This content has been translated from the original text.
Retaining personal data accurately, up to date, for legitimate purposes and only for as long as necessary, and subsequently deleting, destroying or anonymising it by appropriate methods, is of great importance for both legal compliance and corporate reputation. In this article, we have addressed what legal entities acting as data controllers under Personal Data Protection Law No. 6698 (“KVKK”) should pay attention to in their processes of retaining and destroying personal data.
In this article, we have addressed what legal entities acting as data controllers under Personal Data Protection Law No. 6698 (“KVKK”) should pay attention to in their processes of retaining and destroying personal data. Retaining personal data accurately, up to date, for legitimate purposes and only for as long as necessary, and subsequently deleting, destroying or anonymising it by appropriate methods, is of great importance for both legal compliance and corporate reputation.
Today, increasing digitalisation and data-driven business models are pushing organisations to bear more responsibility than ever for data security and privacy. If you, as a legal entity acting as a data controller, are also interested in questions such as “How long should I retain my data?” and “Which methods should I use for destruction?”, you are in the right place!
1. Introduction
When personal data is processed, the following fundamental principles must be taken into account.
Accuracy and Currency: Data must be accurate, complete and, where necessary, kept up to date. The duty of care to ensure that personal data is accurate and, where necessary, up to date lies with the data controller, who must also keep open, at all times, the channels that allow the data subject to ensure that their personal data is accurate and up to date.
Purpose Limitation: Data must be used only in line with the stated processing purposes. This principle requires the data controller to determine the purpose of data processing clearly and precisely and requires that this purpose be legitimate. If data controllers process data for purposes other than those stated to the data subject, liability will arise for such acts.
Processing Limitation: Data must be collected in a manner that is relevant to, limited to and proportionate to the purposes for which they are processed. The processed data being suitable for achieving the specified purposes requires that the processing of personal data that is unrelated to achieving the purpose or is not needed be avoided.
Retention Period: Personal data must not be kept for longer than the period determined for legal or business purposes. Accordingly, data controllers must comply with the period prescribed in the legislation for the personal data concerned, if there is one; if no such period is prescribed, they may retain the data only for as long as is necessary for the purpose for which it was processed. If there is no valid reason for retaining data any longer, that data will be deleted, destroyed or anonymised. Personal data may not be retained on the grounds that it might be used again in the future or for any other reason.
2. Retention of Personal Data
Personal data should generally be retained for the following purposes.
Ensuring company security.
Carrying out statistical studies.
Performing business and transactions as a result of signed contracts and protocols.
Carrying out human resources processes.
Ensuring corporate communication.
Ensuring that legal obligations are fulfilled as required or mandated by legal regulations.
Communicating with natural / legal persons who have a business relationship with the company.
Managing call centre processes.
Personal data must be retained for the periods prescribed by the relevant legislative provisions or for the period required by the purpose of processing the data. At the end of the period prescribed by the legislative provisions or the period required by the purpose of processing the data, personal data must be deleted or anonymised.
Table 1 Retention Periods
Data | Retention Period |
Call Centre Voice Recordings | 3 Years |
Records Relating to Memberships | 10 Years |
Cookies and Log Records | 6 Months - 2 Years |
Commercial Electronic Mail Consent Records | 3 Years from the date on which consent is withdrawn |
Traffic Information Relating to Online Visitors | 2 Years |
Personal Data Relating to Customers | 10 Years after the legal relationship ends |
Personal Data Relating to Suppliers | 10 Years after the legal relationship ends |
Contracts | 10 Years from the Termination of the Contract |
Camera Recordings | 2 Years |
Data Retained under the Labour Law | 5 Years from the termination of the employment relationship |
Data Relating to Job Applications / Internship Applications / Candidate Applications if the Application Is Not Accepted | 1 Year |
Information on Company Shareholders and Members of the Board of Directors (Except for Those Included in the Share Ledger) | 10 Years |
Personal Data Processed in Commercial Books That Must Be Retained in Accordance with the Company's Activities, Documents Created on the Basis of Records in the Commercial Books, Financial Statements, etc. | 10 Years |
Personal Data Processed with Documents That Must Be Kept under the Tax Procedure Law, such as Invoices / Expense Vouchers / Receipts | 5 Years |
Log Records of Employees' Access to Environments Containing Personal Data | 2 Years (10 Years if Subject to Labour Disputes) |
In the Case of Personal Data Requiring Explicit Consent; Withdrawal of Explicit Consent by the Data Subject | Destroyed immediately. |
3. Process and Techniques for the Destruction of Personal Data
When the conditions for processing personal data cease to exist and the retention periods expire, the data controller is obliged, either on its own initiative or at the request of the data subject, to delete, destroy or anonymise the data. The conditions for processing cease to exist in cases such as the expiry of the statutory retention period, the data subject's withdrawal of consent or, in cases not based on consent, the end of the legitimate reason for processing.
