PDPB Announcement on the Notification Procedure for Responses to Data Subject Applications
The Personal Data Protection Board’s Public Announcement dated 1 October 2026, entitled “Notification Procedure for Responses to Data Subject Applications”, has been published.
The Board first recalled that Article 11 of the Law No. 6698 on the Protection of Personal Data (“Law”) sets out the rights of data subjects in relation to their personal data, while Article 13 provides that requests concerning the exercise of such rights may be submitted to the data controller. The Board further emphasized that data controllers are required to conclude the requests included in applications submitted to them as soon as possible and, in any event, within thirty days at the latest, depending on the nature of the request.
In the course of its reviews, the Board identified that certain data controllers responded to applications submitted by data subjects solely through telephone calls, face-to-face information sessions, or similar verbal communication methods. In this context, the Board stated that data subjects may be contacted by telephone, through face-to-face meetings, or by similar means during the assessment of an application only for the purposes of requesting additional information or documentation, clarifying the application, or providing information regarding the application process. The Board emphasized that such verbal communications do not constitute a substitute for the final response that must be provided pursuant to Article 13 of the Law.
The Board stressed that, within the scope of applications submitted to data controllers, data controllers must:
- Conclude data subject applications in accordance with the procedures and principles set out in the Law and the relevant Communiqué;
- Notify the data subject of the response in writing or electronically;
- Take into account that telephone calls, face-to-face information sessions, or similar verbal communication methods cannot be regarded as the final response required under the applicable legislation; and
- Clearly indicate the extent to which the requests included in the application have been fulfilled and, with respect to rejected requests, provide the grounds for rejection in a clear and comprehensible manner.
The Board emphasized the importance of compliance with the above requirements.
The full text of the public announcement is available at the following link: