NEWSLETTER-2017

328 NEWSLETTER 2017 made anonymous in accordance with Law No. 6698 and Regulation. Furthermore, the liability of storing, deleting, removing or anonymiz- ing personal data in accordance with Law No. 6698 and Regulation of the data holders who are not under the obligation to prepare personal data storage and destruction policies shall continue. The data controller is responsible for disclosing the methods used for the deletion, removal and anonymization of personal data in its relevant policies and procedures. The policy of personal data storage and destruction is composed of the following, at the very least: The purpose of the preparation of the policy, the recording media regulated by the personal data storage and destruction policy, the definitions of the legal and technical terms included in the policy, the explanation on legal, technical or other reasons that require the storage and destruc- tion of personal data, technical and administrative measures taken for the safekeeping of personal data, and preventing illegal process and access of personal data, technical and administrative measures taken to ensure that personal data are destroyed in accordance with law, titles, units and job descriptions of persons involved in the storage and destruction of personal data, tables showing storage and destruc- tion periods, periodic destruction periods, if the data has been updated in the existing personal data storage and destruction policy, and any information as to such change. All transactions relating to the deletion, removal and anonymiza- tion of personal data shall be recorded and shall be retained for at least three years, excluding any other legal obligations. Duration of the Destruction of Personal Data The data controller who has prepared the personal data storage and destruction policy is obliged to delete, remove, or anonymize personal data in the first periodic destruction following the date upon which the obligation to delete, remove or anonymize personal data occurs. The period of time during which periodic improvement is car- ried out shall be determined and observed by the data controller in the policy of personal data storage and destruction. This period cannot exceed six months at any time. If the data controller does not have an obligation to prepare a personal data storage and destruction policy, it