What rights does a personal data owner have?

A KVKK request is the channel individuals can use to learn why their personal data was collected, ask for incorrect or incomplete information to be corrected, and submit various requests, including the right to have data deleted, when the legal conditions are met. In most cases, these requests are directed to the data controller, the party that determines the purpose of the processing.

A person may want to know what data about them is being processed, where it was obtained from, who it may be shared with and how long it may be kept. For that reason, one of the first steps in the process is to carefully review the privacy notice provided by the relevant institution or company.

Why is the privacy notice important?

The privacy notice is the main explanation setting out the scope of the personal data processing activity. Before submitting a request, it may be useful to check the following points:

  • What personal data is collected
  • The purpose and legal basis for processing
  • Who the data may be transferred to and for what reason
  • The retention period or retention criteria

How is a KVKK request submitted?

The most important point in a request is to state it clearly and specifically. The person should make it as clear as possible which data they want information about, what they want corrected, or which data they want deleted.

The difference between the data controller and the Authority

The Personal Data Protection Authority is not the same as the data controller. The data controller is the natural or legal person who decides why and how the data is processed, while the Authority is the public body that plays a role in complaints, investigations and guidance.

Quick checklist before applying

  • The subject of the request should be written clearly
  • All information needed for identity verification should be provided
  • The relevant privacy notice and membership/contract records should be reviewed
  • The request should be submitted through a channel that can be recorded

Application methods may be announced on the data controller’s website, in a user account, in the contract or in the privacy notice. For security reasons, additional verification may be requested, which is considered normal.

What does the right to data deletion mean?

The right to data deletion applies when the reasons requiring the processing of personal data no longer exist. However, this right is not absolute; some data may be kept for a certain period because of legal obligations, the need for evidence or retention requirements.

Is every deletion request accepted?

Not every data deletion request is expected to be approved automatically. In particular, the scope of the request may be limited in the following cases:

  • There is a retention obligation arising from legislation
  • There is an ongoing dispute or a need for evidence
  • The processing activity still rests on a valid legal basis

If the response to a request is considered insufficient, it is important to check the possible next steps through official statements. The best approach is to submit the request in writing, clearly and in a way that can be recorded, read the privacy notice carefully and, if necessary, seek expert support.