Turkish Government Sets Q3 2027 Target for GDPR Alignment
On 6 September 2026, Türkiye’s Medium-Term Programme (2027–2029) was published in Official Gazette No. 33362 (Duplicate Issue). Under the “Business and Investment Environment” policy area, the Programme identifies the completion of the process of aligning Personal Data Protection Law No. 6698 (“KVKK”) with the EU General Data Protection Regulation (“GDPR”) as a legislative and administrative measure targeted for the third quarter of 2027.
The measure forms part of the government’s broader objectives of improving regulatory quality, strengthening predictability and facilitating administrative processes. The Programme further provides that public institutions’ legislative and implementation activities will be guided by its policy framework, with detailed measures for the first year to be set out in the 2027 Presidential Annual Programme. The stated timeline establishes a target for completing the alignment process, while the specific scope of any legislative amendments remains to be determined.
Turkish DPA Publishes Guidance on Personal Data Protection in Legal Practice
The Turkish Personal Data Protection Authority (“DPA”) has published its Practical Guide on Personal Data Protection in Lawyers’ Professional Activities, prepared with input and contributions from the Union of Turkish Bar Associations. The Guide addresses key data protection issues arising in legal practice, including the use of generative artificial intelligence tools, data controller and data processor status, special categories of personal data, data transfers and data security, providing practical explanations and examples.
The Guide highlights that uploading client files, court documents or other materials containing personal data to generative AI tools such as ChatGPT, Claude and Gemini may constitute an international data transfer, depending on the infrastructure used. It recommends masking or anonymising personal data where possible, avoiding the upload of special categories of personal data and sharing only the minimum data necessary. It also examines the data protection roles of different legal professionals, the legal bases for processing clients’ and third parties’ data, the use of applications that enable searches using unlawfully obtained data, and practical measures to address data security risks.
The DPA Announced the Following Data Breach Notifications in September
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Sakarya Üniversitesi Teknoloji Geliştirme Bölgeleri Yönetici A.Ş. |
Employees, students and users |
» Identity Data, » Contact Data, » Employee Data (work experience) » Transaction Security Data |
1500 people *Data subjects seeking further information about the incident may contact the following email address: iletisim@sakaryateknokent.com, and telephone number: 0264 346 0202. |
|
Uşak Üniversitesi |
Employees, students and undetected subject groups |
» Identity Data, » Contact Data » Employee Data » Transaction Security Data » Visual and Audio Recordings |
3000 people |
|
Tazemasa Gıda Ürünleri Pazarlama Sanayi ve Ticaret A.Ş. |
Customers |
» Identity Data (name,surname) » Contact Data (address/of residence, email address, phone number) » User Login Credentiasl |
Not yet been determined. *Data subjects seeking further information about the incident may contact the following email addresses: ozcan@tazemasa.com and servis@tazemasa.com, and the following telephone numbers: 0532 274 2806 and 0216 461 0016. |
|
Askı Nişantaşı Tekstil Ticaret ve Sanayi Ltd. Şti. |
Customers |
» Identity Data (name,surname) » Contact Data (address/of residence, email address,phone number), » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the relevant parties at the following address: Halide Edip Adıvar Mah. Sultan Sok. No:28, Kut Yapı İş Merkezi, Kat:4-5, Şişli, İstanbul, via email at destekaskinisantasi@hotmail.com, or by telephone at 0850 305 6027. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Efe Doğal Ürünler Sanayi ve Ticaret Ltd. Şti. |
Customers |
» Identity Data (name, surname) » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the relevant parties via the following address: Şerifali Mah. Beyan Sok. No: 39, Ümraniye/ İstanbul, the following email address: info@biostore.com.tr, or the following telephone number: 0541 590 0586. |
|
Ersoylar Spor Giyim İnşaat İhtiyaç Maddeleri Pazarlama Sanayi ve Ticaret Ltd. Şti. |
Customers |
» Identity Data (name,surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the relevant parties via the following website: https://www. etichet.com.tr/iletisim, the following email address: destek@etichet. com.tr, or the following telephone number: 0850 433 36 37. |
|
İlvi Ayakkabı Deri ve Tekstil Ürünleri Sanayi Ticaret A.Ş. |
Customers |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the following email address: info@ilvi.com or telephone number: 0850 305 1011. |
|
Market Spor Malzemeleri Sanayi ve Ticaret Ltd. Şti. |
Customers |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may visit the following websites: https:// www.dalkilicspor.com/Iletisim or https://www.etichetsport.com/ iletisim-6, contact the following email addresses: destek@ dalkilicspor.com or destek@ etichetsport.com, or call 0850 333 36 06 or 0850 333 36 28. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Tamer Tanca Mağazacılık Sanayi ve Ticaret A.Ş. |
