July 2026: Data Protection Law Updates

In July, significant developments took place in the field of personal data protection, further shaping data processing practices in a more concrete and practice-oriented manner.

The regulations, Principle Decisions and guidelines published during the month not only clarified the obligations of data controllers in a more concrete and practical manner but also introduced significant developments regarding AI applications and the processing of special categories of personal data.

1. Principle Decision on the Processing of Personal Data of Accident Victims

The Personal Data Protection Board's Principle Decision on the Processing of Personal Data of Accident Victims was published in the Official Gazette dated 1 July 2026.¹ The Decision was issued in response to numerous complaints and reports received by the Personal Data Protection Authority concerning accident victims being contacted without their consent following traffic, workplace and similar accidents, the processing of their personal data without a valid legal basis, and unauthorised actions taken on their behalf.

The Board stated that compensation claims arising from insurance contracts may only be pursued by the right holder or their legal representative and may not be assigned to third parties or organisations. It further stated that it is unlawful for claims management companies and similar entities to process the personal data of accident victims without a valid legal basis for processing. The Board also emphasised that persons with access to personal data may process such data only within the scope of their duties and authority, failing which they may be subject to both administrative and criminal liability.

The Decision further states that data controllers should restrict access to personal data to those who require it for the performance of their duties, maintain records of such access, and support employees' awareness of data security and confidentiality obligations through regular training.

2. Developments Concerning Special Categories of Personal Data

Two significant developments concerning the protection of special categories of personal data took place in July:

• The introduction of rules governing the procedures and principles for the reassessment of personal health data;
• The establishment of a new legal framework under the Criminal Procedure Code governing the recording, retention and destruction of genetic examination results.

2.1. Regulation on the Reassessment of Personal Health Data

The Regulation published in the Official Gazette on 4 July 2026² introduced amendments to the Regulation on Personal Health Data. The amendments added the phrase "Reassessment" to Chapter Four, titled "Concealment, Rectification, Destruction and Transfer of Personal Health Data", and introduced a new Article 13/A entitled "Reassessment of Personal Health Data".

Under the new rules, individuals may request a reassessment of previously established diagnoses based on their current health condition. Where the reassessment results in a medical board report confirming that the relevant diagnosis no longer reflects the individual's current health status, that report will serve as the basis for all administrative and legal procedures, including recruitment processes, unless otherwise provided by the applicable legislation. The amendments are intended to prevent historical diagnoses that no longer reflect an individual's current health condition from continuing to produce legal consequences.

2.2. Regulation on Genetic Examination Results

As part of the 12th Judicial Reform Package,³ the Criminal Procedure Code has been amended to redefine the procedures and principles governing the recording, retention, use and destruction of genetic examination results.

Following the Constitutional Court's annulment of the previous provisions, the Criminal Procedure Code now sets out a revised legal framework governing the recording, retention, use and destruction of genetic examination results. The amendments address the legal uncertainties identified by the Constitutional Court regarding the retention and destruction of such records, as well as the safeguards afforded to data subjects.

Where a decision of non-prosecution is issued, or where an acquittal or a decision that no penalty shall be imposed becomes final, the records must be destroyed without delay. In all other cases, the records will be retained for twenty years following the date on which the relevant court decision becomes final and destroyed upon the expiry of that period. In addition, data subjects are granted the right, under certain conditions, to request the deletion of their records, while access to such records is restricted to authorised authorities acting within the scope of an ongoing investigation or criminal prosecution and on the basis of a formal decision.

3. AI and Targeted Advertising in Digital Advertising

Amendments to the Regulation on Commercial Advertising and Unfair Commercial Practices, which entered into force on 1 August 2026,⁴ introduced new obligations regarding the use of AI in advertising and targeted advertising based on personal data.

Where AI or similar software is used in a way that is likely to materially influence consumers' economic behaviour, or where advertisements feature digital characters that are indistinguishable from real persons, this must be clearly, intelligibly and prominently disclosed in the advertisement. The amendments also prohibit advertisements that use AI-generated digital replicas of real individuals to create the false impression that they have experienced, used or endorsed a product or service.

Advertisements displayed to specific individuals or groups based on the analysis of consumers' online behaviour, previous preferences, location data, demographic information or similar personal data are regarded as targeted advertising. In such cases, consumers must be provided with clear and easily accessible information explaining the criteria used to display the advertisement and how those criteria can be modified.

The amendments further prohibit targeted advertising based on the profiling of consumers who are known, or can reasonably be expected, to be children. They also introduce additional obligations in relation to advertisements disseminated through social media influencers, discount sales and consumer reviews.

