Regulations On The Processing And Protection Of Personal Data Under The Civil Registration Services Law
1. General Overview
The Civil Registration Services Law No. 5490 entered into force on 29 April 2006. Article 1 of the Law defines its purpose as follows:
“To determine and register natural and legal events relating to a person’s birth, death, personal and civil status, nationality and any changes therein; to record these in registers; to create an electronic national address database; and to ensure the association of civil registry records with address information.”
2. Family Register
Article 7 of the Law provides that a separate family register shall be kept for each neighborhood or village, containing personal data of individuals. The personal data to be included in family registers is explicitly listed in the Law. These include:
- Turkish Republic ID number,
- Province, district, village or neighborhood of registration, volume, family and individual sequence numbers,
- Name and surname, gender, names and surnames of parents, previous surnames of married women, place and date of birth, and date of registration,
- Events such as marriage, divorce, establishment or denial of paternity, death, acquisition or loss of nationality, corrections made by competent authorities,
- Religion, marital status, place of residence address, photograph, biometric data, guardianship and custody information.
Of these, ID number, residence address, photograph, biometric data, and custody/guardianship information are to be kept exclusively in electronic form.
Civil registration services are carried out by the General Directorate of Civil Registration and Citizenship under the Ministry of Interior, and by the provincial directorates subordinate to it. A central electronic database has been established for the storage of these records. Furthermore, the Identity Sharing System (KPS) has been created, enabling the sharing of data in the central database with institutions and legal entities providing public services.
3. Confidentiality of Personal Data
Article 9 of the Law, titled “Confidentiality,” stipulates that civil registry records and the documents forming their basis are confidential. They cannot be seen or examined by anyone other than authorized officials or those with inspection powers. Courts are exempt from this restriction. Officials processing such data, as well as those accessing registry information through the Identity Sharing System, must also comply with confidentiality obligations, which continue even after they leave public service.
Following the adoption of the Personal Data Protection Law (KVKK) in 2016, Article 45 of Law No. 5490 was amended on 19 October 2017 by Law No. 7039 to ensure compliance with data protection standards. Article 45/5 provides:
“The General Directorate shall take appropriate security measures to prevent the unlawful processing and access to, and to ensure the protection of, personal data, and shall monitor whether institutions and public-service legal entities requesting data also take such measures.”
Under Article 45/1, the Law specifies with whom data may be shared. The Ministry may share:
- Identity data with institutions, legal entities providing public services, insurance and pension companies operating under the Insurance Law, banks under the Banking Law, the Risk Center and companies established under Article 73 of Law No. 5411 for information-sharing, and financial leasing and factoring companies under relevant legislation;
- Address data with institutions providing address-based public services, as well as with the same entities listed above.
Institutions and organizations may only obtain personal data relevant to their operations and must not use such data for purposes other than providing defined services.
4. Sharing of Personal Data
Article 45 allows the sharing of personal data with insurance companies, banks, risk centers, and financial leasing or factoring companies even without the individual’s consent, with the aim of supporting the free circulation of goods and services in a market economy. This provision must therefore be assessed in light of the need to balance the right to privacy with the facilitation of economic activity.
Article 45/2 establishes a “Data Sharing Board” within the General Directorate, responsible for determining beneficiaries of data sharing, its scope, and methods. The procedures of this Board are set out by a regulation issued by the Ministry. However, this delegation of authority may conflict with constitutional provisions: Article 20 of the Constitution allows the processing of personal data only as prescribed by law, and Article 13 requires that restrictions on fundamental rights and freedoms must not infringe their essence and must be made by law.
Furthermore, Article 45 provides: “For the statistical use of databases created under this Law, the provisions of the Turkish Statistics Law No. 5429 shall apply.” Accordingly, pursuant to Article 9 of the Statistics Law, institutions and organizations must provide, without charge, to the Turkish Statistical Institute (TÜİK) the records and data files they collect, process, and store for their activities, as well as maps and remotely-sensed data, to be used in official statistics.
Atty. Yalçın TORUN LL.M.
⚠️ WARNING
The copyright of the above written text published on our website belongs to Atty. Yalçın TORUN© 2025 Torun Law Firm – All Rights Reserved.
This article is protected under the provisions of the Law on Intellectual and Artistic Works (No. 5846). The content, in whole or in part, may not be copied, reproduced, published, or shared on any other website without the prior written permission of the author and Torun Law Firm.
This material may only be shared by licensed attorneys, for professional purposes, without any modifications, and with full attribution to the author and the source.
Any unauthorized use may result in legal and criminal liability.