Turkey: Privacy Protection

The Turkish Data Protection Board’s (“Board”) Principle Decision dated 16 September 2026 and numbered 2026/2035 (“Principle Decision”) was published in the Official Gazette dated 8 October 2026 and numbered 33394. The Principle Decision sets out the procedures and principles applicable to personal data processing activities carried out through the monitoring of communication channels used for work purposes, particularly corporate email accounts assigned to employees by their employers.

This article examines the protection of minors in digital services through a comparative legal analysis directed at foreign platforms and families. It distinguishes access restrictions, age assurance, parental authority, personal-data processing and routes of challenge.

Sosyal medya platformlarının kişilerin günlük yaşamının ayrılmaz bir parçası haline gelmesi ile birlikte, çalışanların iş ilişkisi dışında gerçekleştirdikleri paylaşımların da işverenler tarafından takip edilmesi ve zaman zaman bu paylaşımların disiplin yaptırımına veya iş sözleşmesinin feshine konu edilmesi söz konusu olabilmektedir. Bununla birlikte, çalışanın sosyal medya hesabında yaptığı her paylaşımın iş ilişkisi bakımından disiplin ihlali veya fesih nedeni olarak kabul edilmesi mümkün değildir.

The Personal Data Protection Board has issued a significant decision addressing a widespread compliance challenge: the practice of combining privacy notices with explicit consent requests in a single document or consent mechanism. This development has important implications for organizations managing data protection obligations.

On 27 July 2026, the Ministry of Trade announced comprehensive amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices, entering into force on 1 August 2026. The updated framework introduces strict rules on targeted advertising, requiring advertisers to inform consumers about the criteria used to display targeted ads and how to modify them.

On 7 July 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines explaining when information is genuinely anonymous. Anonymous information falls outside the General Data Protection Regulation (“GDPR”), while pseudonymised information remains subject to it. Removing names or replacing them with identification codes is not enough if an individual can still be identified using other available information

Turkey's Personal Data Protection Authority has intensified its regulatory oversight in 2025-2026, imposing significant fines while establishing new frameworks for artificial intelligence, data breach notifications, and cross-border data transfers. How are these evolving compliance requirements reshaping data protection practices for organizations operating in Turkey's increasingly regulated digital landscape?

Turkey's Personal Data Protection Authority has issued a public notice addressing widespread complaints about unlawful security camera usage in workplaces.

Turkey's Personal Data Protection Authority has issued a public notice addressing municipalities' widespread practice of live-streaming public spaces for tourism promotion...