Turkey: Privacy

Under the Law, the Board has the authority to impose administrative sanctions. It is stipulated that the Board may impose administrative fines for failure to comply with the duty to provide information...

Kanun’un 16. maddesi uyarınca, belirlenen eşikleri aşan Türkiye’de mukim veri sorumluları ve yurt dışına mukim olan ve Türkiye’de veri sorumlusu olarak kişisel veri işleyen veri sorumluları için herhangi bir eşik...

Türkiye'de yapay zeka düzenlemelerinin gelişimi ve Kişisel Verileri Koruma Kurumu'nun yayınladığı Üretken Yapay Zeka Rehberi, veri koruma hukuku çerçevesinde yapay zeka sistemlerinin nasıl ele alınması gerektiğini ortaya koyuyor. Avrupa Birliği'nin AI Act düzenlemesine paralel olarak, Türkiye'nin de risk temelli ve insan odaklı bir yapay zeka mevzuatı oluşturma yönündeki adımları de&#

The DPA published a public announcement regarding the Board’s Principle Decision dated 29 April 2026 and numbered 2026/921, concerning the processing of biometric data for tracking employee working hours.

The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities.

Turkey's data protection landscape in 2025 saw significant regulatory developments through the Personal Data Protection Authority's guidance documents, principle decisions, and enforcement actions. How did artificial intelligence regulation, cross-border data transfers, and cybersecurity legislation reshape compliance obligations for data controllers operating in Turkey?