A Foreign Controller Receives a KVKK Board Information Request: The Fifteen-Day Duty

Identify the Board’s request and the responsible entity

Article 15(1) of Personal Data Protection Law No. 6698 authorises the Board to investigate on a complaint or on its own initiative after learning of an alleged infringement. A controller should therefore read the actual request before treating it as an ordinary customer application. Record the issuing authority, investigation reference, addressee, requested documents and the legal provisions identified. A subject line mentioning privacy does not establish which procedure is underway.

The named company must then be matched to the processing at issue. Article 3 defines the controller by its decisions about the purposes and means of processing and responsibility for the filing system. A multinational group’s headquarters, local subsidiary and external service provider are separate entities. The response should explain the actual role of the addressee and support that explanation with the relevant processing arrangements. Merely referring the Board to another group company does not answer a request addressed to the controller.

Where the addressee disputes that it controlled the relevant processing, explain who selected its purpose, who instructed the operation and which records support that allocation. A group organisation chart establishes ownership relationships, but it does not by itself establish who determined a particular processing activity. Preserve the agreements and operational instructions that substantiate the company’s position.

Under Article 11(3) of the Data Controllers Registry Regulation, the foreign controller’s representative must accept Authority correspondence, forward requests to the controller and transmit its answers. Article 12(1)(c) provides for Authority communication through the representative notified in the registry. The foreign-controller representation framework explains that appointment. Receiving the request is the beginning of the response process; it does not transfer the controller’s substantive compliance duties to the representative.

Establish receipt and the fifteen-day timetable

Article 15(3) requires the requested investigation information and documents to be sent within fifteen days. Preserve the request in its original form together with evidence of delivery to the relevant recipient. Headquarters’ internal registration date, the day a manager reads a translated summary and the date of legally relevant receipt can differ. The deadline assessment must use the actual communication and applicable service rules, rather than selecting the latest date appearing in the company’s workflow.

The statute’s fifteen-day period should not be replaced by the thirty-day period in Article 13. Article 13 concerns applications made by data subjects to the controller. A Board request following such an application belongs to the investigation stage and has its own rule. The representative should identify the request as a statutory investigation matter when escalating it, so an internal customer-service timetable does not displace the legal deadline.

A request for clarification, a change of representative or negotiations about document access do not themselves create a statutory suspension. If an obstacle exists, explain it promptly to the Authority, identify what can be supplied and preserve the correspondence. Article 15(3) does not establish a general automatic extension for foreign headquarters, translation delays or a large volume of records. The controller should not treat an unanswered request for additional time as permission to submit late.

Map the investigation’s information requirements

The statutory duty concerns information and documents related to the matter being investigated. Prepare a response schedule matching each numbered request to the relevant record, person responsible and proposed attachment. This is particularly useful when the Board asks about legal grounds, notice wording, recipients, retention, access permissions and the handling of a particular individual’s application. Each issue calls for its own evidence; a general privacy policy rarely proves the entire processing history.

Distinguish the policy that existed when the relevant event occurred from the policy currently in force. A revised notice can demonstrate a later change, but it does not establish what the individual was told earlier. Likewise, a signed processing agreement identifies contractual arrangements, while system records can establish whether access and disclosures followed those arrangements. The response should make these evidential functions clear instead of presenting every document as interchangeable proof of compliance.

Article 15(3) expressly excludes information and documents constituting state secrets. That wording should not be rewritten as a general exception for every commercial secret or confidential contract. Where another specific legal protection is engaged, identify its actual source and explain the issue to the Authority through the proper procedure. A confidentiality label added by the company does not, on its own, answer the statutory request or establish that the material can be withheld.

Preserve the relevant evidence

An investigation response requires reliable records of what occurred, not only a narrative prepared after receipt of the request. Identify the relevant systems, data categories, transactions and period. Preserve the original request, associated data subject correspondence, notices, authorisations, access records and relevant processor communications. Record where each item came from and whether it is an original, export or translation. This supports a traceable account of the processing that the Board is examining.