4. Ministry of National Education Circular on the Protection of Personal Data in Educational Institutions

The Circular titled "Measures to Be Taken within the Scope of the Protection of Personal Data", issued by the General Directorate of Information Technologies of the Ministry of National Education on 29 June 2026, sets out the administrative and technical measures to be implemented for the protection of personal data processed by educational institutions, including data relating to students, parents, teachers and other personnel. The Circular aims to establish a consistent approach to personal data processing across educational institutions.

In particular, it provides that photographs and videos of students and staff, as well as student lists, examination results, health information and other personal data, should not be made publicly available on school websites, social media accounts or other online platforms. It also requires educational institutions to provide prior notice where photographs or videos are to be taken as part of educational activities and, where necessary, to obtain explicit consent.

In addition, school administrators, teachers and other relevant personnel are required to ensure the security of the user accounts they use to access the Ministry's information systems, refrain from using unauthorised third-party software, plug-ins, bots or similar tools, and report any personal data breaches to the relevant authorities without undue delay.

5. Legislative Amendments Concerning the Cybersecurity Directorate

Legislative amendments published in the Official Gazette on 31 July 2026⁵ introduced significant changes to the powers and responsibilities of the Cybersecurity Directorate. Under the new framework, a substantial portion of the powers and responsibilities relating to cybersecurity that had previously been exercised by different public authorities has been consolidated under the Cybersecurity Directorate (the "Directorate"). The IT infrastructure, data centres, records and documents used in the exercise of those powers, together with the related rights and obligations, have also been transferred to the Directorate.

In particular, the Directorate has been vested with the authority to determine strategies and policies concerning internet domain names and to adopt secondary legislation in this area. It has also assumed responsibility for the management of internet infrastructure, as well as for the identification and analysis of communications. The Directorate is expected to play an increasingly prominent role in shaping cybersecurity practice in the coming years. It will therefore be important to closely monitor the secondary legislation and implementation guidelines to be issued by the Directorate.

6. European Data Protection Board (EDPB) Guidelines

The European Data Protection Board (EDPB) has published three important guidelines on anonymisation, web scraping for generative AI, and the processing of personal data using blockchain technologies.⁶ While the guidelines on anonymisation and web scraping have been published in draft form for public consultation, the guidelines on blockchain technologies have been adopted in their final form.

• Guidelines on Anonymisation: The draft guidelines revisit the concept of anonymous data in light of the recent case law of the Court of Justice of the European Union (CJEU) and provide a practical framework for assessing whether data can truly be regarded as anonymous. According to the guidelines, data may only be considered anonymous where it cannot be used to identify an individual, be linked to other datasets, or enable inferences to be drawn about a person.
• Guidelines on Generative AI and Web Scraping: The draft guidelines emphasise that the automated collection of data from the internet for the purpose of training AI models constitutes the processing of personal data under the GDPR. The mere fact that personal data is publicly available online does not, in itself, make such processing lawful. Data controllers must rely on an appropriate legal basis for processing, comply with their transparency obligations and adhere to the principle of data minimization. Accordingly, the fact that personal data is publicly available online does not mean that it may be used to train AI models without first assessing whether the processing complies with the GDPR.
• Guidelines on Blockchain Technologies: The guidelines emphasise that, in order to ensure compliance with the GDPR, data protection principles should be taken into account from the design stage of blockchain-based systems. They recommend storing personal data off-chain rather than on the blockchain itself, assessing in advance whether the intended purpose can be achieved without using blockchain technology, and implementing technical solutions that enable the effective exercise of the right to erasure and other data subject rights. The guidelines also stress the importance of carrying out a Data Protection Impact Assessment (DPIA) for blockchain-based projects and ensuring that data protection requirements are incorporated into the design of systems, while default settings are configured to provide the highest level of protection for personal data.

7. Developments Concerning Public Institutions

Principle Decision on the Publication of Personal Data on Public Institutions' Websites

The Personal Data Protection Board's Principle Decision on the Publication of Personal Data on the Internet by Data Controllers with Public Legal Entity Status, dated 1 July 2026⁷, sets out the key principles governing the publication of documents containing personal data on the websites of public institutions.

The Board found that documents published on public institutions' websites, including examination results, personnel lists, tender documents and application records, often contained more personal data than necessary. It emphasized that such disclosures must be based on a valid legal basis for processing. The Decision further states that personal data which is not required to be disclosed should be redacted or removed, retention periods for published content should be defined, and access to announcements, particularly examination and lottery results, should be restricted, where possible, to the individuals concerned.

