- with Senior Company Executives and HR
- with readers working within the Transport industries
September 2026 – Several notable developments took place across Türkiye’s data protection and artificial intelligence landscape in August 2026.
The Turkish Personal Data Protection Authority (“DPA”) published 47 decision summaries, providing further insight into its current enforcement priorities. The DPA also extended the compliance deadline for certain loyalty program requirements and clarified the scope of restrictions on using biometric data at the workplace.
In addition, the Türkiye Artificial Intelligence Action Plan (2026–2030) was published by Presidential Circular, setting out Türkiye’s strategic priorities for AI over the coming years.
In this edition of Quick Read, we highlight the most notable recent developments in data protection and artificial intelligence in Türkiye.
Data Protection Highlights
1. DPA Enforcement in Focus: 47 decision summaries published
On 10 August 2026, the DPA published 47 decision summaries covering complaints submitted by data subjects, ex officio investigations, and investigations initiated following personal data breach notifications. Notably, 25 of the 47 decisions arose from personal data breach notifications.
No administrative fine was imposed in 20 of the published cases. The remaining 27 resulted in administrative fines totalling TRY 11,495,179 (approx. EUR 208,580).
The decisions reflect the DPA’s continued focus on preventive data security measures. In several cases, administrative fines were imposed because appropriate technical and organisational measures had not been implemented before the breach occurred. Key areas of scrutiny included risk assessments, continuous system monitoring, vulnerability management, strong authentication mechanisms and the timely detection of security incidents.
Among the 47 decisions, we selected the following cases as particularly illustrative of the DPA’s current enforcement approach toward technology and data-driven businesses.
Digital gaming platform: TRY 1.5 million fine for security failures
In a case concerning a digital gaming and entertainment platform, a cyberattack affected the personal data of 90,182 users in Türkiye, including minors. The DPA noted that the data controller became aware of the breach through an online forum post by the attacker, rather than through its own security systems.
The DPA identified deficiencies in security monitoring, penetration testing, and patch management. It also noted that the same vulnerability had been exploited on two separate occasions. Considering the scale of the breach and the potential impact on data subjects, the DPA imposed an administrative fine of TRY 1.5 million (approx. EUR 27,000).
Technology company: TRY 350,000 fine following unauthorised access
In a case involving a software and technology company, an unauthorised party gained access to a mobile application database containing the personal data of 7,823 users, including their names, email addresses, and telephone numbers.
The DPA identified deficiencies in password security and logging mechanisms and imposed a TRY 250,000 fine for failure to implement appropriate technical and organisational measures, together with a TRY 100,000 fine for failure to notify affected individuals, resulting in a total fine of TRY 350,000 (approx. EUR 6,250).
Hosting company: TRY 350,000 fine for inadequate security measures
In another data breach case, a vulnerability in a hosting company’s customer management system resulted in personal data relating to 31,179 individuals being accessed and subsequently published online.
The DPA identified several security deficiencies, including inadequate monitoring, insufficient password security, failure to prevent bulk data downloads, and lack of appropriate data masking and data minimisation measures. The DPA imposed an administrative fine of TRY 350,000 (approx. EUR 6,250).
Insurance company: No further action following reuse of IBAN information
In a case concerning an insurance company, a data subject claimed that their IBAN information had been unlawfully processed because it was used to make a loss-of-value compensation payment, even though the IBAN had not been provided specifically for that claim.
The DPA found that the IBAN information had previously been obtained lawfully to make a payment under a damage claim arising from the same traffic accident and was subsequently used to make the loss-of-value compensation payment relating to that accident. The DPA considered this processing necessary for the establishment, exercise, or protection of a right and concluded that no further action was required.
2. Compliance Deadline for Loyalty Program Practices Extended
On 13 August 2026, the DPA announced an extension of the compliance period applicable to loyalty program practices.
Under Principle Decision No. 2026/266 dated 11 February 2026, data controllers are required to implement appropriate verification mechanisms for transactions carried out using loyalty card information, such as a membership number or mobile phone number. The Principle Decision initially provided a six-month compliance period.
The DPA stated that the extension was granted following requests from sector representatives to enable the relevant obligations to be implemented effectively and sustainably and to ensure that verification mechanisms can be introduced in a technically, administratively and operationally secure manner. Accordingly, the compliance deadline has been extended to 28 February 2027.
3. DPA Clarifies the Scope of Restrictions on Biometric Data
On 27 August 2026, the DPA published a clarification on its Principle Decision No. 2026/921 dated 29 April 2026 on the processing of biometric data for employee attendance monitoring.
Following the publication of its Principle Decision in June 2026, the DPA received numerous requests from sector representatives and data controllers seeking clarification regarding its scope and practical application.
The DPA reiterated that biometric data solely to monitor employee attendance or working hours does not satisfy any of the processing conditions. It further stated that such processing would fail to meet the proportionality requirement, even where the employee has provided valid explicit consent.
However, the DPA distinguished attendance monitoring from biometric data processing carried out for other purposes. It acknowledged that certain facilities and operational environments may present heightened security risks and that, in such contexts, biometric identification systems may from part of multi-layered security measures for identity verification, authorisation, and access control in critical or restricted areas.
Such processing falls outside the scope of the Principle Decision and must be assessed separately on a case-by-case basis. Its lawfulness will depend on factors including the purpose of the processing, the nature of the relevant activities, and the specific circumstances of the case.
In particular, data controllers should assess whether:
- there is a concrete and demonstrable security need;
- less intrusive alternative measures would be insufficient;
- the processing is limited to the relevant critical areas and personnel; and
- the use of biometric data is necessary and proportionate to the identified security risk.
Biometric systems introduced for security purposes should not subsequently be repurposed to monitor employee attendance or working hours.
4. Data Breach Notification
The DPA’s data breach notifications published in August 2026 may be accessed via this link.
Developments in AI
Türkiye Publishes New AI Action Plan for 2026–2030
On 18 August 2026, the Türkiye Artificial Intelligence Action Plan (2026–2030) was published in the Official Gazette under Presidential Circular No. 2026/9.
Following the conclusion of the National Artificial Intelligence Strategy for 2021–2025, the new Action Plan sets out Türkiye’s AI priorities for 2026–2030. It reflects recent developments in AI technologies and their growing impact on the economy, public services, and society.
The Action Plan focuses on technological sovereignty, competitiveness, data-driven development, trustworthy AI, and sustainable digital transformation.
Prepared under the coordination of the Ministry of Industry and Technology, the Action Plan is structured around four pillars: “Discover, Benefit, Produce, and Govern.” It aims to strengthen AI capabilities, develop human capital, improve data and computing infrastructure, expand AI use across the public and private sectors, and support the development of a trustworthy and competitive AI ecosystem.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
