A news site does not only produce news; it collects data. On this side, unlike news production, there is no exemption debate.
What Data Does a News Site Collect?
| Point | Data collected |
|---|---|
| Comment form | Name, e-mail, IP, timestamp |
| Membership | Name, e-mail, password hash, preferences |
| Newsletter subscription | E-mail, consent record |
| Contact form | Name, e-mail, message content |
| Cookies | Visit and preference information |
| Server logs | IP, browser, time of access |
The Tools the Software Must Provide
- Showing a privacy notice on every form where data is collected
- A cookie management tool and the storing of preferences
- Recording data subject requests and tracking them within their periods
- Being able to export comment and subscription data
- Being able to delete data - on request and when the retention period expires
- Keeping access logs limited to a reasonable period and clearing them automatically
- Keeping a record of who accessed what data and when
Registry Registration
Whether a duty to register with the data controllers' registry arises is determined by the scale of the business and the nature of the data processed. We cover it in the registry guide.
Notification in Case of a Breach
When a data breach occurs a notification duty arises and the periods are short. We cover it in the breach notification guide.
Where It Meets Press Legislation: The Two-Year Archive
News sites have a separate retention duty, and it has to be managed alongside the data protection obligations. Law No. 5187 Art. 10: content published on an internet news site is retained for two years, with accuracy and integrity ensured, so as to be delivered where necessary to a requesting public prosecutor's office.
We cover the archive side in the content retention guide.
Liability Arising from Comments
Opening reader comments also opens an area of responsibility beyond data collection. We cover the moderation tools and the limits of liability in the comment liability guide and the moderation guide.
Checklist
- Is a privacy notice shown on every form where data is collected?
- Are cookie preferences stored and changeable?
- Are data subject requests recorded and answered in time?
- Can comment and subscription data be deleted?
- Are access logs cleared automatically?
- Is a consent record kept for the newsletter and does the unsubscribe link work?
- Are the content archive and the reader data archive managed separately?
Summary
- A news site's reader data processing is assessed separately from news production, and there is no journalism exemption debate here.
- A privacy notice, cookie management, data subject requests, deletion and access logging are the minimum tools.
- The content archive is kept for two years under Art. 10 of Law No. 5187 and must be managed separately from reader data.