First, let us explain what personal data means:
In Türkiye, personal data (kişisel veri) is regulated by Personal Data Protection Law No. 6698, which was adopted on 24 March 2016 and entered into force on 7 April 2016. All information relating to a natural person that directly or indirectly identifies who they are is called personal data. Legal entities whose data is processed are outside the scope of this law. The elements that make a person identifiable are not only their name and surname. A person's economic, social, physical and identity information, IP address, voice recording, vehicle plate, hobbies, preferences, the people they talk to and similar information are also personal data. Data that does not or will not identify a person is anonymous data.
In terms of payment systems, personalized security credentials refer to the information used when making a transaction with a payment instrument that identifies the payment instrument and the identity of its user, such as:
- PIN, card/account/e-money details
- Expiry date
- Security code (CVV)
