Mehmet Gün

We are one of the oldest and largest law firms in Turkey and are considered internationally to be among the top-tier of legal services providers. We are a full-service law firm leading the intellectual property field among others, providing dispute management, advisory, transactional, prosecution, investigation, and regulatory markets law services to domestic and multinational corporations. We are based in Istanbul, with working and correspondent offices in Ankara, Izmir and the major commercial centres in Turkey. We operate mainly in Turkish and English and also work fluently in German and French. We advise a large portfolio of clients in numerous fields of activity including life sciences, insurance and reinsurance, energy, construction & real estate, logistics, technology, media and telecoms, automotive, FMCG, chemicals and the defense industries. Our vision is to be the leader in the services we provide, sensitive to wider society, the environment, and our employees as an innovative and sustainable institution. Our clients’ success is at the heart of our own success. We closely monitor developments in the business sectors in which our clients operate and invest in accumulating industry specific knowledge to understand their changing needs. We actively participate in professional, trade and business organisations in Turkey and internationally. We are committed to adapt to our clients’ changing business needs by delivering innovative, high quality and commercially prudent legal solutions. Gün + Partners Kore Şehitleri Cad. 17 Zincirlikuyu 34394 İstanbul, Turkey+90 (212) 354 00 00+90 (212) 274 20 95gun@gun.av.trhttps://gun.av.tr/ Email: begum.yavuzdogan@gun.av.trT: + 90 (212) 354 00 24Begüm Yavuzdoğan Okumuş has been with the firm since 2007 and became a partner in 2021. Her practice focuses on data protection and privacy, corporate and M&A, life sciences, and competition. Begüm deals with all aspects of data protection and privacy, including supervising and conducting data privacy compliance projects, advising multinational clients in their activities on a day to day basis as well as in their specific projects. She has sector specific knowledge in regulated sectors and advises clients on newly developed devices/apps to ensure compliance. Begüm advises clients on international data transfer of personal data and represents clients before the Turkish DPA. She assists clients in data breach notifications and investigations, provides appeal strategies to object to Turkish DPA decisions rendered against our clients. Begüm represents multinational companies operating in various industries including pharmaceutical, medical device, telecoms, banking and automotive industry. She holds Certified Information Privacy Professional Europe (CIPP/E) designation from the International Association of Privacy Professionals and she is one of the former co-chairs of IAPP Knowledgenet Istanbul Chapter, and founding member of Data Protection Association in Istanbul. Begüm led several M&A projects including due diligence processes and assisted various local and foreign companies during incorporation of their partnership in special projects which also include transfer of technology, know-how and thus needs protection in this respect. She drafted and negotiated several joint-venture agreements, shareholders agreement, share pledge and voting agreements. In addition to her corporate law expertise, she has experience in competition law related matters and provides full service to clients in their corporate law related matters. Apart from providing consultancy services and trainings, she is also representing clients before the TCA about notifications and investigations. Having wide range of experience in pharmaceutical and medical device industry, Begum advised and represented several multinational pharmaceutical and medical device companies on their commercial deals and needs, including advising on their new investments in Turkey, marketing au

Representatives

Begüm Yavuzdoğan Okumuş

partner

Contact

Publications

• Initial Legislative Developments for Artificial Intelligence in TurkiyeWith the rapid expansion of the use of artificial intelligence (AI) and its integration into all areas of life, it has become essential to establish a legal framework that regulates the safe and ethical development, distribution and use of AI systems, considering the complexity and unique characteristics of this technology. In addition to promoting the safe, transparent, and human rights-respecting development of AI technologies, and aiming to protect the safety, rights, and freedoms of users and society, the European Union Artificial Intelligence Act ("AI Act"), which is the first legal regulation in this field, was approved by the European Parliament on March 13, 2024 to ensure the ethical development of AI and the protection of personal data. Finally, the AI Act was also approved by the Council of the European Union on May 21, 2024.14 January 2025
• The Guidelines on Use of Cookies in TurkeyThe Guidelines on Use of Cookies (the “Guidelines”) was published by the Personal Data Protection Authority (the “Authority”) on June 20, 2022 which outlines good practice examples to guide data controllers. The Guidelines explain principles on use of cookies for data controllers to process data on legal grounds, use appropriate privacy notices and obtain explicit consent from data subject legally if and when required.5 April 2023
• Data Controller Registry Requirement in TurkeyIn accordance with Personal Data Protection Law No. 6698 (the “DPL”) and the Regulation on Data Controllers’ Registry (“Regulation”), data controllers must be registered with the Data Controllers’ Registry (“VERBIS”) in Turkey. There are certain thresholds in terms of employee number and financial figures for local data controllers to be subject to registration requirement but there is no threshold or other conditions applicable for foreign data controllers and they are subject to registration requirement in case they process personal data in Turkey and act as data controller.10 March 2023
• Data Localization Rules Imposed on Social Media Companies in TurkeyOn Oct. 1, 2020, amendements to the Regulation of Internet Broadcasts and Prevention of Crimes Committed through Such Broadcasts (Law No. 5651), also known as Social Media Law in Turkey, entered into force. The amendments define social network provider, oblige social network providers to appoint a local representative, sets procedures for content removal, requests reports every six months and requires user data to be store within Turkey On Oct. 2, the Information and Communication Technologies Authority, Turkey’s telecommunications regulatory authority, published guidance, or secondary regulation, clarifying the amendments applicable to social network providers.30 June 2021
• Judicial remedy against decisions issued by Turkish data protection boardUnder the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board (“Board”) has the authority to impose administrative fines on data controllers due to failure to comply with their various obligations regulated under the DPL, i.e. failure to comply with the obligation to inform data subjects, obligations related to data security, the decisions issued by the Board and registration and notification obligations to the Data Controllers’ Registry. However, there is no explicit provision under the DPL about the competent courts for judicial review of decisions of the Board imposing administrative fines which creates confusion and dissatisfaction in practice with regard to the judicial remedies to be followed.19 October 2020
• Judicial remedy against decisions issued by Turkish data protection boardUnder the Personal Data Protection Law No. 6698 Article 18 ("DPL") the Personal Data Protection Board (“Board”) has the authority to impose administrative fines on data controllers due to failure to comply with their various obligations regulated under the DPL, i.e. failure to comply with the obligation to inform data subjects, obligations related to data security, the decisions issued by the Board and registration and notification obligations to the Data Controllers’ Registry. However, there is no explicit provision under the DPL about the competent courts for judicial review of decisions of the Board imposing administrative fines which creates confusion and dissatisfaction in practice with regard to the judicial remedies to be followed.14 September 2020
• Covid-19 and personal data protection in turkey – Frequently asked questionsThis article answers many freuqently asked questions concerning data protection in turkey during times of Covid-19.31 March 2020
• Data breach notification obligation under turkish data protection lawIn Turkey, the Personal Data Protection Law No. 6698 (the "Law") requires data controllers to take all necessary technical and administrative measures.13 January 2020
• Obligation of Notification of Personal Data Violations to Turkish DPALaw on Protection of Personal Data numbered 6698 provides under the article titled “Data Security Liabilities” that, data controllers must take all necessary technical and administrative measures to ensure the appropriate level of security to: • Prevent unlawful processing of personal data, • Prevent unlawful access to personal data, • Maintain safeguarding of personal data.22 October 2019