A Public Announcement Regarding the Procedure for Notifying Data Subjects of Responses to Their Requests Issued by the Personal Data Protection Authority (KVKK) Has Been Published

On October 1, 2026, the Personal Data Protection Authority published a public announcement regarding the notification procedure for responses to requests from data subjects. Article 11 of the Personal Data Protection Law No. 6698 sets forth the rights of data subjects regarding their personal data, while Article 13 regulates the submission of requests to exercise these rights to the data controller.

The announcement states that investigations conducted in response to complaints submitted to the Authority revealed that some data controllers were responding to data subject requests solely through telephone calls, in-person briefings, or similar verbal communication methods. It is emphasized that these methods are not accepted as the response required under Article 13 of the Law and Article 6 of the Communiqué on the Procedures and Principles for Applications to Data Controllers.

The announcement does not introduce a new obligation under personal data protection legislation; rather, it clarifies the Authority’s expectations regarding the manner in which the existing regulations are applied. However, since the non-recognition of an oral response may give rise to the risk of complaints and administrative sanctions regarding requests deemed not to have been answered in accordance with the proper procedure, it is important for data controllers to review their processes for managing requests from data subjects within this framework.

Which Data Controllers Is This Announcement Relevant To?

This announcement applies to all data controllers that receive requests from data subjects regarding the rights listed in Article 11 of Law No. 6698. Pursuant to Article 13 of the Law, the data controller is obligated to resolve the requests contained in the application as soon as possible and no later than thirty days, depending on the nature of the request; to accept the request or reject it by providing a justification; and to notify the data subject of the decision in writing or electronically.

The announcement also specifies that verbal communication with the data subject is permissible during the request evaluation process. Telephone or in-person meetings may be conducted to request additional information or documents, to clarify the request, or to provide information about the request process; however, these meetings will not serve as a substitute for the final response.

Since, in practice, a significant portion of applications are received through call centers, customer service, or human resources departments, the practical impact of the announcement is particularly evident for these units.

Key Points of the Announcement

· Verbal communication does not serve as a substitute for the response required by law. Information provided via telephone calls, in-person briefings, or similar verbal communication methods is not considered the response required under Article 13 of the Law and Article 6 of the Communiqué. In such cases, the relevant individual’s application may be deemed not to have been properly concluded.

· Verbal communication may be established for process management purposes. Contact may be made with data subjects via telephone, in-person meetings, or similar methods to request additional information or documents, to clarify the request, or to provide information regarding the request process. However, this communication does not eliminate the requirement to provide a final response in writing or electronically.

· Written notification ensures that the content and date of the response can be proven. The announcement states that providing the response in writing or electronically ensures that the following are clearly, verifiably, and provably documented: whether the request was accepted or rejected; the grounds for rejection, if applicable; any actions taken within the scope of the request; and the date on which the response was communicated to the relevant individual.

· The scope to which requests are fulfilled must be clearly specified. Data controllers must clearly specify the scope to which the requests contained in the application are fulfilled and provide clear and understandable justifications for any rejected requests. In this context, applications containing multiple requests are expected to be evaluated separately for each request.

· The 30-day timeframe and the obligation to resolve requests effectively remain in effect. Pursuant to Article 6 of the Communiqué, the data controller is obligated to take all necessary administrative and technical measures to resolve data subject requests effectively, in accordance with the law, and in good faith.

· A response in accordance with due process is also important for complaint and judicial proceedings. The Notice emphasizes that providing the response in writing or electronically is important for data subjects to effectively exercise their rights, for complaint and investigation processes before the Board to be conducted properly, and for the application process to be documented in the event of potential judicial proceedings.

Recommended Steps for Data Controllers

· The process for managing data subject requests should be formalized in a written procedure, specifying the steps for receiving the request, verifying identity, forwarding it to the relevant unit, evaluating it, responding to it, and archiving it, along with identifying the unit responsible for each step.

· The final response must always be provided in writing or electronically (e.g., a hand-signed letter, registered email, or via the email address provided by the data subject in their request), and the date of notification must be recorded.

· Informing the call center, customer service, human resources, and field teams; establishing operational guidelines stating that telephone conversations do not serve as a final response and that a written response must be sent in all cases.

· Response templates must be structured on a request-by-request basis; a format must be used in which each request is addressed separately, and the action taken for accepted requests—or the grounds for rejection for denied requests—is clearly and comprehensibly stated.

· Establishing an application registration and tracking system to monitor the 30-day period; maintaining records of the application date, subject matter of the request, response date, and method of notification.

· Retaining response letters and confirmation records related to notifications for the duration specified in the personal data retention and destruction policy, taking into account the need for evidence in potential complaints and legal proceedings.

Frequently Asked Questions

· Can a data subject’s request be answered by phone? No. Telephone calls, in-person briefings, or similar verbal communication methods are not considered valid responses as required under Article 13 of Law No. 6698 and Article 6 of the Communiqué. It is possible to contact the data subject by phone during the request process; however, the final response must also be provided in writing or electronically.

· What is the response period for a data subject’s request? The data controller is obligated to resolve the requests contained in the application as soon as possible and no later than thirty days, depending on their nature. This period begins on the date the request is received by the data controller.

· Can the response to a request be sent via email? The law permits the response to be provided in writing or electronically. In this context, notification may be made via a hand-signed letter, certified email, or the email address provided by the data subject in their request. What is decisive is that the content of the response and the date of notification must be verifiable.

· Is it mandatory to state the grounds for rejecting a request? Yes. The data controller must either accept the request as stated or reject it by explaining the grounds for rejection. The regulation further emphasizes that the grounds for rejected requests must be stated in a clear and understandable manner.

· What can the data subject do if no response is provided to the request? In cases where the request is rejected, the response is deemed insufficient, or no response is provided within thirty days, the data subject may file a complaint with the Personal Data Protection Board. Therefore, providing the response in accordance with the proper procedure and within the prescribed timeframe also serves as a protective measure for the data controller.

You can access other announcements regarding the protection of personal data prepared by MC Legal on our Announcements page.

Source: The Personal Data Protection Authority’s Public Announcement dated October 1, 2026, titled “Procedures for Notifying Data Subjects of Responses to Their Requests.” kvkk.gov.tr