Compliance Guide for Public Institutions

In addition to the Principle Decision on the publication of personal data on the internet, the Authority has also published a comprehensive Compliance Guide for Public Institutions.⁸ The Guide explains, through practical examples, the obligations of public institutions regarding data processing, data sharing and data security, as well as key considerations for ensuring compliance in practice. In particular, the Guide clarifies that the sharing of personal data between public institutions cannot be based solely on a protocol concluded between the relevant institutions and that each data sharing activity must be assessed separately on its own legal basis.

8. Other Developments

Public Announcement on the Use of Contact Information Obtained from Third Parties for Advertising and Marketing Purposes⁹

The Personal Data Protection Authority emphasized that the use of telephone numbers, email addresses and other contact information obtained from third parties for advertising and marketing purposes is not, in itself, lawful. It stated that, before processing personal data for advertising or marketing purposes, data controllers must assess whether a valid legal basis for processing exists in each individual case. Where processing is based on explicit consent, data subjects must first be duly informed and their explicit consent must be obtained through a separate declaration of will.

Constitutional Court Decision on Article 136 of the Turkish Criminal Code¹⁰

The Constitutional Court dismissed the application challenging the constitutionality of Article 136 of the Turkish Criminal Code, which provides that the offence of unlawfully disclosing or obtaining personal data is subject to ex officio investigation rather than being complaint-based. The Court held that the offence concerns not only the individual interests of the victim, but also public confidence in the protection of personal data and public order. Accordingly, it concluded that conducting investigations without requiring a complaint is consistent with the Constitution. The decision confirms that the unlawful disclosure or acquisition of personal data continues to be regarded as an offence that affects not only individual interests but also public order.

9. Our Assessment

Taken together, the developments in July confirm, as highlighted in our previous newsletter,¹¹ that data protection law continues to evolve towards a more practical and implementation-focused approach that keeps pace with technological developments. In particular, the new rules on AI-driven advertising, the processing of genetic data and the sharing of personal data by public institutions demonstrate that data controllers are expected not only to comply formally with the requirements of the Law, but also to design and implement their data processing activities using a risk-based approach.

The guidelines published by the European Data Protection Board further demonstrate that technologies such as AI, anonymisation and blockchain require new assessments from a data protection perspective. Although these guidelines are not binding in Türkiye, they provide an important point of reference for understanding international trends in data protection and anticipating future domestic legislative developments and decisions of the Personal Data Protection Board.

Looking ahead, we expect data protection law to continue evolving not only through legislative amendments, but also through decisions of the Personal Data Protection Board, judicial developments and technological innovation.

Accordingly, data controllers should regularly review their compliance programmes not only in light of existing legal requirements, but also with due regard to evolving regulatory practice and technological developments. In particular, it is essential to keep processes relating to AI applications, data security and the processing of special categories of personal data up to date.

Footnotes

1. Principle Decision No. 2026/1095 of the Personal Data Protection Board, dated 20 May 2026, on the Processing of Personal Data of Accident Victims: https://www.resmigazete.gov.tr/eskiler/2026/07/20260701-15.pdf

2. Regulation Amending the Regulation on Personal Health Data: https://www.resmigazete.gov.tr/eskiler/2026/07/20260704-9.htm

3. For further information on the amendments introduced under the 12th Judicial Reform Package, please refer to our client note available here.

4. Regulation Amending the Regulation on Commercial Advertising and Unfair Commercial Practices: https://www.resmigazete.gov.tr/eskiler/2026/07/20260701-9.htm

5. Legislative Amendments: https://www.resmigazete.gov.tr/eskiler/2026/07/20260731-2.htm

6. EDPB Guidelines published on 8 July 2026: https://www.edpb.europa.eu/news/edpb-sheds-light-on-anonymisation-and-web-scraping-for-generative-ai-and-adopts-final-version_en

7. Principle Decision No. 2026/1301, dated 1 July 2026: https://www.resmigazete.gov.tr/eskiler/2026/07/20260728-6.pdf

8. Compliance Guide for Public Institutions: https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTZhNjc1YWFhNmVjOGY.pdf

9. The Public Announcement: https://www.kvkk.gov.tr/Icerik/8830/ucuncu-kisilerden-elde-edilen-kisisel-verilerin-reklam-ve-pazarlama-amacli-kullanilmasina-iliskin-kamuoyu-duyurusu

10. Constitutional Court Decision: https://www.resmigazete.gov.tr/eskiler/2026/07/20260714-9.pdf

11. Our previous newsletter, June 2026: Data Protection Law Update, is available here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.