Principle Decision No. 2026/2035 of the Personal Data Protection Board ("Board"), dated September 16, 2026, titled "Principle Decision on the Procedures and Principles to Be Complied With in Personal Data Processing Activities Carried Out Through the Monitoring of Communication Channels Used for the Conduct of Business, Primarily Corporate E-Mail Accounts Allocated to Employees by Employers" ("Principle Decision"), was published in the Official Gazette dated October 8, 2026 and numbered 33394.

On October 1, 2026, the Personal Data Protection Authority ("Authority") published the "Public Announcement on the Notification Procedure for Responses to Be Given to Data Subject Requests." The announcement addresses an issue frequently encountered in practice and clarifies the procedure by which the response given to a data subject request must be notified.

The starting point of the announcement is the finding, established in the examinations conducted within the scope of the complaints submitted to the Authority, that certain data controllers respond to requests solely by oral methods. The Authority has clearly stated that such a practice is not accepted as a response complying with the legislation.

Principle Decision No. 2026/921 of the Personal Data Protection Board ("Board") dated April 29, 2026 on the Processing of Biometric Data for Attendance Tracking Purposes ("Principle Decision") was published in the Official Gazette dated June 2, 2026. Following the publication of the Principle Decision, various requests for opinion were submitted to the Personal Data Protection Authority ("Authority") by data controllers operating in different sectors, and these requests gave rise to the need to clarify certain matters.

By way of the public announcement published on August 27, 2026, the Authority resolved these uncertainties and clarified the scope of application of the Principle Decision.

With the publication of the Presidential Circular No. 2026/9 dated August 17, 2026, in the Official Gazette No. 33344 dated August 18, 2026, the Türkiye Artificial Intelligence Action Plan (2026–2030) has entered its implementation phase.

In its current form, the Action Plan does not impose any direct and general binding obligations on the private sector. However, the new legal and technical framework envisaged by the Plan is expected to result in concrete compliance implications for companies in the subsequent stages.