The Law on Protection of Personal Data came into force on April 2018. It imposes various obligations on data controllers (e.g. employers) to inform data subjects, obtain consent where necessary, impose necessary precautions, implement data protection related policies and register with the data controller registry. Most of the data controllers will need to be registered at the data controller registry by 30 September 2019. Non-compliance with the law could result in an administrative fine between TRY 5.000 – 1.000.000. There could also be criminal liability as per Turkish Criminal Code.