The natural or legal person who, alone or jointly, determines the purposes and means of processing personal data.
Under Article 4(7) GDPR and Article 3 KVKK, the data controller is the entity that decides why and how personal data is processed. Controllers bear primary accountability obligations, must implement appropriate technical and organisational measures, conclude processor agreements (Article 28 GDPR), maintain records of processing (Article 30), notify breaches, and respond to data subject rights requests.
Türkiye's Personal Data Protection Law (Law No. 6698), the national data protection regime supervised by KVKK Authority.
EU General Data Protection Regulation 2016/679, the primary data protection law for the European Economic Area.
Data Protection Impact Assessment, a structured analysis required for high-risk processing of personal data.