"""

What is a KVKK request used for?

A KVKK request is one of the main ways for a person to find out what has been done with their personal data records, ask for incomplete or incorrect information to be corrected, and request deletion when the conditions are appropriate. This process may concern many organizations that process data, such as banks, e-commerce platforms, hospitals, schools, employers, or companies that provide digital services.

In Turkey, the framework for personal data protection is shaped around the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) and the relevant legislation. Individuals, defined as data subjects, have the right to learn whether their data is being processed, ask for the purpose of processing, request correction of inaccurate records, and seek deletion or destruction when the conditions are met.

How does the application process work?

In most cases, the application is submitted to the organization or company that holds the data, namely the data controller. The channels that can be used are usually explained on organizations’ websites, in customer agreements, or in the disclosure statement (aydınlatma metni). Making sure the request reaches the right person through the right method is important for the process to move forward smoothly.

What information should be included in the application?

A request that is clear, understandable, and specific makes assessment easier. In particular, when exercising the right to data deletion, it is useful to state which data should be deleted, under which processing activity, and for what reason.

  • First and last name and contact information
  • The subject of the request: access to information, correction, deletion, or objection
  • Relevant account, membership, contract, or transaction details
  • If available, supporting documents or screenshots

It is also important to use a method that allows identity verification. Otherwise, the organization may want to confirm whether the application truly came from the relevant person.

What does the right to data deletion mean?

The right to data deletion does not mean that every record must be removed immediately in all cases. If the legal basis for processing still exists, the contractual relationship continues, or there is a retention obligation arising from other legislation, the request may be assessed differently.

However, if the purpose of processing no longer exists, the data has become outdated, or consent has been withdrawn in a consent-based processing activity, deletion, destruction, or anonymization may come into play. The applicant should be informed why the request was accepted or why it was only partially fulfilled.

What should be considered before applying?

Before submitting a request, the organization’s privacy policy and disclosure statement should be reviewed carefully. These documents help explain which personal data is processed for what purpose, how long it may be retained, and which communication channels can be used during the application process.

If the response is considered insufficient, the appeal and complaint remedies provided for in the legislation may also be considered. Depending on the nature of the case, seeking expert support may also reduce the risk of losing rights.

"""