The Turkish Personal Data Protection Authority (KVKK), in its public announcement published on July 21, 2026, provided important guidance regarding the use of contact information obtained from third parties for advertising and marketing activities.

During its investigations, the Authority found that companies have been contacting prospective customers using telephone numbers, email addresses, and other contact information obtained from existing customers, business partners, referrals, or other third parties. However, it was observed that the obligations set forth under the Turkish Personal Data Protection Law (Law No. 6698) have not always been fulfilled in these processes.

The Personal Data Protection Board (the "Board") published its "Principle Decision on the Processing of Personal Data of Accident Victims" (Decision No. 2026/1095, dated May 20, 2026) in the Official Gazette on July 1, 2026.

Through its Principle Decision dated May 20, 2026 and numbered 2026/1095, the Board has clarified the principles and procedures applicable to the unlawful access to and processing of the personal data of accident victims by unauthorized persons.

With the Principle Decision on the Processing of Biometric Data for Attendance Tracking Purposes, dated April 29, 2026 and numbered 2026/291, published in the Official Gazette dated June 2, 2026 and numbered 33268 (the "Decision"), the Personal Data Protection Board emphasized that the increasing use of biometric identification systems (such as fingerprint, facial recognition, and iris/retina scanning) for the digitalization and security of employee attendance tracking must comply not only with a valid legal basis, but also with the principles of proportionality, necessity, and data minimization, given that biometric data constitutes special category personal data and possesses an irreversible nature.

As is known, the deadline for real and legal person data controllers processing personal data to fulfill their registration and notification obligation with the Data Controllers Registry ("VERBIS"), as stipulated under Article 16 of the Law on the Protection of Personal Data No. 6698, was set as December 31, 2021.