A. Techniques for the Destruction of Personal Data
Personal data is destroyed by being deleted, destroyed or anonymised.
Table 2: Deletion of personal data
Retained Data | Method of Destruction (Deletion) |
Personal Data on Servers | For personal data on servers whose retention period has expired, deletion must be carried out by the system administrator by removing the access authorisation of the relevant users. |
Personal Data in Electronic Media | Personal data in electronic media whose retention period has expired is rendered completely inaccessible and unusable for employees (the relevant users) other than the database administrator. |
Personal Data in Physical Media | For personal data kept in physical media whose retention period has expired, the data must be rendered completely inaccessible and unusable for employees other than the unit manager responsible for the document archive. In addition, it must be blacked out by being struck through/painted over/erased so that it cannot be read. |
Personal Data on Portable Media | Personal data kept on flash-based storage media whose retention period has expired must be encrypted by the system administrator and stored together with the encryption keys in secure environments, with access authorisation given only to the system administrator. |
Table 3: Destruction of personal data
Retained Data | Method of Destruction (Destruction) |
Personal Data in Physical Media | Personal data on paper must be destroyed in paper shredders in a way that cannot be reversed. |
Personal Data on Optical / Magnetic Media | Physical destruction processes such as melting, burning, breaking or pulverising may be applied to personal data on optical and magnetic media whose retention period has expired. |
Anonymisation of personal data
Anonymisation of personal data means rendering personal data incapable of being linked, in any way whatsoever, with an identified or identifiable natural person, even when matched with other data. For personal data to be considered anonymised, it must be rendered incapable of being linked with an identified or identifiable natural person even through the use of techniques appropriate to the recording medium and the relevant field of activity, such as the reversal of the personal data by the data controller or third parties and/or the matching of the data with other data.
B. Ex Officio Destruction Periods
Data controllers that have a Personal Data Retention and Destruction Policy must delete, destroy or anonymise the data in the first periodic destruction process following the date on which the condition for processing ceases to exist (the retention period ends) (at the latest every 6 months). Data controllers that do not have a policy, on the other hand, are obliged to carry out these operations within 3 months from the date on which the condition for processing ceases to exist.
C. Destruction Periods upon the Data Subject's Request
The data subject may request the deletion or destruction of their personal data. If the conditions for processing have completely ceased to exist, the data controller must fulfil the request within 30 days at the latest and inform the data subject. If the data has been transferred to third parties, the data controller must notify the third parties of this and ensure that the deletion or destruction is also carried out on their side. If the data subject's request is rejected, the rejection must be notified, together with its reasons, in writing or by electronic means within 30 days.
D. Retention of Destruction Records
All records relating to deletion, destruction or anonymisation operations must be retained for at least 3 years.
4. Technical and Administrative Measures to Be Taken in Destruction Processes
In order for destruction processes to be carried out lawfully and securely, technical and administrative measures must be taken.
A. Technical Measures
Data access control: It must be ensured that no one other than the relevant users can access deletion or destruction operations.
Security software: Antivirus software, firewalls, IDS/IPS systems, regular penetration tests and strong encryption must be implemented.
Database management: It must be ensured that deletion commands are applied correctly and completely, and that operations are carried out in such a way that the data cannot be recovered.
Logging: All deletion, destruction and anonymisation operations must be recorded in log records and audited.
B. Administrative Measures
Personal Data Retention and Destruction Policy: A Personal Data Retention and Destruction Policy must be prepared in accordance with the legislation in force, kept up to date and communicated to all employees.
Training: Regular training must be provided to the personnel responsible for destruction processes, and general awareness must be raised.
Internal audit: Policy implementations and destruction processes must be audited at regular intervals.
Data processing inventory: All data categories, retention periods and processing purposes must be clearly recorded; the personal data inventory must be consistent with the destruction policy
5. Conclusion
The KVKK imposes serious obligations on legal entities acting as data controllers regarding their personal data processing activities and provides for significant sanctions in the event of non-compliance. It is necessary to prepare a Personal Data Retention and Destruction Policy that clearly sets out matters such as how long personal data will be retained, by which method it will be destroyed and who will be responsible for these processes; furthermore, supporting company personnel with regular training and keeping technical and administrative measures continuously up to date are also of great importance for the successful conduct of these processes.
Remember, protecting personal data and destroying it securely is not merely a legal obligation, but also a fundamental responsibility required by the digital age.
Attorney at Law Mehmet Emre DARICI
