Bezen & Partners | News

Legal Briefing - Communiqué Pertaining to the Principles and Procedures of the Personnel Certification Mechanism




 











Key Issues




  • Data Protection Officers

  • Data Protection Officer Accreditation Standards

  • Certificate Tracking and Verification Information System














 Communiqué Pertaining to the Principles and Procedures of the Personnel Certification Mechanism




The Communiqué Pertaining to the Principles and Procedures of the Personnel Certification Mechanism (the “Communiqué”), prepared by the Personal Data Protection Authority (the “Authority”), has been published in the Official Gazette dated 6 December 2021 and numbered 31681 and entered into force on the date of its publication. The Communiqué introduced the concept of data protection officers into Turkish law.




Introduction

 



The Communiqué, which has been adopted in accordance with Article 22(1)(e) of the Personal Data Protection Law numbered 6698[1] and Articles 7(1)(g)-(ı) and 18(1)(a) of the Regulation on the Organisation of the Personal Data Protection Authority[2], essentially regulates (i) the role of data protection officers; (ii) the conditions with which personnel certification institutions must comply in order to be authorised to grant accreditation; and (iii) the Certificate Tracking and Verification Information System (“SERTABIS”).



Accreditation Process



Under the European Union legislation, data protection officers are independent actors who are responsible for data controllers’ compliance with the personal data protection legislation. They report directly to senior management and are equipped with significant authority.  The Communiqué is in line with the European Union legislation.



As per the Communiqué, personnel certification institutions accredited in accordance with the (TS) EN ISO/IEC 17024 standard and authorised by the Authority will be able to issue certificates to applicants participating in training programs, which are to be conducted in accordance with the training principles and procedures to be announced in detail by the Authority at a later stage. Those applicants who obtain a certificate and succeed in the exams of  the respective personnel certification institution will obtain the title of “data protection officer”. No other technical or professional pre-qualification conditions are set forth other than participating in the relevant training program and successfully completing the exams at the end of such program.



Main Principles Regarding Data Protection Officers



Data protection officers will be deemed to have gained sufficient personal data protection knowledge within the scope of their training and the accreditation will be valid for a period of 4 years. At the end of this period, however, data protection officers are required to retake the exams and hence renew their accreditation.



SERTABIS



The Communiqué also establishes the SERTABIS in order to ensure that the certification process is carried out in an impartial, transparent and effective manner.  



Conclusion



The Communiqué establishes principles for (i) the training of persons on personal data protection to become data protection officers; (ii) experts to take solid action towards the enhancement of data security;  and (iii) transparency and public confidence with the organisation of the SERTABIS. Finally, a point worth noting is that working with a data protection officer will however not release data controllers or data processors from liability to comply with the relevant legislation.



 




 



Key contacts



For more information, please contact us:

















 



Murat Soylu



Partner



+90 (212) 366 6802



[email protected]



 



Dicle Yağmur Kılıç



Junior Associate



+90 (212) 366 6822                           



[email protected]



 



Özcan Yeşilyurt



Trainee



+90 (212) 366 6810



[email protected]



 



 



 




 



 



[1] Published in the Official Gazette dated 7 April 2016 and numbered 29677.





[2] Published in the Official Gazette dated 26 April 2018 and numbered 30403.




TOP