What a citizen request may keep — and for how long
The principles in Article 4 of Türkiye’s data protection law (KVKK) and the deadlines in the deletion regulation determine what a request record may hold, and for how long.
IN SHORT
- 01Article 4 of Law No. 6698 requires personal data to be processed for specific, explicit and legitimate purposes, and to be relevant, limited and proportionate to those purposes.
- 02Under Article 7, once the reasons for processing no longer exist, the data is deleted, destroyed or anonymised.
- 03Under the deletion regulation, the interval for periodic destruction is set in the controller’s policy and may in no case exceed six months.
A request is a small file
At first glance a pothole report is just an address and a sentence. Yet the record also carries the person who reported it, their phone number, perhaps the location of their home, and a photo. What the organisation sees as a work order, the law sees as a file containing personal data.
The principles of the law
Article 4 of the Personal Data Protection Law No. 6698, published in the Official Gazette of 7 April 2016 (No. 29677), makes the following principles mandatory when processing personal data:
- Lawfulness and fairness
- Accuracy and, where necessary, being kept up to date
- Processing for specific, explicit and legitimate purposes
- Being relevant, limited and proportionate to the purpose
- Retention only for the period set by law or needed for the purpose
“Every piece of information kept in a request should answer the same question: is it needed to do this job?”
Location and photos
Location and photos are the job itself: they tell the crew where to go and what they will find. Yet the same photo may show a number plate, a face or the inside of a home. “Relevant, limited and proportionate” becomes concrete here: the job needs the problem itself, not everything around it.
When data must go
Under Article 7, even lawfully processed personal data must be deleted, destroyed or anonymised — on the controller’s own initiative or at the data subject’s request — once the reasons for processing no longer exist.
Under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, published in the Official Gazette of 28 October 2017 (No. 30224), the interval for periodic destruction is set in the controller’s retention and destruction policy and may in no case exceed six months. Controllers not required to have such a policy must act within three months of the obligation arising.
- This article is not legal advice and does not replace your legal team’s assessment.
- We do not suggest a single correct retention period; it depends on the organisation’s obligations.
Sources
This article has been prepared for general information purposes only and does not constitute legal, financial, technical or other professional advice. Legislative and technical information reflects the position as at the date of publication. Short extracts may be quoted provided that the source is cited and a link to the article is given; publication of the article in full or of a substantial part of it is subject to written permission. Terms of use