Amendments Introduced To The Regulation On Personal Health Data In Türkiye

December 2025 – On 3 December 2025, Türkiye's Ministry of Health published amendments to the Regulation on Personal Health Data (the "Regulation").

The Regulation governs the principles and procedures regarding the processing of and access to personal health data by the Ministry of Health, healthcare providers, and other relevant parties in line with Law No. 6698 on the Protection of Personal Data ("DP Law").

The amendments aim to (i) clarify the lawful grounds for accessing and processing personal health data, (ii) recalibrate access rights in specific factual scenarios, and (iii) further align the Regulation with Article 6(3) of the DP Law.

Below we provide an outline of the key changes introduced by the amendments.

What's New

Lawful processing grounds clarified: Under the previous version of the Regulation, access to past health data was framed under the necessity for delivery of healthcare services. The amendments replace this formulation by explicitly anchoring all processing, access, and disclosure of personal health data to the lawful processing conditions set out in Article 6(3) of the DP Law.

Attorneys' access to clients' health data: Article 10 of the Regulation, which previously regulated attorneys' access to their clients' health data, has been repealed. As a result, attorneys' access to such data will now be assessed under the general framework of the DP Law and relevant legislation.

e-Nabız security setting: Individuals may restrict access to their health data through e-Nabız (Turkish Personal Health Record System) security settings. Individuals must be informed of the scope and consequences of these settings, and the Ministry of Health is not liable for disruptions to healthcare services arising from restricted access to past health data.

To ensure continuity of healthcare services, the amendments introduce an SMS verification mechanism, enabling access to past health data upon entry of a verification code sent to the individual's registered phone number.

In exceptional circumstances, including detention or imprisonment, where verification codes cannot be received, access restrictions do not apply. In such cases, family physicians and treating physicians may access health data without any security preference check, provided that processing remains limited to Article 6(3) of the DP Law. Individuals may reconfigure security settings once such circumstances cease.

Introduction of the "caregiver" concept: The amendments introduce a new definition of "caregiver" covering a child's parent or legal guardian, as well as natural or legal persons authorised to assume responsibility for the care and supervision of a child. A new provision further permits caregivers to access the health data of individuals holding valid disability reports.

Access to children's health data in custody-related situations: The amendments introduce detailed rules governing access to children's health data in the context of divorce and custody disputes.

• During ongoing divorce proceedings, the parent granted temporary custody may access the child's health data.
• Following divorce, the parent holding custody retains access rights.
• A non-custodial parent does not have direct access; however, upon application to the General Directorate of the Ministry of Health and subject to approval, filtered health data may be shared. Such data excludes location, address, and contact information and is limited to information from which health-related conclusions may be drawn.

Changes Affecting Healthcare Professionals' Data Access

The amendments comprehensively restructure healthcare professionals' access to personal health data by classifying access rights based on both the role of the physician and the duration of the healthcare service.

• Family physicians may access their registered patients' health data without any time limitation, in line with the principle of continuity of preventive and primary healthcare services.
• Treating physicians providing outpatient services may access health data only for the duration necessary to complete the healthcare service directly related to the relevant appointment, including examination, testing, and follow-up procedures.
• Emergency department admissions allow broader but time-limited access: all physicians employed at the relevant healthcare facility may access health data strictly within the scope of the emergency case, until the patient is discharged.
• Inpatient treatment similarly enables physicians employed by the relevant healthcare provider to access health data up to the moment of the patient's discharge.

All such access remains subject to the processing conditions under Article 6(3) of the DP Law.

Conclusion

The amendments introduce detailed rules regarding access to and processing of personal health data including role-based and time-bound access mechanisms for healthcare personnel, procedures for e-Nabız security settings and verification, and revisions to provisions on data retention periods and third-party access.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.