Data Protection & Privacy

Violations such as breaching the duty to inform, failing to take data security measures, or non-compliance with Board decisions can attract administrative fines up to the statutory ceiling; the amounts are updated annually.

The data controller is the party that determines the purposes and methods of processing personal data; the data processor is the third party that processes data on the controller's instructions. Each has distinct obligations, which should be clarified by contract.

You may apply to the data controller in writing, or through the methods specified by the Board, requesting deletion, destruction or anonymisation; the data controller must respond to the request within 30 days at the latest.

You may first apply to the data controller with your request, and if you receive no response or an unsatisfactory one, you may file a complaint with the Data Protection Board.

Withdrawing consent does not render processing carried out before that point unlawful, but the data controller must stop consent-based processing from that moment onward.

The retention period varies depending on the purpose of processing and the controller's policy; if the applicant is not hired, the data should be deleted or anonymised after a reasonable period.

Yes, a data controller conducting CCTV surveillance must inform visitors of the recording through a visible notice or similar means.

For processing the personal data of a minor lacking capacity of discernment, the consent of the parent or legal guardian is generally required.

Cross-border data transfer is subject to the statutory conditions being met, such as transfer to a country with adequate protection, appropriate safeguards, or explicit consent.

If the data controller fails to respond within the statutory period, or rejects the request, a complaint may be filed with the Board within a defined period after that response deadline.

If an image constituting personal data is shared without your consent, you may request its removal from the platform and pursue legal liability against the person who shared it.

Yes, a person whose personality rights are harmed by unlawful processing may file an action for material and non-material damages under general legal provisions.

Since biometric data is a special category of personal data, the employer must meet additional conditions to use this method, such as obtaining explicit consent or relying on a statutory exception.

Transferring personal data to a third party without the data subject's explicit consent or a legal basis may result in both administrative sanctions and, under the conditions set by law, criminal liability.

In the event of a company transfer, the transferee assumes the role of data controller, and the obligations relating to personal data processing — including informing data subjects — pass to it.