Ministry of Health imposed new obligations to health care providers and protection of personal health data has been undertaken by  “the Regulation Regarding Processing and Protection of Privacy of Personal Health Data” issued at October 20, 2016 (hereinafter to be referred to as “the Regulation”) The Regulation entered into effect at the same time as the date of issue (October 20, 2016) to specify the details related to collection, utilization, conservation and protection of privacy of personal health data. Mandatory principles of processing of personal health data have been designated at the Regulation. According to mandatory principles, data can be processed for determined, explicit and legitimate purpose in addition such data shall only be conserved up to the time frame necessary for the purpose for which they were processed. Anyone who processes health or has access to personal health data as part of their job is obligated to maintain secrecy regarding those data. Including health care providers, one can only access and process to personal health data based on the requirements of the health services to be provided. In order to process and transfer one’s personal health data, it is mandatory that the owner of the personal health data shall be informed in detail and written consent shall be taken. In addition, one can withdraw his/her consent at any time and s/he may prevent the usage of such data. Personal data owners may apply to the officials in charge regarding their personal data and request to be informed whether their personal data has been processed or not, if processed. Besides they possess the right to be informed whether any of the personal data has been shared with third parties and may request such data to be deleted if the conditions are met. Processed data in accordance with the law may be made anonymous or deleted upon request in case processing causes have   disappeared. Anyone who has access to personal health data is under confidentiality obligation.