Turkey: Privacy Protection

The Italian Data Protection Authority (“Garante”) imposed a €180,000 fine on Emirates following its investigation into the airline’s processing of passengers’ health data through its Medical Information for Fitness to Travel (“MEDIF”) process. While the authority confirmed that processing health data for the purpose of providing safe travel and special assistance was lawful and did not require consent, it found that Emirates failed to provide passengers with clear and comprehensive privacy information regarding the processing activities.

Turkey's data protection landscape in 2025 saw significant regulatory developments through the Personal Data Protection Authority's guidance documents, principle decisions, and enforcement actions. How did artificial intelligence regulation, cross-border data transfers, and cybersecurity legislation reshape compliance obligations for data controllers operating in Turkey?

Turkey's Personal Data Protection Authority has intensified its regulatory oversight in 2025-2026, imposing significant fines while establishing new frameworks for artificial intelligence, data breach notifications, and cross-border data transfers. How are these evolving compliance requirements reshaping data protection practices for organizations operating in Turkey's increasingly regulated digital landscape?

The European Union’s (“EU”) Artificial Intelligence Act No. 2024/1689 (Regulation (EU) 2024/1689) was published in the Official Journal of the European Union on 12 July 2024.

The use of biometric recognition systems has become widespread across workplaces, gyms, public institutions and digital services, yet data protection authorities worldwide are increasingly scrutinizing whether such systems are truly necessary or if less intrusive alternatives could achieve the same objectives. Turkey's Personal Data Protection Board has now issued a landmark principle decision that fundamentally challenges employers' reliance on fingerprint and facial recognition systems for time and attend

May saw several significant developments in Türkiye across the areas of data protection, artificial intelligence, cybersecurity, and digital regulation. Notable updates included the Turkish DPA's approval of Binding Corporate Rules for international data transfers...

The information document titled “QR Kodlarla Gelen Risk: Quishing” published by the Personal Data Protection Authority (“Authority”) examines the concept of quishing, defined as a type of phishing...

Sosyal medya, bireylerin düşüncelerini açıklama, haber alma ve kamusal tartışmalara katılma imkânını önemli ölçüde genişletmiştir. Ancak bu genişleme, kişilerin şeref ve itibarı, özel hayatı, görsel verileri, kişisel verileri ve sosyal çevre içindeki saygınlığı bakımından yeni ihlal alanları da yaratmıştır. Türk hukukunda sosyal medya paylaşımları yoluyla kişilik haklarının ihlali, tek bir normla değil; Anayasa, Türk Medeni Kanunu, Türk Borçlar Kanunu, Türk Ceza Kanunu, 5651 sayılı Kanun ve 6698 sayılı Kişisel Verilerin Korunması Kanunu hükümlerinin birlikte değerlendirilmesiyle çözümlenmektedir. Anayasa’nın 20.

Social media has significantly expanded individuals’ ability to express their opinions, access information, and participate in public debate. However, this expansion has also created new areas of infringement with respect to individuals’ honor and reputation, private life, visual data, personal data, and social standing. Under Turkish law, the violation of personal rights through social media posts is not resolved through a single legal norm; rather, it is assessed through the combined application of the Constitution, the Turkish Civil Code, the Turkish Code of Obligations, the Turkish Penal Code, Law No. 5651, and Law No. 6698 on the Protection of Personal Data.