Allocation of responsibility among data controller and data processor within the scope of General Data Protection Regulation and Turkish Law on the Protection of Personal Data

In the 21st century, "data" does not only mean a piece of knowledge in a traditional sense. As a result of the increasing value of data and the protection of data as a fundamental right, since 1950s, studies have been carried out in the field of data protection law both at the global and national levels. The European Union General Data Protection Regulation, an inclusive and detailed regulation, came into force in 2016, as a result of years of practices. The first regulation regarding protection of personal data in Turkey is Law on Protection of Personal Data numbered 6698, which came into force in April 7, 2016. The terms of data controller and data processor are central concepst in respect to data protection law. Although the data controller is held responsible for nearly all obligations and sanctions under the Law on Protection of Personal Data numbered 6698, the data processor is getting more important each and every day as the result of technological developments and complex structurings in the businesses. Thusly Direct obligations for the data processor are set forth and the scope and level of responsibility is increased in terms of the data processor with the European Union General Data Protection Regulation. In line with this explanations, the first part of the thesis focuses on the concept of personal data, the need for personal data protection and the historical development of regulations regarding data protection. In the second section, concepts of data controller and processor which constitutes the basis of this thesis are exlained and the general principles of data processing is clarified. In the last part of the thesis, allocation of responsibility among data controller and data processor within the scope of General Data Protection Regulation and Turkish Law On The Protection Of Personal Data is analized. Keywords: Protection of Personal Data, Personal Data, Data Controller, Data Processor, Data Process Contract, GDPR, Data Privacy