Turkey: Compliance

The European Commission has issued a commitment decision addressing SAP's practices in the aftermarket for maintenance and support services for its on-premises ERP software. Following preliminary findings that SAP may have abused its dominant position through restrictive contract terms and fees, the company has agreed to implement global changes allowing customers greater flexibility in choosing maintenance providers and modifying contract terms. These legally binding commitments will remain in effect for 1

Şirket birleşme ve devralmalarında due diligence süreci, alıcının bilinçli bir yatırım kararı verebilmesi için hedef şirketin hukuki, mali ve operasyonel yapısını derinlemesine analiz ettiği temel aşamayı oluşturmaktadır. Bu süreç, yalnızca mevcut durumu tespit etmekle sınırlı kalmayıp kapanış sonrasında alıcının maruz kalabileceği gizli riskleri ve yükümlülükleri öngörmek, bunları sözleşme yapısına doğru bir şekilde yansıtmak bakımından da belirleyici bir işlev üstlenmektedir.

In corporate mergers and acquisitions, the due diligence process constitutes the fundamental stage during which the buyer conducts an in-depth analysis of the target company's legal, financial and operational structure, enabling the buyer to make an informed investment decision. This process is not limited to merely ascertaining the current situation; it also plays a decisive role in anticipating hidden risks and liabilities to which the acquirer may be exposed following completion, and in ensuring these are properly reflected in the contractual framework

Kanun uyarınca Kurul’un idari yaptırımlara karar verme yetkisi bulunmaktadır. Kurul’un, aydınlatma yükümlülüğünün, veri güvenliğine ilişkin yükümlülüklerin, Kurul tarafından verilen kararların yerine getirilmemesi...

The primary legislation governing the protection of personal data in Türkiye is the Personal Data Protection Act No. 6698 (the “Law”), which came into force in 2016.

Turkey's data protection landscape in 2025 saw significant regulatory developments through the Personal Data Protection Authority's guidance documents, principle decisions, and enforcement actions. How did artificial intelligence regulation, cross-border data transfers, and cybersecurity legislation reshape compliance obligations for data controllers operating in Turkey?

Turkey's Personal Data Protection Law marked its tenth anniversary in April 2026, with accelerating efforts toward GDPR harmonization. The first half of 2026 brought significant regulatory developments including principle decisions on biometric data processing, loyalty card verification, and security camera usage, alongside guidance on artificial intelligence tools and a landmark Constitutional Court ruling on administrative penalties.

Turkey has issued a new Food Codex Communiqué establishing comprehensive administrative and scientific procedures for novel foods and traditional foods from other countries. The regulation introduces consultation mechanisms for determining novel food status, detailed application requirements including toxicological studies and allergenicity assessments, and specific timelines for regulatory review processes. Food business operators must now navigate structured pathways for market authorization, with pr

Turkey's Personal Data Protection Board has issued a landmark decision addressing the unlawful processing of accident victims' personal data by claims consultancy companies, lawyers, and insurance loss adjusters. The decision establishes strict guidelines on data access, processing limitations, and professional obligations while introducing potential criminal liability for violations. What are the broader implications for insurance companies, automotive sector participants, and other stakeholders involved i