PDPL provides the following definitions of collection and processing of personal data:

• Collection of personal data is an action aimed at receiving personal data
• Processing of personal data are actions aimed at:
  • Recording
  • Systemization
  • Storage
  • Amendment
  • Replenishment
  • Extraction
  • Usage
  • Spread
  • Impersonation
  • Blocking, and
  • Destruction of personal data

Collection and processing of personal data is allowed when the following conditions are met:

• The data subject’s consent or that of his / her legal representatives
• The processed and collected information is in compliance with the lawful aims of the data controller
• The processed and collected information is accurate and complete
• The data subject has access to the processed and collected data relating to him / her and has the right to require rectification of the relevant information
• The data collector has duly certified all the relevant equipments and facilities designated for processing and collection of data with the Regulator

Article 12 of the PDPL entitles the data collector to process personal data without receiving the data subject’s consent, if it is necessary for governmental authorities to carry out their functions or for the purpose of protecting the constitution rights and freedom of the citizens.