NEWSLETTER-2017

329 PERSONAL DATA PROTECTION is obliged to delete, remove or anonymize personal data within three months from the date upon which the obligation to delete, remove or anonymize personal data occurs. The real person whose personal data is processed may apply to the data controller and request that his/her personal data be deleted or removed. In this case, if all of the personal data processing conditions are eliminated, the data controller deletes, removes or anonymizes the personal data in question. The data controller concludes such request of the relevant person within thirty days at the latest, and informs her/ him accordingly. If all conditions of the personal data processing have been eliminated and the personal data in question has been transferred to a third party, the data controller shall notify the third party, and the third party shall carry out the necessary procedures within the scope of the Regulation. If all the conditions of personal data processing have not yet been eliminated, this request may be rejected for reasons, and the relevant person shall be notified of the rejection notice in writing or electronically within thirty days, at the latest. Conclusion The Regulation, which sets out the principles and procedures for the deletion, removal or anonymization of personal data, and the Guideline prepared for clarification in practice as to how to carry out the procedures for the destruction of personal data, is very important. While the Regulation, which will enter into force within a short period of time, will undoubtedly shed light on the methods for the destruc- tion of personal data, the application of the said Regulation is highly anticipated.