Cases Requiring Destruction of Personal Data

Cases Requiring Destruction of Personal Data

Personal data can be collected by natural and legal entities for many purposes, as well as destroyed in accordance with many requirements. Cases requiring the destruction of personal data are clearly specified in the scope of Law No. 6698 on the Protection of Personal Data (KVKK).

Personal data can be destroyed in 3 different ways according to KVKK. These ways include the deletion, destruction and anonymization of personal data.

While the erasure and destruction of personal data is the process of making the personal data inaccessible and unusable in any way for the users concerned, the anonymization of personal data is the process of making the personal data impossible to associate with a specific or identifiable natural person in any way, even by matching it with other data.

For the destruction of personal data, it is necessary to identify all copies in which the data is located and destroyed individually by the mentioned methods according to the type of systems in which the data is located.

According to KVKK, situations that require the destruction of personal data include:

• Modification or amendment of the relevant provisions of legislation which constitute the basis for its processing,
• The disappearance of the purpose that requires its processing or storage,
• where the processing of personal data takes place only on the basis of explicit consent, the withdrawal of the explicit consent of the person concerned,
• Acceptance by the Agency of the application for erasure and destruction of personal data within the framework of the rights of the person concerned,
• If the Agency rejects the application made to it by the person concerned with a request to delete, destroy or anonymize his personal data, considers his answer insufficient or does not respond within the period prescribed by the Law; Submits a complaint to the Board and this request is deemed appropriate by the Board,
• The expiration of the maximum period requiring the retention of personal data and the absence of any conditions justifying the retention of personal data for a longer period of time,

In cases, they are deleted, destroyed or re-deleted, destroyed or anonymized by the Agency at the request of the person concerned.

Data controllers who do not carry out the destruction of personal data within the scope of these cases may face many sanctions under the Law.

‍

‍

Disclaimer: All rights to any articles and content published belong to Efilli Software. All or part of any content, such as text, audio, video, even if the source is shown or the active link is provided, cannot be used, published, shared or modified.

‍