A data subject access request is the request through which an individual exercises the rights listed in Article 11 of the KVKK, such as learning whether their data is processed, requesting information, correction or deletion, towards the data controller. Under Article 13 of the KVKK, the controller must resolve the request within 30 days at the latest. The GDPR counterpart is the rights under Article 15 onwards, with a response period of one month.
Article 11 of the KVKK grants individuals the following rights: to learn whether their personal data is processed, to request information if it is, to learn the purpose of processing and whether the data is used accordingly, to know the third parties to whom data is transferred, to request correction of incomplete or inaccurate data, to request deletion or destruction, to ask that these operations be notified to recipients, to object to a result produced exclusively by automated analysis and to claim compensation for damages. Under Article 13, the request is submitted in writing or through other methods determined by the authority, and the controller must resolve it within 30 days at the latest, free of charge as a rule; if handling it requires a separate cost, the fee in the authority's tariff may be charged.
If the request is rejected, answered inadequately or not answered in time, the individual can complain to the Turkish data protection authority. On the GDPR side, the rights under Article 15 onwards carry a response period of one month, which may be extended by two further months for complex or numerous requests, with the individual informed of the extension within the first month. For site owners, preparation is the only way to avoid a scramble: provide an easy-to-find request channel, define how you will verify the requester's identity and maintain an up-to-date data inventory showing which system holds which personal data. Without an inventory, answering completely within the deadline becomes difficult; recording each request with its dates is part of accountability.
Frequently asked questions
How many days do you have to answer a KVKK request?
Under Article 13 of the KVKK, the controller must resolve the requests in an application as soon as possible and within 30 days at the latest, free of charge as a rule. The period starts when the request arrives. For requests under the GDPR, the basic period is one month. The safest way to avoid missing the deadline is to collect requests through a single channel and record each one with its arrival date.
How is a data subject access request submitted?
The individual submits the request in writing or through other methods announced by the controller, such as registered email or the email address on file. The request should contain information verifying the requester's identity and clearly state which right is being exercised. Controllers usually publish a request form on their website; using the form is not mandatory, but it speeds up the process for both sides.
This content is for information only and is not legal advice.