Customers |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. Data subjects seeking further information about the incident may contact the relevant parties via the following address: Şerifali Mah. Beyan Sok. No: 39, Ümraniye/ İstanbul, the following email address: info@biostore.com.tr, or the following telephone number: 0541 590 0586. |
|
Uçak İş Formaları Sanayi ve Ticaret A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. |
|
Yakupoğlu Tekstil ve Deri Sanayi Ticaret A.Ş. |
Users and Customers |
» Identity Data (name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the relevant parties via the following KEP address: yakupoglutekstil@hs01.kep.tr or the following telephone number: 0312 398 12 13. |
|
Aktif Bilgi İşlem Sanayi Ticaret Ltd. Şti. |
Employees, customers and potential customers |
» Identity Data (name,surname, ID number, passport) » Contact Data (address/of residence, email address,phone number) » Employee Data (employee names, salary information) |
500 people *Data subjects seeking further information about the incident may contact the data controller via the company’s telephone numbers, email addresses, and social media accounts. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Neptün Turizm ve Ticaret A.Ş. (Club Atlantis Resort & Maya Bistro) |
Employees, customers and potential customers |
» Identity Data (name, surname, ID number, passport) » Contact Data (address of residence, email address, phone number) » Accommodation Data (accommodation information) » Financial Data (current account information) » Employee Data (employee names, salary information) |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following website: https://www. clubresortatlantis.com/, email address: info@neptunclubhotels. com, KEP address: neptunturizmas@hs01.kep.tr, or hotel switchboard telephone number: +90 232 398 14 70. |
|
Beauty Omelette Tekstil Kozmetik Pazarlama Sanayi ve Ticaret Ltd. Şti. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: clothing@beautyomelette.com, the following website: https://clothing. beautyomelette.com/, the following KEP address: beautyomelette@ hs01.kep.tr, or the following postal address: Harbiye Mahallesi Teşvikiye Cad. No: 7/4, Şişli/İSTANBUL. |
|
Emre Kuzey Mağazacılık Sanayi ve Ticaret Ltd. Şti. |
Subscribers/ Members |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: doksanbir@gmail.com, the following website: https://www. incetopuk.com/, the following telephone number: +90 533 595 59 98, the following KEP address: emrekuzeymagazacilik@hs01.kep. tr, or the following postal address: Oruçreis Mahallesi Tekstilkent Cad. Tekstilkent Sit. A17 Apt. No: 10 M/302, Esenler/İSTANBUL. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Est 1923 Perakende ve İnteraktif Mağazacılık Ticaret A.Ş. |
Employees and Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following website: https:// www.eyupsabrituncer.com/iletisim-formu, the following email address: eyupsabrituncer@eyupsabrituncer. com, or the following telephone number: 0850 577 41 01. |
|
Antrepo Mağazacılık Hizmet Turizm Dış Ticaret A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following website: https://cabani. com.tr/. |
|
Avva Mağazacılık A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. |
|
Ayaydın Tekstil Turizm Ticaret Sanayi A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Bg Store Mağazacılık A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: info@ bgstore.com.tr, or the following telephone number: 444 21 81. |
|
Efor Gıda Sanayi ve Dış Ticaret Ltd. Şti. |
Subscribers/ Members |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: iletisim@ anteppazari.com.tr. |
|
FF Sanayi ve Dış Ticaret Ltd. Şti. |
Subscribers/ Members |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: kan@ffrue.com, the following website: http://rueonline.com/, the following telephone number: +90 545 825 21 22, the following registered electronic mail (KEP) address: ffteks@hs01.kep.tr, or the following postal address: Yenibosna Merkez Mah. Yalçın Koreş Cad. Ali Duran Sok. No:5 Kat:4 Bahçelievler/ İstanbul, Türkiye. |
|
MNT Gıda İnşaat Turizm Sanayi Ticaret Ltd. Şti. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Vitaberg Kozmetik A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via their website or WhatsApp support line. |
|
Setre Giyim Tekstil Sanayi ve Ticaret A.Ş. |
Not yet been determined. |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via their website or WhatsApp support line. |
|
Coşkun Hazır Giyim A.Ş. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller via the following email address: musterihizmetleri@suvari.com.tr, or the following telephone number: 0850 360 97 88. |
|
Efachem Kimya Ürünleri Sanayi ve Ticaret A.Ş. |
» Identity Data » Contact Data » Location Data » Employee Data » Legal Proceedings Data » Customer Transaction Data » Physical Space Security Data » Transaction Security Data » Risk Management Data » Marketing Data » Visual and Audio Records » Health Data » Criminal Conviction and Security Measures Data |
