The Personal Data Protection Authority ('KVKK') published, on 5 August 2022, the banking industry good practices guide on protection of personal data. In particular, the guide sets forth the procedures and principles to be complied with and the obligations to be fulfilled within the framework of the Personal Data Protection Law No. 6698 ('the Law'). However, the guide highlights that the Personal Data Protection Board will make its assessment, taking into account the specifics of the concrete case, and that it will conduct ex officio examinations where a complaint has been submitted to it or in the case of an alleged violation.

Moreover, the guide provides guidance to data controllers in relation to personal data processing activities carried out by banks in accordance with the Law and the secondary legislation issued by the Personal Data Protection Board, as well as practice examples in this context.

You can read the guide, only available in Turkish, here.