- with readers working within the Transport industries
- within Strategy topic(s)
August 2026 – A number of important regulatory and policy developments were introduced across Türkiye's data protection, cybersecurity, and digital governance framework in July 2026.
The Turkish DPA issued two Principle Decisions and further public guidance addressing the personal data of accident victims and data used for third-party marketing. Significant legislative amendments also introduced a framework for reassessing previous medical diagnoses and strengthened the rules governing the retention and subsequent use of genetic examination results.
Beyond data protection, the Cybersecurity Presidency was granted broader powers relating to internet infrastructure and services, while new advertising rules introduced transparency requirements for AI-generated content and targeted advertising.
In this edition of Quick Read, we highlight the most notable recent developments in data protection, cybersecurity, and artificial intelligence in Türkiye.
Data Protection Highlights
1. Turkish DPA’s Principle Decision on Personal Data of Accident Victims: Key Implications for the Insurance Sector
On 1 July 2026, the Turkish DPA published Principle Decision No. 2026/1095, addressing the unlawful access to and use of the personal data of accident victims in Türkiye.
The Decision followed complaints that individuals had been contacted shortly after road traffic accidents by compensation consultancy firms or persons claiming to act as lawyers who already appeared to have detailed information about the incident.
The DPA emphasised that insurers, loss adjusters, and other parties involved in accident and claims-management processes may process such data only where there is a valid legal basis and only for purposes directly connected to the post-accident process.
The DPA expects controllers handling such information to implement least-privilege and role-based access controls, effective logging and monitoring mechanisms, and regular data protection training for relevant personnel. Unlawful access or disclosure may result in administrative sanctions under Turkish DP Law as well as criminal liability under the Turkish Criminal Code.
Read our detailed article here.
2. Referrals Do Not Constitute Consent to Marketing
On 21 July 2026, the Turkish DPA published an announcement on the use of personal data obtained from third parties for advertising and marketing purposes.
The DPA clarified that obtaining contact details through referrals, recommendations, or similar third-party channels does not, by itself, provide a lawful basis for advertising or marketing. Controllers must identify an appropriate lawful basis under Article 5 of the Turkish DP Law and comply with the obligation to inform, even where the personal data has not been collected directly from the individual.
The announcement also reiterates that fulfilling the obligation to inform and obtaining explicit consent are separate processes. Where consent is required, the individual must first be properly informed and must then provide a specific, informed, and freely given indication of consent. Simply remaining on a call, asking questions, or failing to reject an SMS does not constitute valid explicit consent.
3. Health Data Update: Previous Medical Diagnoses Can Now Be Reassessed
An amendment to the Regulation on Personal Health Data, published on 4 July 2026, introduced a new mechanism allowing individuals to request the reassessment of previous medical diagnoses based on their current health status.
Depending on how the original diagnosis was made, the reassessment must be carried out by either a three-physician medical board or a fully authorised medical board.
Where the new medical report concludes that the earlier diagnosis is no longer present, future procedures must take the updated report into account. Unless specific legislation provides otherwise, the former diagnosis may no longer be relied upon, including in recruitment and employment-related processes.
4. New Safeguards for Genetic Data Retention
Law No. 7589 was adopted on 16 July 2026 and published on 31 July 2026. The Law amends Article 80 of the Criminal Procedure Code and introduces new rules for genetic examination results obtained during criminal proceedings.
Genetic examination results must be separated from information that directly identifies the individual and recorded in a dedicated system. The records must be destroyed immediately following a final decision not to prosecute, an acquittal, or a decision not to impose a penalty. In other cases, they may be retained for 20 years from the date on which the relevant judgment becomes final.
Individuals may request deletion where the purpose for retaining the data no longer exists or another justified reason applies. Any subsequent use of the records requires a decision by a court, judge, or public prosecutor. Further procedural details will be determined through secondary legislation.
5. Data Breach Notification
The DPA’s data breach notifications published for July 2026 may be accessed from this link.
Developments in Cybersecurity
Cybersecurity Presidency Gains New Powers
Law No. 7590 was adopted on 24 July 2026 and published in the Official Gazette on 31 July 2026. The Law introduces transitional provisions under the Cybersecurity Law and transfers certain internet- and communications-related powers, together with the associated assets and personnel arrangements, to the Turkish Cybersecurity Presidency.
The newly introduced Article 60/A authorises the Presidency to regulate internet domain names and order urgent measures relating to internet infrastructure and services. Urgent orders must be implemented within two hours. Such orders must be submitted for judicial approval within 24 hours, and the judge must issue a decision within 48 hours. The amendments also introduce administrative fines and allow the Presidency to provide technical capabilities for lawful interception and intervention by legally authorised public bodies.
Developments in AI
AI-Generated Advertising Must Now Reveal Its Source
Amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices were published on 1 July 2026 and entered into force on 1 August 2026.
Advertisements featuring AI-generated digital characters that cannot reasonably be distinguished from real individuals must now clearly disclose the use of AI.
The digital replica of a real individual may not be used in a way that falsely suggests that the individual has used, experienced, or endorsed a product or service. The amendments also introduce transparency requirements for targeted advertising based on personal data and prohibit profiling-based advertising directed at children.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
