- within International Law topic(s)
In this report, we address the latest developments in the field of personal data protection in Turkiye, the decisions taken and guidelines published, as well as the fundamental regulations, principles and developments of personal data protection law, and the current issues, expectations and assessments in this field. We will also discuss the key developments from last year (2025) and the current issues that have arisen up to the first half of 2026.
2025 marked a pivotal year for data protection in Türkiye, with significant developments in both the regulatory framework and enforcement landscape. Throughout the year, the Turkish Personal Data Protection Authority (the "Authority") continued to shape compliance expectations through the publication of guidance documents, principle decisions, and public announcements, particularly in relation to cross-border data transfers, data security, digital platforms, and artificial intelligence ("AI").
Enforcement activity also increased considerably, with administrative fines totaling TRY 352.5 million imposed on 876 data controllers. The Authority reviewed hundreds of personal data breach notifications, while standard contractual clauses became the predominant mechanism for legitimising international data transfers following the amendments to the Personal Data Protection Law.
In parallel, the Authority issued sector-specific guidance for the banking and payment services industries, published comprehensive guidance on the processing of special categories of personal data and generative AI, and adopted notable principle decisions addressing practices such as obtaining consent for commercial electronic communications through SMS verification codes and the collection of identity document photocopies by hotels.
The first half of 2026 further demonstrated the Authority's increasingly proactive and technology-focused enforcement approach. New principle decisions addressed user authentication mechanisms, the use of biometric data for employee attendance monitoring, and the requirement that privacy notices be presented separately from consent requests. The Authority also launched ex officio investigations into Google Assistant, Grok, and the processing of children's personal data by digital platforms, reflecting heightened regulatory scrutiny of AI-powered services and children's privacy. Meanwhile, the Constitutional Court's Viennalife decision triggered significant debate regarding the legal basis for administrative fines imposed under the Personal Data Protection Law, potentially paving the way for further legislative amendments aligned with the GDPR. At the same time, the entry into force of the Cybersecurity Law and the establishment of the Cybersecurity Directorate introduced a new regulatory regime governing cybersecurity, critical infrastructure, cyber resilience, and incident response, substantially reinforcing Türkiye's broader digital governance framework.
To view the full article please click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