2200 people *Data subjects seeking further information about the incident may contact the data controller via the following email address: kvkkiletisim@mefaendustri.com. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Milkrun Lojistik A.Ş. |
Employees, Users and Customers |
» Identity Data » Contact Data » Location Data » Employee Data » Legal Proceedings Data » Customer Transaction Data » Physical Space Security Data » Transaction Security Data » Risk Management Data » Marketing Data » Visual and Audio Records » Health Data » Criminal Conviction and Security Measures Data |
2200 people *Data subjects seeking further information about the incident may contact the data controller via the following email address: kvkkiletisim@mefaendustri.com. |
|
Al Fa Global Turizm Yatırımları Sanayi ve Ticaret A.Ş. |
Employees, Customers and Users |
» Identity Data » Contact Data » Location Data » Employee Data » Legal Proceedings Data » Customer Transaction Data » Physical Space Security Data » Transaction Security Data » Risk Management Data » Marketing Data » Visual and Audio Records » Health Data » Criminal Conviction and Security Measures Data |
2200 people *Data subjects seeking further information about the incident may contact the data controller via the following email address: kvkkiletisim@mefaendustri.com. |
|
Ecoploymer Geri Dönüşüm A.Ş. |
Employees, Customers and Users |
» Identity Data » Contact Data » Location Data » Employee Data » Legal Proceedings Data » Customer Transaction Data » Physical Space Security Data » Transaction Security Data » Risk Management Data » Marketing Data » Visual and Audio Records » Health Data » Criminal Conviction and Security Measures Data |
2200 people *Data subjects seeking further information about the incident may contact the data controller via the following email address: kvkkiletisim@mefaendustri.com. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Elektrik Mühendisleri Odası |
Employees and Subscribers/Users |
» Identity Data (name, surname), » Contact Information (e-mail address) » User Login Cridentials (password) |
58,600 people |
|
Mefa Endüstri A.Ş. |
Employees, Users and Customers |
» Identity Data » Contact Data » Location Data » Employee Data » Legal Proceedings Data » Customer Transaction Data » Physical Space Security Data » Transaction Security Data » Risk Management Data » Marketing Data » Visual and Audio Records » Health Data » Criminal Conviction and Security Measures Data |
2200 people *Data subjects seeking further information about the incident may contact the data controller via the following email address: kvkkiletisim@mefaendustri.com. |
|
Suud Tekstil Sanayi ve Ticaret Ltd. Şti. |
Customers |
» Identity Data (name, surname), » Contact Data (address of residence, email address, phone number) » User Login Credentials |
Not yet been determined. *Data subjects seeking further information about the incident may visit https://www.suudcollection. com, contact the following email address: info@suudcollection.com, or call 0850 259 7883. |
|
Canva Pty Ltd |
The breach affected data associated with 424 organisations based in Türkiye. |
» Employee Data (employee names, business email address, workplace location, business phone number) » Business Documents (customer order forms, contracts, invoices, data protection agreements, master service agreements and other routine business correspondence, to the extent shared with the data controller) |
Not yet been determined. *Data subjects seeking further information about the incident may contact the data controller through its Help Centre (https://www.canva. com/en_au/help/contact-us/) or email address: privacy@canva.com. |
|
Data Controller ( and sector) |
Affected Data Subjects |
Affected Personal Data Categories |
Number of Data Subjects |
|
Locco Elektronik Mağazacılık ve Ticaret Ltd. Şti. |
Employees and Users |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials |
517,306 people. |
|
Tokgözler Civata Ticaret ve Pazarlama A.Ş. |
Customers |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » User Login Credentials (password) |
17,915 people |
|
Yeni Mağazacılık A.Ş. (“Eve Kozmetik”) |
Customers |
» Identity Data(name, surname), » Contact Data (email address, phone number) |
6,263,305 people Data subjects seeking further information about the incident may contact the data controller through its website: https://www. eveshop.com.tr/ or email address: kvkkbildirim@eveshop.com.tr. |
|
3H Tekstil Ürünleri Sanayi Ticaret Ltd. Şti. |
Users and Subscribers/ Members |
» Identity Data » Contact Data » Transaction Security Data |
85,722 people *Data subjects seeking further information about the incident may contact the data controller via email at info@micca.com.tr, through its registered electronic mail (KEP) address at 3htekstil@hs03.kep.tr, or by telephone at 0216 641 2671. |
|
Papara Menkul Değerler A.Ş. |
Users |
» Identity Data(name, surname), » Contact Data (address/of residence, email address, phone number) » Financial Data (investment profile, customer’s tax status as determined under FATCA rules) |
Not yet been determined. |
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.