Personal Data Protection Day

April 7 Personal Data Protection Day is an official observance in Türkiye aimed at increasing legal awareness regarding the protection of personal data and promoting a culture of data security.^【1】

Personal data encompasses any information relating to an identified or identifiable natural person. This definition includes not only specific identifying details such as a person’s name, surname, date of birth, and place of birth, but also all characteristics that reflect the individual’s physical, familial, economic, social, and psychological identity. Any data that can be linked in any way to a natural person, thereby enabling their identification, qualifies as personal data.^【2】

Personal data covers a broad range of information that can directly or indirectly identify an individual. This includes names, telephone numbers, vehicle license plates, social security numbers, passport numbers, curricula vitae, photographs, images, audio recordings, fingerprints, and genetic information. Any circumstance in which data is linked to identifiers such as identity, tax, or insurance numbers, thereby enabling the identification of a person, falls within the definition of personal data.^【3】

The landmark Law on the Protection of Personal Data, No. 6698, which marked the beginning of a new era in personal data protection in Türkiye, entered into force on April 7, 2016. Following its enactment, various measures were introduced to raise public awareness. The Ministry of National Education (MEB) Regulation on Social Activities in Educational Institutions, published in the Official Gazette on September 1, 2018, No. 30522, mandated the establishment of "Personal Data Protection Clubs" in educational institutions and designated April 7 as "Personal Data Protection Day."

^【4】

The primary objective of Personal Data Protection Day is to raise awareness about the protection of personal data and to foster a culture of data protection among individuals. Within this framework, the importance of individual precautions in safeguarding personal data is emphasized. The target audience for this observance is strategically defined as children and youth, who represent the future of the country. Establishing data protection awareness among this demographic and ensuring their upbringing within this cultural framework is considered a strategic priority.^【5】

With the widespread use of the internet, risks to personal data protection have increased. To ensure data security, individuals must remain vigilant against email, messaging, and social media-based phishing attacks, avoid clicking on suspicious links, and refrain from indiscriminately sharing personal information. Official institutions never request sensitive information via email or messaging; therefore, such requests must be questioned and only verified official sources should be followed.^【6】

For individual data security, it is essential to monitor online payments through credit card statements and to use virtual or limited-amount cards. The use of virtual keyboards during transactions and the establishment of hard-to-guess passwords that are changed at regular intervals is recommended. Additionally, scanning files downloaded onto computers and mobile devices for viruses, preferring licensed software, keeping operating systems updated, and using up-to-date antivirus software are among the essential security measures.^【7】

Some free applications available on mobile app stores can be exploited by malicious actors aiming to harvest users’ personal data. Widely adopted free applications without established revenue models may be acquired by malicious actors and later modified through updates to facilitate data theft. Through this method, attackers can reach millions of users in a single day.^【8】

^{Personal Data Protection Day} (Istanbul/Eyüpsultan Gümüşsuyu Primary School)

Permissions requested during app installation must be consistent with the application’s stated functionality. For example, it is suspicious if a contact management app requests access to photos and videos. Applications requesting excessive permissions beyond their intended purpose may be designed for behavioral profiling or tracking visited websites. Therefore, applications that appear suspicious should not be installed on devices, and security software designed to protect mobile systems must be used.^【9】

The Personal Data Protection Authority (KVKK) has continuously carried out its mandate to monitor data violations and impose sanctions since its establishment. To date, 485,533 complaints, reports, and applications have been received, of which 468,120 have been concluded. As a result of these investigations, a total administrative fine of 1 billion 12 million 711 thousand Turkish lira has been imposed.^【10】

According to KVKK records, 1,648 data breach notifications have been submitted to date, of which 359 have been publicly announced on the authority’s website. Additionally, 1,230 legal opinions have been issued on matters within the authority’s jurisdiction, 10 undertakings for cross-border data transfers have been approved, and 1,986 standard contractual clauses have been registered.^【11】