In the Law of Protection of Personal Data No.6698 (the "Law"), personal data is defined as all kinds of information relating to an identified or identifiable natural person. With all kinds of information statements, in fact, it is not only information such as name, surname, date of birth, place of birth that provides the definitive diagnosis of the individual; At the same time, it means information about physical, familial, economic, social and similar characteristics that enable the individual to be identified. In the law, since personal data are not determined by counting limited, it is also possible to expand the scope of personal data according to the nature of each concrete event. In this context, a real person's motor vehicle license plate, interview results, IP addresses of electronic devices used, audio and video records, location information, criminal record, credit card statements, social media likes, fingerprints, etc. information can also be defined as personal data. EXAMPLE: Images of individuals captured by a video surveillance system may be considered within the scope of personal data if individuals are recognizable. EXAMPLE: In the telephone banking system, the voice recording that the customer instructs the bank can be considered as personal data.

In order for it to be personal data, the information must be related to an identified or identifiable real person. Being identifiable means that it enables the identification of the person as a result of being associated with any record.

EXAMPLE: Name and surname alone are personal data and can identify a real person. However, name and surname may not always be sufficient to identify a real person, in some cases other information may be required along with the name and surname to identify a real person.

General principles to be followed in the processing of personal data are specified in Article 4 of the Law. These principles;

• Compliance with the law and good faith
• Being accurate and up-to-date when necessary
• Processing for specific, explicit and legitimate purposes
• Being connected, limited and measured with the purpose for which they are processed
• Listed as being preserved for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

This principle; means to act in accordance with the principles set forth by laws and other legal regulations in the processing of personal data, and to take into account the interests and reasonable expectations of the relevant persons while processing the data.