EU General Data Protection Regulation 2016/679, the primary data protection law for the European Economic Area.
The General Data Protection Regulation (Regulation (EU) 2016/679) governs the processing of personal data of individuals in the EU/EEA. It applies extraterritorially to controllers and processors offering goods or services to, or monitoring, EU data subjects. Core principles include lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Maximum fines reach EUR 20 million or 4% of global annual turnover.
Türkiye's Personal Data Protection Law (Law No. 6698), the national data protection regime supervised by KVKK Authority.
Data Protection Impact Assessment, a structured analysis required for high-risk processing of personal data.
The natural or legal person who, alone or jointly, determines the purposes and means of processing personal data.