Article 18 - Misdemeanours
(1) For the purposes of this Law;
- a) those who fail to comply with obligation to inform provided for in Article 10 herein shall be required to pay an administrative fine of 5.000 to 100.000 TL,
- b) those who fail to comply with obligations related to data security provided for in Article 12 herein shall be required to pay an administrative fine of 15.000 to 1.000.000 TL,
- c) those who fail to comply with the decisions issued by the Board under Article 15 herein shall be required to pay an administrative fine of 25.000 to 1.000.000 TL,
- ç) those who fail to meet the obligations for enrolling in the Registry of Data Controllers and making a notification as provided for in Article 16 herein shall be required to pay an administrative fine of 20.000 to 1.000.000 TL.
- d) Those who fail to fulfill the notification obligation stipulated in paragraph five of Article 9 shall be subject to an administrative fine ranging from 50,000 Turkish lira to 1,000,000 Turkish lira.
(2) The administrative fines specified in subparagraphs (a), (b), (c), and (ç) of the first paragraph apply to data controllers, while the fine specified in subparagraph (d) applies to data controllers or data processors, whether they are natural persons or private law legal entities.
(3) Administrative fines imposed by the Board may be challenged before administrative courts.
(4) If the actions listed in the first paragraph are committed within public institutions and organizations or professional organizations with public institution status, disciplinary actions shall be taken against civil servants and other public officials working within the respective public institution or organization, as well as those working in professional organizations with public institution status, based on the notification by the Board, and the results shall be reported to the Board.