Turkey: Privacy Protection

On 27 July 2026, the Ministry of Trade announced comprehensive amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices, entering into force on 1 August 2026. The updated framework introduces strict rules on targeted advertising, requiring advertisers to inform consumers about the criteria used to display targeted ads and how to modify them.

On 7 July 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines explaining when information is genuinely anonymous. Anonymous information falls outside the General Data Protection Regulation (“GDPR”), while pseudonymised information remains subject to it. Removing names or replacing them with identification codes is not enough if an individual can still be identified using other available information

The Personal Data Protection Board has extended the compliance deadline for loyalty card verification requirements to 28 February 2027. Data controllers must now implement technical and administrative...

İş süreçlerinin yönetiminde hız, maliyet etkinliği ve operasyonel verimlilik arayışı tek-nolojideki yeniliklerin ortaya çıkmasında hare-kete geçirici unsurlar arasında yer almaktadır. Teknolojinin de gelişimi ile başlangıçta yalnızca mekanik süreçleri kolaylaştırmak amacıyla ge-liştirilen otomasyon sistemleri, günümüz itiba-rıyla insan müdahalesine ve katkısına neredeyse ihtiyaç duyulmaksızın bağımsız karar alabilen sistemlere dönüşmüştür.

The DPA published a public announcement regarding the Board’s Principle Decision dated 29 April 2026 and numbered 2026/921, concerning the processing of biometric data for tracking employee working hours.

The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities.

Turkish municipalities have been conducting live broadcasts from public spaces for tourism promotion, but these streams often capture identifiable personal data.

Turkey's Constitutional Court examines whether administrative fines imposed for processing publicly disclosed personal data violate the principle of legality in crimes and punishments. The case centers on whether regulatory interpretations can create obligations not explicitly defined in the Personal Data Protection Law, raising fundamental questions about legal predictability and constitutional safeguards in data protection enforcement.

The Turkish Personal Data Protection Board has issued a landmark principle decision addressing the processing of biometric data for employee attendance tracking purposes. This decision establishes critical guidelines for employers regarding the lawful collection and use of sensitive biometric information in workplace settings. Understanding these new regulatory requirements is essential for organizations operating in Turkey to ensure compliance with data protection obligations.