ARTICLE
23 October 2026

Two-Minute Recap Data Protection Law Matters In Türkiye

GT
Gen Temizer

Contributor

Gen Temizer is a leading independent Turkish law firm located in Istanbul's financial centre. The Firm has an excellent track record of handling cross-border matters for clients and covers the full bandwidth of most complex transactions and litigation with its cross-departmental, multi-disciplinary and diverse team of over 30 lawyers. The Firm is deeply rooted in the local market with over 80 years of combined experience of the name partners while providing the highest global standards of legal services.
On 6 September 2026, Türkiye’s Medium Term Programme (2027–2029) was published in Official Gazette No. 33362 (Duplicate Issue). Under the “Business and Investment Environment” policy area, the Programme identifies the completion of the process of aligning Personal Data Protection Law No. 6698 (“KVKK”) with the EU General Data Protection Regulation (“GDPR”) as a legislative and administrative measure targeted for the third quarter of 2027.
Turkey Privacy

Turkish Government Sets Q3 2027 Target for GDPR Alignment

On 6 September 2026, Türkiye’s Medium-Term Programme (2027–2029) was published in Official Gazette No. 33362 (Duplicate Issue). Under the “Business and Investment Environment” policy area, the Programme identifies the completion of the process of aligning Personal Data Protection Law No. 6698 (“KVKK”) with the EU General Data Protection Regulation (“GDPR”) as a legislative and administrative measure targeted for the third quarter of 2027.

The measure forms part of the government’s broader objectives of improving regulatory quality, strengthening predictability and facilitating administrative processes. The Programme further provides that public institutions’ legislative and implementation activities will be guided by its policy framework, with detailed measures for the first year to be set out in the 2027 Presidential Annual Programme. The stated timeline establishes a target for completing the alignment process, while the specific scope of any legislative amendments remains to be determined.

Turkish DPA Publishes Guidance on Personal Data Protection in Legal Practice

The Turkish Personal Data Protection Authority (“DPA”) has published its Practical Guide on Personal Data Protection in Lawyers’ Professional Activities, prepared with input and contributions from the Union of Turkish Bar Associations. The Guide addresses key data protection issues arising in legal practice, including the use of generative artificial intelligence tools, data controller and data processor status, special categories of personal data, data transfers and data security, providing practical explanations and examples.

The Guide highlights that uploading client files, court documents or other materials containing personal data to generative AI tools such as ChatGPT, Claude and Gemini may constitute an international data transfer, depending on the infrastructure used. It recommends masking or anonymising personal data where possible, avoiding the upload of special categories of personal data and sharing only the minimum data necessary. It also examines the data protection roles of different legal professionals, the legal bases for processing clients’ and third parties’ data, the use of applications that enable searches using unlawfully obtained data, and practical measures to address data security risks.

The DPA Announced the Following Data Breach Notifications in September

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Sakarya Üniversitesi Teknoloji

Geliştirme

Bölgeleri Yönetici A.Ş.

Employees, students and users

» Identity Data,

» Contact Data,

» Employee Data (work experience)

» Transaction Security Data

1500 people

*Data subjects seeking further

information about the incident may contact the following email address: iletisim@sakaryateknokent.com,

and telephone number: 0264 346

0202.

Uşak Üniversitesi

Employees, students and undetected

subject groups

» Identity Data,

» Contact Data

» Employee Data

» Transaction Security Data

» Visual and Audio Recordings

3000 people

Tazemasa Gıda Ürünleri

Pazarlama Sanayi ve Ticaret A.Ş.

Customers

» Identity Data (name,surname)

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentiasl

Not yet been determined.

*Data subjects seeking further information about the incident may contact the following email

addresses: ozcan@tazemasa.com and servis@tazemasa.com, and the following telephone numbers: 0532

274 2806 and 0216 461 0016.

Askı Nişantaşı Tekstil Ticaret ve Sanayi Ltd. Şti.

Customers

» Identity Data (name,surname)

» Contact Data (address/of

residence, email address,phone number),

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident

may contact the relevant parties at the following address: Halide Edip Adıvar Mah. Sultan Sok.

No:28, Kut Yapı İş Merkezi, Kat:4-5, Şişli, İstanbul, via email at

destekaskinisantasi@hotmail.com, or by telephone at 0850 305 6027.

 

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Efe Doğal Ürünler Sanayi ve Ticaret Ltd. Şti.

Customers

» Identity Data (name, surname)

» Contact

Data (address/of residence, email address, phone number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident

may contact the relevant parties via the following address: Şerifali Mah. Beyan Sok. No: 39, Ümraniye/

İstanbul, the following email

address: info@biostore.com.tr, or the following telephone number: 0541 590 0586.

Ersoylar Spor Giyim İnşaat

İhtiyaç Maddeleri Pazarlama Sanayi ve Ticaret Ltd. Şti.

Customers

» Identity Data (name,surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the relevant parties via the following website: https://www.

etichet.com.tr/iletisim, the following email address: destek@etichet.

com.tr, or the following telephone number: 0850 433 36 37.

