Notification Procedure for Responses to Data Subject Requests: KVKK Public Announcement

On October 1, 2026, the Personal Data Protection Authority ("Authority") published the "Public Announcement on the Notification Procedure for Responses to Be Given to Data Subject Requests." The announcement addresses an issue frequently encountered in practice and clarifies the procedure by which the response given to a data subject request must be notified.

The starting point of the announcement is the finding, established in the examinations conducted within the scope of the complaints submitted to the Authority, that certain data controllers respond to requests solely by oral methods. The Authority has clearly stated that such a practice is not accepted as a response complying with the legislation.

The Legal Framework of the Obligation to Respond to Requests

The rights of data subjects concerning their personal data are regulated under Article 11 of the Personal Data Protection Law No. 6698 ("Law"), and Article 13 provides that requests relating to the exercise of these rights may be submitted to the data controller.

Pursuant to Article 13 of the Law, the data controller is obliged to conclude the requests contained in an application submitted to it as soon as possible and in any event within thirty days, depending on the nature of the request. Within this period, the data controller either accepts the request or rejects it by explaining its reasons, and notifies its response to the data subject in writing or by electronic means.

Article 6 of the Communique on the Procedures and Principles of Application to the Data Controller ("Communique") contains a provision to the same effect. Accordingly, the data controller is obliged to take all necessary administrative and technical measures in order to conclude requests effectively and in compliance with the law and the rule of good faith, and must notify the response it will give to the request to the data subject in writing or by electronic means.

Therefore, the notification procedure, as much as the content of the response, constitutes an obligation determined by the legislation.

The Authority's Finding: Responses Given Solely by Oral Methods

In the examinations it has conducted within the scope of the various complaints submitted to it, the Authority has established that certain data controllers respond to data subject requests solely by means of telephone calls, face-to-face information or similar oral communication methods.

It may be considered that this practice is preferred in practice for various reasons. Concluding the request swiftly, easing the process by communicating directly with the data subject, or avoiding the workload that preparing a written text would bring may be counted among these reasons. However, the Authority's announcement demonstrates that the practical benefit of the preferred method does not replace the notification procedure provided for in the legislation.

In Which Cases Is Oral Communication Possible?

The announcement particularly emphasizes that oral communication is not prohibited altogether. The Authority has stated that it is possible to contact data subjects by telephone, face-to-face meetings or similar methods for the purposes of requesting additional information or documents, clarifying the request or providing information on the request process during the assessment of requests.

However, oral communication carried out within this scope is not accepted as the response required pursuant to Article 13 of the Law and Article 6 of the Communique.

The distinction that follows may be summarized as follows: Oral communication constitutes an auxiliary tool that may be used during the assessment of the request. The final response, on the other hand, must in all cases be notified in writing or by electronic means. Even where the request has in fact been concluded through a telephone conversation, it is considered that the outcome should additionally be notified to the data subject in writing or by electronic means.

The Function of Written or Electronic Notification

The Authority has also explained in the announcement the rationale underlying this approach to the notification procedure. Notifying the response given to the request in writing or by electronic means ensures that whether the request has been accepted, the grounds for refusal where it is refused, the actions carried out within the scope of the request where applicable, and the date on which the response was notified to the data subject are set out in a clear, auditable and provable manner.

In the Authority's words, this matter is of importance in terms of enabling data subjects to exercise their rights effectively, enabling complaint and examination processes before the Board to be conducted properly, and enabling the request process to be documented in potential judicial proceedings.

This rationale also gives rise to a consequence that data controllers should take into account. Written or electronic notification should not be regarded merely as a safeguard operating in favor of the data subject. Since the burden of proving that the request was concluded within the prescribed period and in compliance with the legislation rests with the data controller, documenting the notification also enables the data controller to present its own defense. As it will become difficult to subsequently establish the content and date of a response given orally, it may be considered that this situation may also have consequences in terms of the risk of an administrative fine.

Recording the date on which the response was notified carries a separate significance. Since the period within which the data subject may file a complaint with the Board is linked to the date on which the data controller's response was learned, the ability to document the notification date may be decisive in terms of monitoring the process.

Expectations Regarding the Content of the Response

In addition to the notification procedure, the announcement also sets out expectations regarding the content of the response. The Authority has stated that it is of importance for data controllers to clearly indicate the extent to which the requests contained in the application have been met and to set out the grounds for rejected requests in a clear and comprehensible manner.

This expectation gains particular importance where a large number of requests are submitted together in a single application. Where part of the application is met and part of it is rejected, explaining on a request-by-request basis the extent to which each request has been concluded may be regarded as an appropriate approach. It may be considered that responses given in general terms, from which it cannot be understood which request has been met, would not satisfy the clarity criterion required by the legislation.

Actions to Be Taken by Data Controllers

Following the announcement, it is important for companies to review the following matters:

• Setting out in a written procedure the process running from the receipt of data subject requests to their response, and expressly providing in that procedure that the final response will be notified in writing or by electronic means.
• Determining whether there is any practice under which requests are concluded solely by telephone calls or face-to-face information. Call center, human resources and customer relations units should be examined first in this respect.
• Informing the relevant units that oral communication established for the purpose of requesting additional information or documents in relation to the request does not replace the final response.
• Determining the channels to be used in communicating the response. Methods such as registered electronic mail, messages signed with a secure electronic signature, transmission to the electronic mail address notified in the application, or registered post with return receipt may be assessed in terms of the provability of the notification.
• Preparing templates to be used in response texts. It would be appropriate for the templates to address separately the cases in which the request is accepted, partially accepted or rejected, and to contain explanatory sections concerning the grounds for refusal.
• Verifying whether the information concerning application channels in privacy notices, application forms on the website and the personal data processing inventory is up to date.
• Where part of the requests is concluded through suppliers acting as data processors, ensuring in the agreements and workflows that the response to be given in that process will likewise be notified in writing or by electronic means.,

Conclusion

The public announcement does not add a new obligation to those already provided for under the Law and the Communique. The announcement recalls the notification procedure dimension of the existing regulation and aims to remedy a shortcoming that has arisen in practice.

Nevertheless, it may be considered that the practical effect of the announcement is not limited. There is a possibility that a data controller which in fact resolves the request through a telephone conversation yet does not notify the outcome in writing or by electronic means may be found not to have concluded the request in accordance with the prescribed procedure in an examination to be conducted before the Board.

If the answer to this question is negative, the request response process should be reconsidered in line with the announcement.

You can review the details on the matter in the Public Announcement on the Notification Procedure for Responses to Data Subjects' Applications. (In Turkish)