Turkey: Data Protection

Turkey's Constitutional Court has struck down Article 134 of the Criminal Procedure Code, which governed digital searches and data seizures, finding it violated privacy rights and personal data protection due to insufficient safeguards on data retention, deletion procedures, and scope limitations. The ruling creates a nine-month window for legislators to craft new regulations that balance criminal investigation needs with constitutional protections for digital privacy.

The Turkish Data Protection Board’s (“Board”) principle decision dated 29 April 2026 and numbered 2026/921 on the Processing of Biometric Data for Attendance Tracking Purposes (“Principle Decision”) was published in the Official Gazette dated 2 June 2026 and numbered 33268.

Turkey's Personal Data Protection Board has issued a comprehensive ruling on the use of biometric identification systems for employee attendance tracking, establishing strict limitations on when and how such data may be processed.