İlvi Ayakkabı Deri ve Tekstil Ürünleri Sanayi

Ticaret A.Ş.

Customers

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the following email address: info@ilvi.com or telephone number: 0850 305 1011.

Market Spor Malzemeleri

Sanayi ve Ticaret Ltd. Şti.

Customers

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may visit the following websites: https:// www.dalkilicspor.com/Iletisim or

https://www.etichetsport.com/ iletisim-6, contact the following email addresses: destek@

dalkilicspor.com or destek@

etichetsport.com, or call 0850 333 36

06 or 0850 333 36 28.

 

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Tamer Tanca Mağazacılık

Sanayi ve Ticaret A.Ş.

Customers

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

Data subjects seeking further information about the incident

may contact the relevant parties via the following address: Şerifali Mah. Beyan Sok. No: 39, Ümraniye/

İstanbul, the following email

address: info@biostore.com.tr, or the following telephone number: 0541 590 0586.

Uçak İş Formaları Sanayi ve Ticaret A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

Yakupoğlu Tekstil ve Deri Sanayi

Ticaret A.Ş.

Users and Customers

» Identity Data (name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident

may contact the relevant parties via the following KEP address:

yakupoglutekstil@hs01.kep.tr or the following telephone number: 0312

398 12 13.

Aktif Bilgi İşlem Sanayi Ticaret Ltd. Şti.

Employees, customers

and potential customers

» Identity Data (name,surname, ID number, passport)

» Contact Data (address/of

residence, email address,phone number)

» Employee Data (employee names, salary information)

500 people

*Data subjects seeking further

information about the incident may contact the data controller via the company’s telephone numbers,

email addresses, and social media accounts.

 

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Neptün Turizm ve Ticaret A.Ş. (Club Atlantis Resort & Maya Bistro)

Employees, customers

and potential customers

» Identity Data (name, surname, ID number, passport)

» Contact Data (address of

residence, email address, phone number)

» Accommodation Data

(accommodation information)

» Financial Data (current account information)

» Employee Data (employee names, salary information)

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller via the following website: https://www.

clubresortatlantis.com/, email address: info@neptunclubhotels.

com, KEP address:

neptunturizmas@hs01.kep.tr, or hotel switchboard telephone

number: +90 232 398 14 70.

Beauty Omelette Tekstil Kozmetik Pazarlama Sanayi ve Ticaret Ltd. Şti.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

clothing@beautyomelette.com, the following website: https://clothing. beautyomelette.com/, the following KEP address: beautyomelette@

hs01.kep.tr, or the following postal address: Harbiye Mahallesi Teşvikiye

Cad. No: 7/4, Şişli/İSTANBUL.

Emre Kuzey Mağazacılık

Sanayi ve Ticaret Ltd. Şti.

Subscribers/ Members

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

doksanbir@gmail.com, the following website: https://www. incetopuk.com/, the following telephone number: +90 533 595

59 98, the following KEP address: emrekuzeymagazacilik@hs01.kep. tr, or the following postal address: Oruçreis Mahallesi Tekstilkent

Cad. Tekstilkent Sit. A17 Apt. No: 10 M/302, Esenler/İSTANBUL.

 

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Est 1923

Perakende ve İnteraktif Mağazacılık Ticaret A.Ş.

Employees and Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident may contact the data controller

via the following website: https:// www.eyupsabrituncer.com/iletisim-formu, the following email address: eyupsabrituncer@eyupsabrituncer.

com, or the following telephone number: 0850 577 41 01.

Antrepo Mağazacılık

Hizmet Turizm Dış Ticaret A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller via the following website: https://cabani. com.tr/.

Avva Mağazacılık A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

Ayaydın Tekstil Turizm Ticaret Sanayi A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Bg Store

Mağazacılık A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident

may contact the data controller via the following email address: info@ bgstore.com.tr, or the following

telephone number: 444 21 81.

Efor Gıda Sanayi ve Dış Ticaret Ltd.

Şti.

Subscribers/ Members

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller via the following email address: iletisim@ anteppazari.com.tr.

FF Sanayi ve Dış Ticaret Ltd. Şti.

Subscribers/ Members

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident may contact the data controller via the following email address: kan@ffrue.com, the following website: http://rueonline.com/,

the following telephone number:

+90 545 825 21 22, the following registered electronic mail (KEP)

address: ffteks@hs01.kep.tr, or the following postal address: Yenibosna Merkez Mah. Yalçın Koreş Cad. Ali

Duran Sok. No:5 Kat:4 Bahçelievler/ İstanbul, Türkiye.

MNT Gıda İnşaat Turizm Sanayi Ticaret Ltd. Şti.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Vitaberg Kozmetik A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller via their website or WhatsApp support line.

Setre Giyim Tekstil Sanayi ve Ticaret A.Ş.

Not yet been determined.

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller via their website or WhatsApp support line.