Preservation must remain compatible with Article 4’s requirements of purpose limitation, proportionality and necessary retention. A properly defined investigation record is different from copying every employee’s mailbox indefinitely. Identify the material needed for the investigation and the legal basis for retaining it. Review routine deletion schedules to prevent the loss of relevant evidence while avoiding an unrestricted collection of unrelated personal data.

When a record no longer exists, state that fact accurately and explain the relevant system, retention rule and evidence of deletion where available. Do not reconstruct a historical log and present it as an original record. A later technical analysis should be identified as such, with its method and limits. Article 12 also requires the controller to conduct or commission necessary audits within its organisation, making the existing audit history relevant when the Board asks about security governance.

Prepare a complete, verifiable response

A useful response begins by identifying the controller, the investigation and the authority of the person submitting it. It then answers the Board’s questions in the order asked. State the factual finding, the legal ground relied on and the supporting attachment for each issue. Where the answer concerns several processing activities, separate them rather than claiming that a single consent statement covers the company’s entire relationship with the individual.

Article 4’s general principles and the applicable processing conditions in Articles 5 or 6 remain relevant to the underlying conduct. For overseas disclosures, Article 9 requires a separate transfer analysis. Our guide to Article 9 and overseas transfer safeguards explains that framework. The investigation response should identify the mechanism actually relied on during the relevant period, supported by dates and documents, rather than substituting a newly signed instrument for missing historical evidence.

Mark the source and date of translations and keep the original documents available. Reconcile names, identifiers and time zones across attachments so the chronology remains intelligible. The submission should distinguish established facts from issues still under examination and identify the basis for any technical conclusion. A partial response must be described honestly as partial; the existence of a cover letter does not establish that every requested item has been supplied.

Before submission, check that attachments are present, readable and correctly numbered. Preserve the completed submission and evidence that it reached the appropriate Authority channel. A message sent from the representative to headquarters is an internal escalation, not proof of delivery to the Authority. Any later supplement should refer to the original submission and identify precisely what it adds or corrects.

Address access and on-site examination

Article 15(3) also requires the controller to permit an on-site examination where necessary. This is an additional aspect of the investigation duty. The company should identify the relevant premises, systems and personnel and arrange a responsible point of contact. A document response does not automatically eliminate the possibility of an examination, and an appointment of a local representative does not place every relevant system within that representative’s physical custody.

For a foreign controller using Turkish premises or processors, clarify who operates the relevant system and who can provide access to the requested material. Article 12(2) makes the controller jointly responsible with a processor for taking the security measures addressed in Article 12(1) when processing is performed on the controller’s behalf. Outsourcing therefore requires informed coordination; the controller cannot establish compliance simply by saying that the technical information belongs to its vendor.

The precise scope and practical arrangements must follow the actual investigation and lawful request. Preserve instructions, attendance records and the description of material examined. The Law’s reference to on-site examination should not be expanded into an unsupported claim about unrestricted extraterritorial powers or private access to another company’s systems. Where the location or custody creates a legal difficulty, identify it specifically and address it with the Authority rather than treating it as an automatic exemption.

Protect personal data during the response

Producing investigation material is itself a processing activity. Article 12 requires appropriate technical and organisational measures to prevent unlawful processing and access and to safeguard personal data. The response team should restrict working copies to authorised people, use secure transfer channels and avoid distributing identity documents or sensitive attachments to everyone copied into a general email conversation. Security controls should support timely production of the relevant material.

Apply relevance and proportionality to the response schedule. An attachment can contain information about people unrelated to the investigation. Identify that issue and determine how the requested evidence can be provided faithfully while protecting unrelated information. Redaction must not silently remove the very facts the Board has requested. When a restriction changes the meaning or completeness of an attachment, explain it transparently and retain the unaltered original securely.

The international response team also requires an Article 9 assessment where personal data are transferred abroad. A Turkish investigation does not automatically authorise unrestricted sharing of its contents throughout a foreign corporate group. Identify who actually needs the material and why, then apply the relevant legal grounds and transfer conditions. The representative’s authority to communicate with the Board and the company’s authority to send personal data to another overseas entity are separate questions.

