Key Decisions of the Turkish Data Protection Board in 2026

October 27, 2026 · Mosturoğlu & Çopuroğlu

2026 was a year in which the Turkish Personal Data Protection Board (the “Board”) shaped practice mainly through principle decisions. The Board adopted decisions of general application on many areas of everyday life, from the use of biometric data in employment and the monitoring of corporate email to loyalty cards and debt notices in residential complexes. In this article, we summarise the key decisions and developments that data controllers should take into account in their compliance work.

1. Biometric Data for Working-Time Tracking (Principle Decision 2026/921)

In principle decision no. 2026/921 of 29.04.2026 (Official Gazette 02.06.2026, No. 33268), the Board examined the use of biometric methods such as fingerprints, facial recognition, iris or palm scans for attendance tracking in the workplace. According to the decision:

• As no statutory provision expressly provides for biometric attendance tracking, such processing cannot be based on the ground of being “expressly provided for by law”.
• Because of the power imbalance between employer and employee, explicit consent obtained in an employment relationship is, as a rule, not regarded as freely given and is not a sufficient legal basis on its own.
• Even where consent is valid, processing must comply with the general principles in Article 4 of the Law, in particular proportionality. Since less intrusive methods exist, such as PIN or encrypted card systems, RFID/NFC ID cards or signature sheets, biometric attendance tracking was found disproportionate.

The decision provides for no transition period. Employers using biometric attendance systems should replace them with alternative methods without delay.

2. Monitoring of Corporate Email and Communication Channels (Principle Decision 2026/2035)

By principle decision no. 2026/2035 of 16.09.2026 (Official Gazette 08.10.2026), the Board set out the procedures and principles for employers monitoring corporate email accounts and other work communication channels assigned to employees. Key points:

• Employees must be informed in advance and specifically of the legal basis, purpose, scope and method of monitoring, the circumstances in which content may be accessed and the retention periods. A general statement that “corporate emails may be monitored” is not considered sufficient.
• Clear rules must be set on business and private use of corporate accounts. Even where private use is prohibited, monitoring remains subject to proportionality.
• An employer’s technical ability to access a device, session or network does not entitle it to access an employee’s personal email, messaging or social media accounts.
• A graduated approach should be adopted; content review should be exceptional and, as a rule, tied to a concrete suspicion or a specific incident. General and continuous content screening is not accepted.
• Access to monitoring results must be restricted to a limited number of authorised persons and access logs kept. After the employment ends, the legal basis for processing data in the former employee’s account must be reassessed.

3. Loyalty Card Programmes (Principle Decision 2026/266 and Extension)

In principle decision no. 2026/266 of 11.02.2026 (Official Gazette 28.02.2026, No. 33182), the Board held that loyalty card transactions carried out at checkout merely by quoting a phone number or card number, without the cardholder’s knowledge and approval, lack a legal basis under Article 5 and may breach the data security obligation under Article 12. Data controllers running loyalty programmes are required to set up mechanisms verifying that transactions are made with the cardholder’s knowledge and approval.

Following requests from the sector, the six-month compliance period was extended until 28.02.2027 by Board decision no. 2026/1491 of 22.07.2026 (Official Gazette 13.08.2026, No. 33339).

4. Separating Privacy Notices from Explicit Consent Texts (Principle Decision 2026/347)

By principle decision no. 2026/347 of 18.02.2026 (Official Gazette 24.03.2026, No. 33203), the Board addressed a problem frequently encountered in practice: privacy notices and explicit consent texts must be prepared separately, in plain language and tailored to the controller’s own processing activities. Explicit consent should not be requested for processing that can rely on another legal basis. The Board noted that non-compliance may lead to action under Article 18.

In line with this decision, the Board published an announcement on mobile app notifications in January 2026, stressing that bundling campaign notifications and operational notifications such as order tracking into a single consent is not appropriate, as it forces users to receive marketing messages.

5. Sharing Debt Information in Residential Complexes (Principle Decision 2026/348)

In principle decision no. 2026/348 of 18.02.2026 (Official Gazette 31.03.2026, No. 33210), the Board stated that management of residential complexes and apartment buildings may share information on service charge debts, but must do so proportionately and securely. Posting lists of debtors in common areas was found unlawful; closed email groups or messaging groups with restricted access were recommended instead.