Coşkun Hazır Giyim A.Ş.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

musterihizmetleri@suvari.com.tr, or the following telephone number:

0850 360 97 88.

Efachem Kimya Ürünleri Sanayi ve

Ticaret A.Ş.

 

» Identity Data

» Contact Data

» Location Data

» Employee Data

» Legal Proceedings Data

» Customer Transaction Data

» Physical Space Security Data

» Transaction Security Data

» Risk Management Data

» Marketing Data

» Visual and Audio Records

» Health Data

» Criminal Conviction and Security Measures Data

2200 people

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

kvkkiletisim@mefaendustri.com.

 

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Milkrun Lojistik A.Ş.

Employees, Users and Customers

» Identity Data

» Contact Data

» Location Data

» Employee Data

» Legal Proceedings Data

» Customer Transaction Data

» Physical Space Security Data

» Transaction Security Data

» Risk Management Data

» Marketing Data

» Visual and Audio Records

» Health Data

» Criminal Conviction and Security Measures Data

2200 people

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

kvkkiletisim@mefaendustri.com.

Al Fa Global Turizm Yatırımları Sanayi ve Ticaret

A.Ş.

Employees, Customers and

Users

» Identity Data

» Contact Data

» Location Data

» Employee Data

» Legal Proceedings Data

» Customer Transaction Data

» Physical Space Security Data

» Transaction Security Data

» Risk Management Data

» Marketing Data

» Visual and Audio Records

» Health Data

» Criminal Conviction and Security Measures Data

2200 people

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

kvkkiletisim@mefaendustri.com.

Ecoploymer Geri Dönüşüm A.Ş.

Employees, Customers and

Users

» Identity Data

» Contact Data

» Location Data

» Employee Data

» Legal Proceedings Data

» Customer Transaction Data

» Physical Space Security Data

» Transaction Security Data

» Risk Management Data

» Marketing Data

» Visual and Audio Records

» Health Data

» Criminal Conviction and Security Measures Data

2200 people

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

kvkkiletisim@mefaendustri.com.

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Elektrik

Mühendisleri Odası

Employees and Subscribers/Users

» Identity Data (name, surname),

» Contact Information (e-mail address)

» User Login Cridentials (password)

58,600 people

Mefa Endüstri A.Ş.

Employees, Users and Customers

» Identity Data

» Contact Data

» Location Data

» Employee Data

» Legal Proceedings Data

» Customer Transaction Data

» Physical Space Security Data

» Transaction Security Data

» Risk Management Data

» Marketing Data

» Visual and Audio Records

» Health Data

» Criminal Conviction and Security Measures Data

2200 people

*Data subjects seeking further information about the incident may contact the data controller via the following email address:

kvkkiletisim@mefaendustri.com.

Suud Tekstil

Sanayi ve Ticaret Ltd. Şti.

Customers

» Identity Data (name, surname),

» Contact Data (address of

residence, email address, phone

number)

» User Login Credentials

Not yet been determined.

*Data subjects seeking further

information about the incident may visit https://www.suudcollection. com, contact the following email

address: info@suudcollection.com, or call 0850 259 7883.

Canva Pty Ltd

The breach affected data

associated with 424 organisations based in Türkiye.

» Employee Data (employee

names, business email address, workplace location, business

phone number)

» Business Documents (customer order forms, contracts, invoices, data protection agreements,

master service agreements and other routine business

correspondence, to the extent

shared with the data controller)

Not yet been determined.

*Data subjects seeking further

information about the incident may contact the data controller through its Help Centre (https://www.canva. com/en_au/help/contact-us/) or

email address: privacy@canva.com.

Data Controller ( and sector)

Affected Data Subjects

Affected Personal Data Categories

Number of Data Subjects

Locco Elektronik Mağazacılık ve Ticaret Ltd. Şti.

Employees and Users

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials

517,306 people.

Tokgözler Civata Ticaret ve

Pazarlama A.Ş.

Customers

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» User Login Credentials (password)

17,915 people

Yeni Mağazacılık A.Ş. (“Eve

Kozmetik”)

Customers

» Identity Data(name, surname),

» Contact Data (email address, phone number)

6,263,305 people

Data subjects seeking further information about the incident

may contact the data controller through its website: https://www. eveshop.com.tr/ or email address:

kvkkbildirim@eveshop.com.tr.

3H Tekstil Ürünleri Sanayi Ticaret

Ltd. Şti.

Users and Subscribers/

Members

» Identity Data

» Contact Data

» Transaction Security Data

85,722 people

*Data subjects seeking further

information about the incident may contact the data controller via email at info@micca.com.tr, through its

registered electronic mail (KEP)

address at 3htekstil@hs03.kep.tr, or by telephone at 0216 641 2671.

Papara Menkul Değerler A.Ş.

Users

» Identity Data(name, surname),

» Contact Data (address/of

residence, email address, phone number)

» Financial Data (investment

profile, customer’s tax status as determined under FATCA rules)

Not yet been determined.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More