- in Turkey
- within Strategy, Tax and International Law topic(s)
On 13 August 2026, the Turkish Personal Data Protection Authority published an announcement confirming that the deadline for data controllers to implement verification mechanisms for loyalty card transactions has been extended to 28 February 2027.
The extension relates to the Turkish Personal Data Protection Board’s (the “Board”) Principle Decision No. 2026/266 dated 11 February 2026. The Principle Decision introduced specific requirements aimed at preventing personal data breaches arising where a loyalty card holder’s mobile phone number or loyalty card number is used by a third party during a purchase.
Under the Principle Decision, data controllers operating loyalty card programmes must implement appropriate mechanisms to verify that transactions involving a loyalty card are carried out with the card holder’s knowledge and authorisation. These requirements apply across the loyalty card lifecycle, including enrolment, the accrual and redemption of points, and access to loyalty-based discounts and promotions.
Following requests from industry representatives, the Board adopted Decision No. 2026/1491 dated 22 July 2026, extending the original six-month implementation period to 28 February 2027.
Businesses operating loyalty card programmes should use the extended implementation period to review their existing practices, identify processes that may allow loyalty card credentials to be used by third parties, and implement the necessary technical and operational safeguards. All required compliance measures should be in place by 28 February 2027.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
