Data Subject Requests: The Authority Clarifies Response and Notification Requirements

Introduction

On 1 October 2026, the Personal Data Protection Authority (“Authority”) published a public announcement providing important clarifications regarding the manner in which responses to applications submitted by data subjects to data controllers under the Personal Data Protection Law No. 6698 (“Law”) must be notified.

Response Period and Notification Method for Data Subject Applications

While Article 11 of the Law sets out the rights of data subjects in relation to their personal data, Article 13 provides that requests concerning the exercise of such rights may be submitted to the data controller. Accordingly, data controllers are required to conclude applications addressed to them as soon as possible, depending on the nature of the request, and in any event within no later than 30 days.

A data controller may accept an application or reject it by stating the reasons for the rejection; however, its final response must be notified to the data subject in writing or electronically.

Verbal Communication Does Not Constitute a Final Response

The Authority stated that, in the course of its examinations concerning various complaints submitted to the Authority, it had observed that certain data controllers responded to data subject applications solely through telephone calls, face-to-face communications or similar verbal methods.

The Authority expressly emphasised that such communication methods may be used during the application process for purposes such as requesting additional information or documents, clarifying the application, or providing information regarding the process; however, they cannot replace the final response required to be provided under the Law and the relevant legislation.

The Response Must Be Capable of Being Documented

The announcement further stated that notifying the response in writing or electronically is important in order to establish, in a clear, auditable and verifiable manner, whether the request has been accepted, the reasons for rejection where applicable, the actions taken within the scope of the application, and the date on which the response was notified to the data subject.

The Authority noted that this is necessary both to enable data subjects to exercise their rights effectively and to ensure that complaint and review processes before the Authority are conducted properly.

Compliance Obligations for Data Controllers

In this context, it is important for data controllers to conclude data subject applications in accordance with the Law and the Communiqué on the Procedures and Principles of Application to the Data Controller; to ensure that final responses are always communicated in writing or electronically; not to use verbal communication methods as a substitute for an official response; and, particularly in respect of rejected requests, to set out the reasons for rejection in a clear, comprehensible and specific manner.

Conclusion

The Authority’s announcement demonstrates that, for data controllers, compliance obligations encompass not only responding to an application within the prescribed time limit, but also communicating the response in a procedurally compliant, documentable and subsequently auditable manner. Accordingly, data controllers should consider reviewing their internal procedures, response templates and record-keeping practices for handling data subject applications.

You can access the public announcement, which is only in Turkish, from here.