Turkey: Privacy Protection

On 7 July 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines explaining when information is genuinely anonymous. Anonymous information falls outside the General Data Protection Regulation (“GDPR”), while pseudonymised information remains subject to it. Removing names or replacing them with identification codes is not enough if an individual can still be identified using other available information

The Personal Data Protection Board has extended the compliance deadline for loyalty card verification requirements to 28 February 2027. Data controllers must now implement technical and administrative...

Teknolojinin gelişmesiyle birlikte güvenlik kamerası sistemleri, günlük hayatın ayrılmaz bir parçası haline gelmiştir. Günümüzde sadece alışveriş merkezleri, bankalar veya kamu kurumları değil; apartmanlar, siteler, ofisler, fabrikalar, oteller ve küçük işletmeler dahi güvenlik amacıyla kamera sistemlerinden yararlanmaktadır.

The DPA published a public announcement regarding the Board’s Principle Decision dated 29 April 2026 and numbered 2026/921, concerning the processing of biometric data for tracking employee working hours.

The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities.

Turkey's data protection landscape in 2025 saw significant regulatory developments through the Personal Data Protection Authority's guidance documents, principle decisions, and enforcement actions. How did artificial intelligence regulation, cross-border data transfers, and cybersecurity legislation reshape compliance obligations for data controllers operating in Turkey?

Turkey's Constitutional Court examines whether administrative fines imposed for processing publicly disclosed personal data violate the principle of legality in crimes and punishments. The case centers on whether regulatory interpretations can create obligations not explicitly defined in the Personal Data Protection Law, raising fundamental questions about legal predictability and constitutional safeguards in data protection enforcement.

The Turkish Personal Data Protection Board has issued a landmark principle decision addressing the processing of biometric data for employee attendance tracking purposes. This decision establishes critical guidelines for employers regarding the lawful collection and use of sensitive biometric information in workplace settings. Understanding these new regulatory requirements is essential for organizations operating in Turkey to ensure compliance with data protection obligations.

The Turkish Constitutional Court has ruled that the Personal Data Protection Board violated the principle of legality by imposing an administrative fine on an insurance company without proper legal basis for its interpretation of 'disclosure purpose.' This landmark decision requires companies processing data from public sources to reassess their timelines, inventories, and ongoing investigation files under Article 5 of the Personal Data Protection Law.