Distinguish investigation from a remedial decision

Under Article 15(5), when the Board establishes an infringement, it orders the controller to remedy it and notifies the relevant parties. The controller must implement the decision without delay and within thirty days after service at the latest. This thirty-day outer limit does not turn the original fifteen-day investigation request into a thirty-day request. Keep separate records for the information submission and the later measures required by a decision.

The remedial file should identify the ordered action, affected processing, responsible person and evidence of completion. A decision requiring correction of a practice is not necessarily satisfied by sending a statement of future intention. Conversely, the required action must be read from the actual decision; the response team should not invent additional measures and describe them as orders of the Board. Record voluntary improvements separately from measures taken to comply with a specific instruction.

Article 15(7) permits the Board to stop processing or overseas transfers where the joint conditions of harm that is difficult or impossible to remedy and manifest unlawfulness are met. Such an order requires immediate attention to its actual scope. It is distinct from an ordinary request for information. The controller must not infer that responding to questions automatically authorises continuation of processing covered by a stopping decision.

Assess compliance, sanctions and later proceedings

Article 18 of Law No. 6698 provides administrative sanctions for specified infringements, including failure to fulfil Board decisions issued under Article 15. The legal character of the conduct and the actual Board instrument must be examined before selecting a sanction provision. A commercial assurance that the Turkish representative will “handle all fines” cannot change the identity of the statutory duty-holder or determine the Board’s assessment.

Under the current Article 18(3), administrative fines imposed by the Board can be challenged before the administrative courts. Any challenge requires its own review of the notified decision, service date, jurisdiction and applicable procedural period. An investigation response is not itself a judicial challenge, and sending an objection letter to the Authority should not be assumed to preserve a court deadline. The procedural route must be assessed from the measure actually adopted.

Keep the final investigation record coherent: request and receipt, evidence preserved, questions answered, attachments delivered, subsequent correspondence and any decision implemented. This record supports accountability inside the company and enables a later lawyer or court to understand the chronology. It also prevents a change of staff, representative or service provider from obscuring what the controller knew and what it actually submitted.

Frequently asked questions

1. Can the Board investigate without a data subject complaint?

Yes. Article 15(1) permits an investigation on a complaint or on the Board’s own initiative after learning of an alleged infringement. The absence of a prior customer application does not itself invalidate an official investigation request.

2. Is the controller allowed thirty days to answer a Board information request?

Article 15(3) specifies fifteen days for requested investigation information and documents. Article 13’s thirty-day outer limit concerns applications by data subjects. The two procedures must be distinguished.

3. Does the period start only when foreign headquarters reads the request?

The relevant receipt and service must be established from the actual communication and applicable rules. Internal forwarding or translation dates do not automatically replace legally effective receipt through the notified representative.

4. Does asking for more time automatically extend the deadline?

No automatic extension arises from such a request under Article 15(3). Explain any specific obstacle promptly, provide what can lawfully be produced and preserve the Authority’s response. Do not assume silence grants additional time.

5. Can commercial confidentiality justify withholding everything?

Article 15(3) expressly excepts state secrets. A commercial confidentiality label is not the same exception. Any separate legal protection must be identified and addressed specifically through the proper procedure.

6. Can the controller send only its current privacy policy?

Only if that document actually answers the request, which must be assessed from its terms. Historical processing, actual recipients, system access and earlier notices require evidence relating to the relevant event and period.

7. Is the Turkish representative automatically responsible for the underlying processing?

The representative has the minimum receipt, forwarding and registry functions specified in Article 11 of the Registry Regulation. The foreign company’s role and duties as controller remain. Separate conduct by a representative requires its own assessment.

8. Can the Board require an on-site examination?

Article 15(3) requires the controller to permit an on-site examination where necessary. The practical arrangements and scope depend on the lawful investigation and actual request, including where relevant systems and records are held.

9. How long does the controller have to implement a remedial Board decision?

Article 15(5) requires implementation without delay and within thirty days after service at the latest. This is a separate obligation from the fifteen-day production of investigation information.

10. Does a Board investigation automatically stop overseas transfers?

No automatic stopping rule follows from investigation alone. Article 15(7) authorises a stopping decision when its cumulative conditions are met. Any actual decision must be read and implemented according to its scope.