1. Introduction
In its Announcement published on 1 October 2026, the Turkish Personal Data Protection Authority (“TR DPA”) emphasizes that responses to data subject requests must be notified in writing or by electronic means.
2. Notification Procedure for Responses and Points to Consider
The Authority states that, during the evaluation of requests, it is possible to contact data subjects by telephone, in person, or by similar methods in order to request additional information or documents, to clarify the request, or to provide information about the application process.
However, oral communications held with data subjects do not constitute a response that satisfies the conditions set out in the Personal Data Protection Law No. 6698 (“DPL”) and the relevant secondary legislation.
The following points must be observed in responses to data subject requests:
- Requests must be concluded as soon as possible, depending on their nature, and in any case within 30 days,
- The response must clearly explain the extent to which each request has been granted and give the reasons for any request that is rejected,
- All necessary administrative and technical measures must be taken to ensure that requests are handled effectively, lawfully, and in good faith,
- The response must be delivered to the data subject in writing or by electronic means.
3. Conclusion
Responding in writing or by electronic means makes it possible to document, clearly and verifiably, whether the request was accepted, the reasons for any rejection, any actions taken in response to the request, and the date on which the data subject was notified.
Accordingly, data controllers are advised to follow the prescribed notification procedure when responding to data subjects and, where necessary, to update their data subject request policies.