6. Publication of Personal Data Online by Public Bodies (Principle Decision 2026/1301)

Principle decision no. 2026/1301 of 01.07.2026 (Official Gazette 28.07.2026, No. 33323) covers public-law data controllers such as municipalities, universities and provincial administrations. Under the decision, these bodies must verify a valid legal basis before publishing personal data online, promptly review existing publications and remove or mask those without a basis, and delete or anonymise data whose purpose has expired. Instead of publishing exam and lottery results as open public lists, results should be shown only to the person concerned through secure means such as e-Government or two-factor authentication.

7. SMS Verification Codes (Principle Decision 2025/1072)

In principle decision no. 2025/1072 of 10.06.2025 (Official Gazette 26.06.2025, No. 32938), published in 2025 but still relevant in 2026, the Board held that sending SMS verification codes in processes such as payments, memberships, reservations or account opening constitutes processing of personal data. It stressed that the privacy notice must be provided before processing, that explicit consent and consent to commercial electronic messages cannot be obtained through a single checkbox, and that SMS content should be designed with the processing activity in mind.

8. Practical Guide for Lawyers

On 22.09.2026, the Personal Data Protection Authority published the “Practical Guide on the Protection of Personal Data in Lawyers’ Professional Activities”, prepared with input from the Union of Turkish Bar Associations. The guide addresses the legal bases on which lawyers may process data, the conditions for processing special categories of data, domestic and cross-border transfers and data security measures.

The most notable part of the guide concerns generative AI tools. According to the guide, uploading client files or documents containing personal data to such tools may amount to a cross-border transfer, depending on the provider’s infrastructure and processing locations. Lawyers are therefore advised to review in advance the tool’s terms of use, where and for how long data is stored and whether it is used to train the model; to mask or anonymise data as far as possible; and in particular not to upload special categories of data such as health data or criminal convictions. The guide also recalls that, under Board decision no. 2018/32, lawyers are exempt from registration with VERBİS, but must be able to provide data subjects and the Authority, on request, with complete information on the purposes of processing and the recipients to whom data is transferred.

9. Constitutional Court: Legality Principle in Administrative Fines

In its decision of 27.01.2026 on application no. 2020/32193 (Official Gazette 16.06.2026, No. 33282), the Constitutional Court reviewed an administrative fine imposed on an insurance company under the KVKK. The company had called the data subject using contact details the person had made publicly available on a website; the Board fined the company on the grounds that data made public may only be processed consistently with the purpose for which it was made public.

While accepting that the fine had a statutory basis in the formal sense, the Court found that the Law contains no clear provision linking use contrary to the purpose of publication directly to a sanction, so that the fine relied on an unforeseeably broad interpretation. It held that the principle of legality of offences and penalties had been violated and ordered a retrial. The decision is significant in emphasising that, for administrative sanctions under the KVKK, both the obligation breached and the sanction attached to it must be set out clearly and foreseeably.

10. Administrative Fine Amounts for 2026

The administrative fines under Article 18 KVKK have been updated for 2026 by applying the revaluation rate of 25.49%:

• Failure to fulfil the obligation to inform: TRY 85,437 – 1,709,200
• Failure to fulfil data security obligations: TRY 256,357 – 17,092,242
• Failure to comply with Board decisions: TRY 427,263 – 17,092,242
• Breach of VERBİS registration and notification obligations: TRY 341,809 – 17,092,242
• Failure to notify standard contracts for cross-border transfers to the Authority: TRY 90,308 – 1,806,377

Conclusion

The 2026 decisions show that the Board is wary of reliance on explicit consent in employment relationships, places proportionality at the centre of its assessment and attaches importance to separating privacy notice and consent processes. We recommend that data controllers review their employee data processes (biometric systems and email monitoring), customer consent mechanisms (SMS, loyalty programmes, mobile notifications) and privacy notice and consent texts in light of these decisions. For lawyers and law firms, adopting an internal policy on the use of AI tools has now become a necessity.