ADMINISTRATIVE FINES OF THE PERSONAL DATA PROTECTION AUTHORITY THROUGH E-NOTIFICATION SYSTEM
As per the public announcement dated 10 June 2025 of the Personal Data Protection Authority (in Turkish, “Kişisel Verileri Koruma Kurumu”, the “Authority”), a significant transformation has been initiated in the procedures and principles regarding the notification of administrative fines imposed under the Law on the Protection of Personal Data (in Turkish, “Kişisel Verilerin Korunması Kanunu”, hereinafter referred to as “PDPL”).
As a result of the protocol efforts between the Authority and the Ministry of Treasury and Finance, the technical integration enabling notifications to be made via the E-Notification infrastructure of Revenue Administration Presidency has been completed, and the system has been activated.
Pursuant to Article 18 of the PDPL below, the administrative fines stipulated in subparagraphs (a), (b), (c), and (ç) of the first paragraph shall be imposed on the data controller, while the administrative fine stipulated in subparagraph (d) shall be imposed on natural persons or private legal entities who are data controllers or data processors.
Above-mentioned Article of the PDPL, titled “Misdemeanors,” includes the following provisions:
“(1) For those who fail to fulfill their obligations under this Law;
a) those who fail to comply with the obligation to inform under Article 10 shall be imposed an administrative fine from TRY 68,083 to TRY 1,362,021,
b) those who fail to comply with the obligations regarding data security under Article 12 shall be imposed an administrative fine from TRY 204,285 to TRY 13,620,402,
c) those who do not comply with the decisions made by the Board pursuant to Article 15 shall be imposed an administrative fine from TRY 340,476 to TRY 13,620,402,
ç) those who fail to fulfill the registration and notification obligation foreseen in Article 16 regarding the Data Controllers’ Registry shall be imposed an administrative fine from TRY 272,380 to TRY 13,620,402,
d) those who fail to fulfill the notification obligation stipulated in the fifth paragraph of Article 9 shall be imposed an administrative fine from TRY 71,965 to TRY 1,439,300.
(2) The administrative fines set forth in subparagraphs (a), (b), (c), and (ç) of the first paragraph shall be imposed on data controllers; whereas the administrative fine set forth in subparagraph (d) shall be imposed on data controllers or on natural persons and legal persons governed by private law who process data.”
Accordingly, pursuant to Article 26(4) of the Misdemeanor Law, administrative sanction decisions may be notified electronically by the Ministry of Treasury and Finance using the technical infrastructure established pursuant to Article 107/A of the Tax Procedure Law, under protocols to be executed between the relevant authorities and the Ministry of Treasury and Finance.
Within the scope of this systemic transition, administrative fines imposed by the Authority will now be notified to data controllers via the Revenue Administration Presidency’s E-Notification system (in Turkish, “Dijital Vergi Dairesi”).
However, notifications addressed to data controllers who do not have a tax registration or whose tax registration has been cancelled will continue to be made in accordance with the provisions of Notification Law.
Our Law Firm remains at your disposal for any further clarifications you may need.
Copyright © 2025 Cailliau&Colakel Attorney Partnership, All rights reserved.