Two-Minute Recap Data Protection Law Matters In Türkiye

Ministry of Trade Introduces New Regulations on Digital Advertising and AI Practices

On 27 July 2026, the Ministry of Trade announced comprehensive amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices, entering into force on 1 August 2026. The updated framework introduces strict rules on targeted advertising, requiring advertisers to inform consumers about the criteria used to display targeted ads and how to modify them. The regulation strictly bans targeted advertising aimed at children through personal data profiling and regulates AI in marketing by requiring clear disclosures for synthetic digital characters and prohibiting AI clones from portraying fake product experiences.

The amendments also establish new requirements for influencer marketing, requiring clear commercial disclosures when any benefit is received. Furthermore, the regulation addresses greenwashing by mandating scientific substantiation for environmental claims, sets stricter rules for discount pricing calculations, and bans unverified consumer reviews. On complaint platforms, the response window for sellers has been reduced from 72 to 48 hours before reviews are published.

DPA Issues Principle Decision on Processing Accident Victims’ Data

Turkish Personal Data Protection Authority (“DPA”) published a public announcement regarding Principle Decision No. 2026/1095 of the Personal Data Protection Board (“Board”), targeting unauthorized “damage consultancy” firms and fake lawyers who illegally obtain accident victims’ data to solicit business. Under Insurance Law No. 5684, insurance claims can only be handled by beneficiaries or their official attorneys; therefore, transferring victim data or claims to unauthorized consulting entities is legally void and constitutes a criminal offense under the Turkish Penal Code.

While insurance adjusters and relevant entities may legally process victim data for post-accident management, sharing it with unauthorized third parties is strictly prohibited. Data controllers must secure such data in accordance with the Personal Data Protection Law No. 6698 (“Law”) by implementing appropriate technical and administrative measures, including role-based access controls and logging mechanisms. The DPA warned that failure to implement the required safeguards may result in administrative fines and criminal liability under the Law.

DPA Issues Public Announcement on Using Personal Data Obtained from Third Parties for Marketing Purposes

On 21 July 2026, the DPA published a public announcement regarding the processing of contact information obtained from third parties, such as through customer referrals or brand ambassador programs, for advertising and direct marketing activities. The announcement follows numerous complaints submitted to the Board concerning unsolicited calls and text messages sent without prior notification or valid consent.

The Board clarified that acquiring contact details from third parties does not in itself provide a legal basis for marketing communications under the Law. The announcement highlights that silent or passive behaviors, including staying on a call, asking questions, or failing to reply with an opt-out message, cannot be treated as valid explicit consent. Furthermore, the Board emphasized that informing data subjects and obtaining explicit consent are two separate legal obligations, reminding data controllers that non-compliance may lead to administrative fines under the Law.

DPA Issues Principal Decision on Online Data Disclosures by Public Entities

On 27 July 2026, the Board rendered Principal Decision No. 2026/1301 regarding the publication of personal data on the internet by public institutions, municipalities, universities, and other public legal entities. The decision follows numerous complaints submitted to the DPA concerning online disclosures of excessive personal details, including national identification numbers, contact information, employment history, and examination results.

The Board highlighted that making personal data accessible on the internet constitutes a processing activity that must strictly adhere to the fundamental principles of the Law, particularly data minimization, purpose limitation, and storage limits. Public entities must immediately audit their websites, remove or mask unauthorized personal data, and implement technical measures such as masking or anonymization. Furthermore, for announcements such as exam or lottery results, the Board recommended adopting secure individual access methods through two factor authentication or the e-Devlet portal rather than releasing public lists. Failure to meet these requirements may lead to administrative sanctions under Article 18 of the Law.

DPA Publishes Data Protection

Compliance Guide for Public Institutions

On 28 July 2026, the DPA published the Compliance Guide for Public Institutions and Professional Organizations to enhance data protection awareness and eliminate operational ambiguities across the public sector. The guide provides comprehensive guidance on the obligations of public entities as data controllers under the Law, detailing core concepts such as general processing principles, lawful bases, notification duties, data security, retention and destruction policies, and VERBİS registration.

The guide also clarifies critical operational areas using concrete examples, including data sharing between public bodies, domestic and cross-border data transfers, and required technical and administrative safeguards. Furthermore, it outlines the duties of public institutions during DPA audits and details the full and partial exemptions applicable to the public sector under the Law.

DPA Imposes TRY 1 Million Fine on Finance Company for Unauthorized Marketing Communications

Media reported that the Board imposed an administrative fine of TRY 1 million on a savings finance company for processing contact information and sending unsolicited marketing communications without prior explicit consent. The case stemmed from an individual complaint regarding marketing text messages and phone calls, where the company claimed the phone number was entered into its system by another customer. The Board ruled that obtaining contact details through third parties without explicit consent violates the Law and commercial electronic communication rules, clarifying that third-party referrals do not relieve data controllers of their consent and notification obligations.

Parliament Amends Cybersecurity Framework

The Turkish Grand National Assembly (“Parliament”) adopted legislative amendments concerning the allocation of certain cybersecurity-related powers and responsibilities to the Cybersecurity Presidency. The amendments concern, among other matters, responsibilities relating to internet infrastructure and domain-name governance and include transitional provisions governing the transfer of relevant infrastructure, assets and responsibilities.

Ministry of National Education Issues Ten Point Data Protection Directive for Schools

The Ministry of National Education issued a ten point directive to all 81 Turkish provinces prohibiting the public disclosure of student and staff personal data across school websites, social media channels, and digital platforms. Under the directive, educational institutions are strictly forbidden from publishing class rosters,  national  identification  numbers, academic performance records, health details, contact information, or photographic and video content. School administrations must immediately audit their online presence to remove existing non compliant content and adopt secure, individual access methods for announcements. The circular also mandates data security training for educational staff, prohibits the use of unauthorized third party software or credential sharing, and warns of legal and administrative proceedings for data breaches.

Parliament Amends Criminal Procedure Code to Regulate Processing and Retention of Genetic Data

On 17 July 2026, the Parliament adopted amendments to the Code of Criminal Procedure under the 12th Judicial Package, establishing new safeguards for recording, storing, and destroying genetic data in criminal proceedings. Following an annulment decision by the Constitutional Court, the updated framework mandates that genetic analysis results be stripped of personal identifiers before being recorded in a dedicated system. The law requires immediate destruction of genetic records upon finalized acquittal, decisions not to prosecute, or rulings declaring no penalty, while setting a maximum retention period of twenty years after a finalized judgment. Furthermore, individuals may request early deletion from a judge if processing purposes no longer apply, and access to stored data is strictly limited to active criminal investigations under judicial authorization.

Data Breach Notifications – July 2026

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.