EUROPEAN UNION GENERAL DATA PROTECTION REGULATION (GDPR) COMPLIANCE CONSULTANCY

The EU General Data Protection Regulation (GDPR) is the most important change in data security over the last 20 years. This law, adopted by the European Parliament on 14 June 2016, has been effective as of 25 May 2018 and imposes severe penalties on organizations that do not comply with laws on GDPR compliance.

GDPR replaced the Directive 95/46/EC on the Processing and Free Movement of Personal Data of the European Parliament and the Council of Europe. Its main purpose is to ensure that citizens of the European Union have an effective privacy and security approach with the reshaping of compliance in organizations in order to ensure data security.

Article 3 of the GDPR relates to the Regional Scope. In the 2^nd chapter of the article;

If an organization established outside the EU is offering products and services to the data subjects living in the EU or monitoring the behavior of a natural person within the EU even if this is not based on any payment, these are sufficient indicators showing that the organization is subject to GDPR.

To interpret the relevant article of the law; for example, if you offer services and products in one of the languages spoken in the EU on your organization's website, you are in the Increased Territorial Scope. If you collect the data of persons from a contact page and offer them a list of currencies and prices used in Europe, you are in the scope of GDPR. In addition, for example, identifying the data of persons through a website or different methods by profiling, finding their habits, and obtaining their IP addresses by using cookies are also evaluated within this scope. On the other hand, if you are engaged in import, export and any commercial activities with EU member states, you must meet the GDPR compliance requirements.

As GDPR is related to the personal data of EU citizens living within or outside Europe, organizations resident in Türkiye are significantly mislead. Likewise, many organizations outside the EU region have similar perception. For example, as in 2018, according to various studies, 50% of American companies think that they will not be affected by GDPR. Only 12% of Asia-Pacific companies prepared for GDPR.

Some misleading publications report that GDPR is a regulation that applies only in the EU. This is completely wrong. Many organizations in Türkiye fall within the scope of GDPR, along with KVKK for various reasons. It is important that the administrative and technical measures required by the two laws differing in terms of retention periods, responsibilities, and penalties that need to be determined during the compliance process, are transferred to policies, procedures, and all other documents with a combined approach.