Data Deletion Directives

1. Introduction

With the rise of the digital economy, personal data has become one of the most valuable assets of organizations. However, this situation has also led to the rapid spread of legal regulations that strengthen data subjects' control over their information. Data deletion directives are the entire body of rules governing when, how and under what conditions personal data is to be erased. This article addresses the fundamental principles of data erasure obligations and their reflections in practice, primarily the European Union General Data Protection Regulation (GDPR) and Turkey's Law on the Protection of Personal Data (KVKK).

2. Legal Foundations

2.1. KVKK and Related Secondary Legislation

Article 7 of Law No. 6698 on the Protection of Personal Data grants the data subject the right to "request the erasure, destruction or anonymization of personal data in the event that the reasons requiring its processing cease to exist." This right has been given concrete form by the Regulation on the Erasure, Destruction or Anonymization of Personal Data. Under the Regulation, every data controller is obliged to prepare a Retention and Destruction Policy and to apply this policy periodically.

2.2. GDPR and the Right to Be Forgotten

The European Union's General Data Protection Regulation, which came into force in 2018, introduced a comprehensive erasure regime in its Article 17 under the heading "Right to Erasure" (the Right to Be Forgotten). Under the GDPR, the data subject may request erasure when the purpose for which the data was collected no longer exists, when they withdraw their consent, or when the data has been unlawfully processed.

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay." (GDPR, Article 17(1))

2.3. Other International Regulations

• CCPA / CPRA (California): The consumer's "Right to Delete."
• LGPD (Brazil): The right to erasure under Article 18.
• PIPEDA (Canada): Destruction of data in line with its purpose.

3. The Difference Between Erasure, Destruction and Anonymization

Data deletion directives most often regulate three different techniques together. Although these three look similar on the surface, in practice they produce results that are independent of one another.

4. Circumstances That Trigger the Erasure Obligation

Both KVKK and GDPR separately enumerate the cases in which data erasure must be carried out automatically. The occurrence of one or more of these cases gives rise to an erasure obligation for the data controller:

• The purpose of processing the data ceases to exist.
• Withdrawal of consent in processing based on the explicit consent of the relevant person.
• Expiry of the legal retention period.
• A finding that the data has been processed unlawfully.
• The data subject making an erasure request on legitimate grounds.
• A decision by a court or competent authority.

5. Stages of the Erasure Process

5.1. Receiving the Request

The data subject may submit their application in writing, by email, by registered electronic mail (KEP) or by another method determined by the data controller. For mobile applications, an in-app "Delete My Account" link or an official support email address is a common solution. Since 2024, Google Play and the App Store have required that the account deletion feature be accessible from within the app.

5.2. Identity Verification

To prevent unauthorized erasure requests, the data controller must verify by reasonable means that the applicant is genuinely the data subject. This step is a critical security link against abuse.

5.3. Evaluating the Request

Under KVKK, the data controller is obliged to conclude the application within 30 days at the latest. GDPR, for its part, requires a response within 1 month. For complex requests this period may be extended by a further 2 months.

5.4. Erasure / Destruction / Anonymization

If the request is found justified, the data must be erased simultaneously from all systems (production databases, backups, analytics systems, third-party integrations, log files). The most critical mistake here is "deleting only from the production database" and forgetting the backups.

5.5. Notification and Recording

The completion of the erasure must be notified to the applicant. The operation performed must be kept in destruction records. These records are mandatory in order to meet the burden of proof during an audit.

6. Technical Implementation Methods

• Soft delete vs. hard delete: A soft delete (placing a "deleted" mark on a record) does not on its own count as "erasure" in the KVKK/GDPR sense. A hard delete must be applied at the end of a certain grace period.
• Crypto-shredding: A method of rendering data practically unreadable by destroying the key with which it was encrypted. It is a pragmatic solution for large-scale systems.
• Overwriting: Writing random or fixed patterns over the same disk area many times.
• Anonymization techniques: Making individual identification impossible while preserving statistical usability, through methods such as k-anonymity, l-diversity and differential privacy.

7. How Do You Delete Your Account in the Halinisa App?

Halinisa lets you delete your account from within the app. The process takes just a few taps. You are not asked for a password, and no email or SMS verification code is required. By following the steps below in order, you can permanently delete your account and all your personal data.

7.1. The Path to Follow

1. Tap the "Settings" tab in the menu at the bottom of the app.
2. On the screen that opens, tap the profile row at the very top or the "My Account" link.
3. On the My Account screen, scroll all the way down. Right below the "Give Feedback" option, you will see the "Delete My Account" option with a trash can icon and red text. Tap this option.
4. In the window that opens, titled "You Are About to Delete Your Account," read the informational text. Continue by tapping the "Delete My Account" button. If you want to cancel, you can use the "Cancel" button.
5. In the second step, a confirmation screen titled "Are You Sure?" will appear. Here, tap the red "Delete It?" button. This is your final confirmation.
6. After a waiting animation, you will see the message "All your data has been deleted." When you tap the "OK" button, you will be automatically redirected to the start (welcome) screen.

7.2. Scope of the Deletion

When you give your confirmation, all of the following information is deleted from both our servers and your device:

• Your account information (name, email, profile)
• Your period calendar records and your predictions
• Your notification settings and your symptom history
• Session information and cache stored on your device

When the operation is complete, the app automatically logs out and takes you back to the onboarding (welcome) flow. You can log back in with the same Google account or the same name. However, your deleted data will not return, so you will be starting from scratch.

7.3. What to Consider Before Deleting

• If you want to move your data to another device: As also stated in the informational text on the Delete My Account screen, you can first synchronize your data by signing in with Google on your other device. You must complete this step before the deletion.
• If you use it anonymously (without signing in): Your data is kept only on this device. The moment you tap Delete My Account, the data is lost and you have no way to make a backup.
• If you have an App Store or Google Play subscription: Deleting your Halinisa account does not automatically cancel your subscription. You need to cancel the subscription separately from your device's App Store / Google Play account settings.

7.4. If You Run Into Problems

If you receive the error "Account deletion failed" during the deletion process:

• Check your internet connection and try the operation again.
• Make sure you have updated the app to the latest version.
• If the problem persists, reach us via the "Give Feedback" option on the My Account screen or via the KVKK contact address found on the app's privacy policy page. Under your legal time limit, your request will be concluded within 30 days at the latest.

8. Sanctions for Non-Compliance

A breach of data erasure obligations produces serious consequences, both financial and reputational. Under KVKK, administrative fines under the 2026 tariff can reach millions of Turkish lira, while under the GDPR this figure can rise to 20 million euros or 4% of global turnover. In addition, the customer loss experienced because breach notifications are made public often means a cost greater than the fine itself.

9. Typical Mistakes Encountered in Practice

• Leaving backups outside the scope of the erasure.
• Failing to forward the erasure request to third-party integrations (CRM, analytics, email).
• Carrying out reversible masking under the name of anonymization.
• Retention periods not being defined in the inventory.
• Failing to keep a destruction record.
• Forgetting the hard delete after a soft delete.

10. Conclusion

Data deletion directives are not merely a legal compliance obligation but also one of the fundamental tools for making user trust sustainable. An effective erasure regime is built on a clear policy, a solid technical infrastructure, a continuously updated inventory and a transparent application process. For data controllers, the safest approach is to design the erasure flow as a process that is automatic by default, auditable and propagated across all systems. Otherwise, one of the most expensive fallacies of the digital age, the "I thought I deleted it" mistake, becomes inevitable.

This article is intended as general information regarding data protection legislation and does not constitute legal advice. Publication Date: 29 April 2026