Union, also local information security necessities have obliged the implementation of personal data protection legislation.

Four of the negotiation phases of EU membership process are completely related to personal data protection, which are in progress.

Brief History

Turkish Personal Data Protection Law no. 6698 is based on the Data Protection Directive 95/46/EC of European Parliament and European Commission, published in the Official Gazette dated 7/04/2016 no. 29677. Personal data that is processed before the date of publication of the law, must become compliant with the rules stated in the law in two years starting from publishing date. In other words, all personal data processed before 07/04/2016 should have become compliant with the law by 07/04/2018.

In addition, GDPR has replaced Data Protection Directive 95/46/EC of European Council and Parliament. It is the most important change in data security over the last 20 years. This law, adopted by the European Parliament on 14 June 2016, has been effective as of 25 May 2018 and imposes severe penalties on organizations that do not comply with laws on compliance.

Awareness

In order to protect each personal data possessed (digitally or physically) with the principle of right to privacy, organizations are obliged to prepare required technical and administrative infrastructures. Furthermore, they need to realize all necessary legal regulations in terms of actions to be taken when personal data are acquired by third parties.

Your data, which must be kept confidential, are generated through the exchange of information between you and your employees, their families, clients, suppliers and any other third-party organizations. Digital transformation requires fundamental changes in the services you provide in all areas of your business and operations of any kinds. This new cultural formation will only be possible by radically changing the status quo that provides administrative and operational comfort in your organization.

About ADP (NASDAQ – ADP)

Designing better ways to work through cutting-edge products, premium services and exceptional experiences that enable people to reach their full potential. HR, Talent, Benefits, Payroll and Compliance informed by data and designed for people.