Processing of customer data in the banking sector in light of the Law No. 6698 on the Protection of Personal Data

The banking sector is, by its nature, one of the fields in which personal data is extensively processed and, at the same time, must be protected with particular care. Since customer information may qualify both as personal data and as banking secrecy, data processing activities in this context require multifaceted legal evaluation. With the entry into force of the Law No. 6698 on the Protection of Personal Data (KVKK), banks have begun to assume concrete obligations not only under the Banking Law but also under data protection law. This thesis focuses on the application of the KVKK in the banking sector, specifically in relation to customer data. The study examines data processing procedures, legal bases, and the responsibilities of banks within the framework of relevant legislation and practical examples. The first chapter clarifies frequently encountered concepts in the sector and discusses the intersections between personal data and banking secrecy. The subsequent chapters analyze the legal justifications for data processing by banks, particularly within the scope of legitimate interest, performance of contracts, and legal obligations. Furthermore, key compliance topics such as data security obligations, the duty to inform (disclosure), obtaining explicit consent, and registration with the Data Controllers' Registry (VERBIS) are explored in detail. Finally, the thesis addresses the transfer of customer data abroad and evaluates associated risks and potential solutions in light of recent legal developments. The primary aim of the study is to present a comprehensive assessment that integrates theoretical and practical perspectives, thereby contributing to the harmonization of banking practices with data protection law.