Turkish Data Protection Authority (the “TR DPA”) has published (i) the Communiqué on Procedures and Principles Regarding Personnel Certification Mechanism (“Communiqué”) on December 06, 2021, and (ii) the Data Protection Officer Certification Program (“Program”) on December 07, 2021.

Pre-requisites of being a DPO

Pursuant to the Communiqué, in order to qualify as a DPO, candidates must (i) obtain a participation certificate, which is issued by the TR DPA for the persons who complete the DPO training program, (ii) pass the DPO certification exam to be organized by the personnel certification bodies and (iii) be certified by the personnel certification bodies as a DPO.  DPO certifications are valid for 4 (four) years from the announcement of the DPO exam results.

According to the Program, persons who hold (i) a valid DPO certificate or (ii) have a bachelor’s degree (graduated from 4 (four) year undergraduate programs) from a domestic or foreign university - and hold a participation certificate received within the last 4 (four) years are entitled to take the DPO exam.

Cancellation and suspension of DPO certifications

The Program also stipulates the situations/conditions under which the personnel certification bodies might cancel and/or suspend the DPO certifications as follows: (i) DPO’s request, (ii) determination of false statements made by the DPO, (iii) malicious and misleading usage of DPO certificate by the DPO, (iv) decision made against the DPO by judicial authorities or TR DPA after the examination of the complaint, (v) falsified DPO certificate.

Certificate Tracking and Verification Information System (“SERTABIS”)

In order to ensure that the certification activities are carried out impartially, transparently, and effectively, the SERTABIS, which will allow public inquiries regarding the certification activities, will be established by the TR DPA.

Other major issues

Please note that employing the DPO does not relieve the data controller or data processor from its obligations arising from the Data Protection Law and relevant legislation. Additionally, authorization procedures of the personnel certification bodies in line with the (TS)EN ISO/IEC 17024 standards are also foreseen under the Communiqué.

In light of the Communiqué, it is envisaged that the term “DPO” is likely to be introduced under the Turkish data privacy law in the near future.