NEWSLETTER-2019-metin

275 PERSONAL DATA PROTECTION behalf of the data controller, on the authority given by the data control- ler. A data processor, who is authorized by the data controller through a personal data processing contract, processes personal data in ac- cordance with the instructions given by considering the terms of the contract with the data controller. The crucial part here is that the data processor is a real person or a legal entity outside of the organization of the data controller. Therefore, even if the employees of a company process data, these employees cannot be defined as data processors. Companies serving their customers in accounting, call center, human resources and payroll, cloud computing departments are examples of data processors. However, in the event that the data processor processes personal data on its own behalf by exceeding the authority given to it by the data controller, the data processor will be regarded as a data controller with respect to this data. Relationship between Data Controller and Data Processor A real person or a legal entity may be both a data controller and a data processor at the same time, depending on the nature of the situation. For example, accounting, call center or human resources and payroll companies will be considered data processors in respect of the data of its own employees, while they are considered as data processors in terms of the data processed on behalf of their customers. The details of precedents are also set forth in the Guidelines on Data Controllers and Data Processors issued by the Authority 3 . Upon the processing of personal data by a natural or a legal person on behalf of a data controller (e.g. an accounting company maintaining the records of the said company), the data controller shall jointly and severally be liable with these persons for taking the measures required under the Law. The controllers and processors must not unlawfully misuse nor disclose the obtained personal data to anyone. This obliga- tion shall continue even after the conclusion of their duty. 3 Please see https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/f63e88cd- e060-4424-b4b5-f6413c602060.pdf (Access date: 19.09.2019).