Regulations On The Processing And Protection of Personal Data Under The Right To Information Law
1. General
The Right to Information Law No. 4982 was published on 24.10.2003 and entered into force six months later. This Law also contains provisions relating to the protection of personal data.
Article 2 of the Law, titled “Scope and Area of Application,” provides that:
“This Law shall apply to the activities of public institutions and organizations and professional organizations having the status of public institutions.”
Thus, it is clearly regulated that the Law applies to the activities of public institutions and organizations and professional organizations having the status of public institutions.
2. The Right to Information and the Obligation to Provide Information
Article 4 of the Law, titled “The Right to Information,” provides:
“Everyone has the right to information. Foreigners residing in Turkey and foreign legal entities operating in Turkey may also benefit from the provisions of this Law, provided that the information they request concerns themselves or their field of activity and subject to the principle of reciprocity. Rights and obligations arising from international treaties to which Turkey is a party are reserved.”
Article 5, titled “The Obligation to Provide Information,” provides:
“Institutions and organizations are obliged to make available to applicants any information or document, except those excluded under this Law, and to take the necessary administrative and technical measures to ensure that applications for information are concluded effectively, swiftly and accurately.”
When these provisions are evaluated together, it is seen that public institutions and organizations and professional organizations having the status of public institutions, acting as data controllers, are obliged to provide applicants—whether natural or legal persons—with the requested information, except where restricted by law. Considering that the data subject in the context of personal data protection is the natural person, natural persons may apply under this Law to public institutions and organizations and professional organizations having the status of public institutions. According to Article 11 of the Law, upon application, public institutions and organizations must provide access to the requested information or document within fifteen business days.
The limits of the right to information are also set out in the Law: judicial activities subject to judicial review, information and documents relating to state secrets, intelligence, national economic interests, administrative investigations, judicial investigations and prosecutions, information and documents violating the confidentiality of communications, information and documents of a commercial secret nature, information and documents within the scope of privacy of private life, internal regulations of the institution, and information and documents relating to intellectual and artistic works are excluded from the scope of the Law.
3. Protection of Personal Data and Privacy of Private Life
Article 21 of the Law provides that, except where the person has given consent, information or documents which, if disclosed, would constitute an unjust interference with the individual’s health data or with their private and family life, honor and dignity, or professional and economic values, fall outside the scope of the Law. It further provides that in cases where the public interest requires, personal information or documents may be disclosed by institutions and organizations, on condition that the explicit written consent of the data subject is obtained, and that the individual is notified at least seven days in advance.
Although the concept of “personal data” is not explicitly used in Article 21, it is clear that health data, and other information that would constitute an unjust interference with the private and family life, honor and dignity, or professional and economic values of the person, may not be disclosed without the consent of the data subject.
Pursuant to Article 32 of the Law, it entered into force six months after its publication date of 24.10.2003. From the date of its entry into force until the date the Personal Data Protection Law No. 6698 entered into force on 07.04.2016, the rights of natural persons to obtain information from public institutions and organizations under Article 11 of the PDPL were undoubtedly effective under the Right to Information Law. The scope of the Right to Information Law also allows access to information other than personal data, and permits applications not only by natural persons but also by legal entities. However, Law No. 4982 provides only for access to information from public institutions and organizations, not from all data controllers.
Furthermore, Law No. 4982 does not allow for the exercise of all the rights granted to data subjects under Article 11 of the PDPL. Under the Law, the time limit for providing the requested information is 15 days, which is shorter than the 30-day period provided under the PDPL. Where an individual believes that their rights have been violated as a result of an application under the PDPL, they may lodge a complaint with the Personal Data Protection Board. Under Law No. 4982, however, the individual must apply directly to the administrative judiciary.
Atty. Yalçın TORUN LL.M.
⚠️ WARNING
The copyright of the above written text published on our website belongs to Atty. Yalçın TORUN© 2025 Torun Law Firm – All Rights Reserved.
This article is protected under the provisions of the Law on Intellectual and Artistic Works (No. 5846). The content, in whole or in part, may not be copied, reproduced, published, or shared on any other website without the prior written permission of the author and Torun Law Firm.
This material may only be shared by licensed attorneys, for professional purposes, without any modifications, and with full attribution to the author and the source.
Any unauthorized use may result in legal and criminal liability.