Principle Decision On The Online Publication Of Personal Data By Data Controllers With Public Legal Personality Published In The Official Gazette

The Personal Data Protection Board’s (the “Board”) Principle Decision dated 1 July 2026 and numbered 2026/1301 on the Online Publication of Personal Data by Data Controllers with Public Legal Personality (the “Decision”) was published in the Official Gazette dated 28 July 2026 and numbered 33323. The Decision clarifies the fundamental principles and compliance obligations under Law No. 6698 on the Protection of Personal Data (the “Law”) applicable to personal data disclosures made online by public institutions and organisations and other data controllers with public legal personality.

In its assessment, the Board noted that public institutions publish examination results, personnel information, immovable property information, application details and various other categories of personal data on their websites and through other electronic channels. The Board emphasised that such disclosures also constitute personal data processing activities under the Law. Accordingly, personal data disclosures made online must comply with the general principles and the conditions for processing personal data set out under the Law.

Online Publication of Personal Data Must Have a Legal Basis

The Decision expressly states that any online publication of personal data must rely on at least one of the processing conditions set out in Article 5 of the Law or, in the case of special categories of personal data, Article 6 of the Law.

Accordingly, public institutions may not rely solely on established practice or transparency considerations when disclosing personal data online; each disclosure must be supported by a valid legal basis for processing.

Data Minimisation and Retention Periods Are Prioritised

Among the general principles under the Law, the Decision places particular emphasis on the requirement that personal data be processed in a manner that is relevant, limited and proportionate to the purposes for which they are processed.

In this context, the Decision states that:

• personal data that are not necessary for the purpose of the disclosure should not be included;
• masking, anonymisation or similar methods should be used where appropriate;
• the period during which online publications will remain accessible should be determined in advance; and
• content should be removed once the purpose of the disclosure ceases to exist.

This approach demonstrates that online publications of personal data must be managed in compliance with the Law not only at the time of publication, but throughout the entire period during which they remain accessible.

Technical and Organisational Measures Should Be Strengthened

The Decision emphasises that online publications create heightened risks from a data security perspective.

Accordingly, data controllers should:

• implement risk-based technical and organisational measures;
• establish regular audit mechanisms;
• provide employees with training on personal data protection; and
• review their website and social media management processes.

Secure Access Methods Are Encouraged

In particular, for the announcement of examination results, draw results and similar results, the Board recommends using methods that allow individuals to access only their own information, rather than publishing personal data in a manner accessible to everyone.

In this context, the e-Government Gateway, two-factor authentication and similar secure authentication methods are cited as examples.

Existing Disclosures Must Also Be Reviewed

The Decision applies not only to future disclosures, but also to content that is already available online.

Accordingly, data controllers are expected to review their existing websites, social media accounts and other electronic communication channels and to remove, mask or anonymise personal data disclosures that:

• are not based on a valid processing condition;
• do not comply with the data minimisation principle; or have exceeded the applicable retention period.

Key Considerations for Public Institutions

The Decision is particularly relevant to:

• municipalities;
• universities;
• special provincial administrations;
• professional organisations with public institution status; and
• other data controllers with public legal personality.

In this context, data controllers should:

• review existing online publications of personal data;
• assess the relevant processing condition for each disclosure;
• apply the data minimisation principle;
• determine applicable retention periods;
• reassess their website and social media management processes from a personal data protection perspective;
• update their technical and organisational measures; and
• increase employee awareness.

Conclusion

Through the Principle Decision, the Board has expressly confirmed that online publications of personal data by data controllers with public legal personality constitute separate personal data processing activities under the Law. Accordingly, data controllers should reassess not only future disclosures, but also existing online content in terms of applicable processing conditions, data minimisation, retention periods and data security obligations.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.