Turkey: Data Protection

Turkey's data protection authority has issued a public announcement clarifying the scope and application of biometric data processing regulations, particularly addressing uncertainties around employee attendance tracking systems. The announcement examines when fingerprint and palm scanning technologies constitute biometric data processing and under what circumstances such processing may be lawful beyond routine attendance monitoring.

İtalyan veri koruma otoritesi (Garante), 18 Haziran 2026 tarihli ve 476 sayılı kararı ile Piaggio & C. S.p.A.'ya, işten çıkarılan iki çalışanın kurumsal e-posta hesaplarına erişim ve bu verilerin uzun süre saklanması nedeniyle 460.000 avro idari para cezası uygulamıştır.

By its decision no. 476 of 18 June 2026, the Italian data protection authority (the "Garante") imposed an administrative fine of EUR 460,000 on Piaggio & C. S.p.A. for accessing the corporate email accounts of two dismissed employees and retaining that data for an extended period.

The compliance period prescribed for data controllers in relation to loyalty card practices has been extended until 28 February 2027 pursuant to the Decision of the Personal Data Protection Board (the “Board”) dated 22 July 2026 and numbered 2026/1491 (the “Decision”), published in the Official Gazette dated 13 August 2026 and numbered 33339.

17 Ağustos 2026 tarihli ve 2026/9 sayılı Cumhurbaşkanlığı Genelgesi, 18 Ağustos 2026 tarihli Resmî Gazete’de yayımlandı. Genelge ile Türkiye’nin yapay zekâ alanındaki 2026–2030 dönemi yol haritasını belirleyen Türkiye Yapay Zekâ Eylem Planı’nın (“Plan”) uygulanması için kamu kurum ve kuruluşlarının gerekli çalışmaları yürütmesi ve ihtiyaç duyulan desteği sağlaması öngörülmektedir.

Significant developments in law and technology emerged in February 2026, including a new Turkish Personal Data Protection Board principle decision, proposed digital copyright regulation for online platforms, pay transparency discussions, OECD guidance on artificial intelligence, and a DSA investigation concerning TikTok. This update provides insights on these developments alongside recent judicial decisions in labour law and personal data protection.

Temmuz ayında kişisel verilerin korunması alanında, veri işleme süreçlerini daha somut ve uygulamaya dönük şekilde şekillendiren önemli gelişmeler yaşanmıştır.

In July, significant developments took place in the field of personal data protection, further shaping data processing practices in a more concrete and practice-oriented manner.

On January 2, 2025, the Personal Data Protection Authority (“Authority“) published the Guideline on the Cross-Border Transaction of Personal Data Cross-border (“Guideline“) in order to enlighten the public on the implementation of transactions of personal data cross-border within the scope of Article 9 of the Personal Data Protection Law No. 6698 (“KVKK“) and the appropriate safeguards expected by the Personal Data Protection Board (“Board“).