The Geospatial Data Permits Regulation Published: Permit Obligation and Data Protection Requirements

The Geospatial Data Permits Regulation ("Regulation"), prepared by the Ministry of Environment, Urbanization and Climate Change ("Ministry"), was published in the Official Gazette dated October 14, 2026 and numbered 33400 and entered into force on the date of its publication.

The Regulation repealed the Geospatial Data Permits Regulation and the Geospatial Data Licence Regulation published in the Official Gazette dated February 10, 2021 and numbered 31391, thereby bringing the permit and licence regimes together in a single text. Licence and permit certificates previously issued remain valid until the end of the periods for which they were granted.

In this article, we assess the framework introduced by the Regulation and the consequences of the arrangement for personal data protection and compliance processes.

The Basis of the Arrangement and the Framework of the Geospatial Data Regime

The Regulation is based on Article 1 of Law No. 7221 on the Amendment of the Law on Geographic Information Systems and Certain Laws and on Presidential Decree No. 49 on Geographic Information Systems.

At the centre of the regime lies the National Geospatial Data Responsibility Matrix. The Matrix sets out the geospatial data themes listed in the annex to Decree No. 49 together with the public institutions responsible for those themes. That list comprises thirty-two themes and includes headings such as addresses, buildings, cadastre, transport networks, hydrography, infrastructure, land use, population distribution, human health and safety, industrial facilities and orthoimagery.

The breadth of this scope shows that the arrangement is not a technical regime concerning especially mapping and engineering firms. However, it may be considered that companies producing address and building data, developing location-based applications, collecting location data through field teams, maintaining infrastructure inventories, or providing geospatial analysis services in logistics, insurance, retail and real estate should also assess whether their activities fall within the scope.

Who Is Obliged to Obtain a Permit?

Under the Regulation, real persons, private law legal entities and foreign real persons and legal entities are obliged to obtain a permit for their commercial activities directed at collecting, producing, sharing or selling the geospatial data within the scope of the Matrix.

For legal entities regarded as branches under the Turkish Commercial Code, the business centre obtains a single permit, and for those regarded as agencies, the business centre for which the agency acts obtains a single permit.

For geospatial data activities carried out for public institutions within the scope of a service procurement, the permit is obtained free of charge. However, where the data obtained as a result of such activity is made the subject of trade, sold or shared, the permit fee must be paid. Turkish citizen real persons and private law legal entities are also exempt from the fee in the year in which they commence commercial activity for the first time.

Legal entities holding an electricity or natural gas distribution licence are exempt from the permit obligation and from the fee in respect of the activities subject to their distribution licence, provided that they register with the Ministry's electronic infrastructure. It is expressly regulated that this exemption does not cover commercial uses falling outside the licensed activity.

The Scope of the Exemption Has Been Kept Narrow

The Regulation exempts only two situations from the permit obligation. These are the address information requested for the purpose of issuing invoices, and the sharing on the website or social media accounts of the address and location data of the company's own headquarters, branches and agencies.

The fact that the exemption has been kept this narrow is noteworthy. For example, the analysis of customer address data for purposes other than issuing invoices, its use in segmentation, or its sharing with third parties may not be assessed within the scope of the exemption. For this reason, it is important for companies to separate, on a purpose basis, the purposes for which they process address and location data.

The Documents Required in the Application and the Personal Data Protection Dimension

The most noteworthy aspect of the Regulation in terms of personal data protection concerns the documents required at the application stage.

In applications by legal entities, the name, surname, Turkish identity number, professional certificate, diploma and social security document of the personnel to be employed in the project, together with the make, model and plate information of the vehicles to be used, must be entered into the system. In addition, the criminal record certificate of the personnel to be employed must be uploaded to the system.

A criminal record constitutes data relating to criminal convictions and security measures under Article 6 of the Personal Data Protection Law No. 6698 ("Law") and is among the special categories of personal data. For this reason, requesting such data from the employee, processing it within the employer's organization and transferring it to the Ministry is subject to the regime applicable to special categories of personal data.

At this point, it may be considered that a careful assessment should be made as regards the legal ground. The Law lists exhaustively the processing conditions for special categories of personal data other than explicit consent and, for data relating to criminal convictions, requires that processing be expressly provided for in laws. As the obligation has been regulated at the level of a regulation, it would be appropriate for data controllers to assess this processing activity in the light of their own circumstances and to document the processing condition.

Within this scope, it is important for companies to update their employee privacy notices in relation to the processing of employee data for the geospatial data permit process, to add the transfer to the Ministry to their personal data processing inventory and VERBIS records, and to ensure that the criminal record is processed solely for the purposes of the permit process and, thereafter, subject to the period set out in the retention and destruction policy.

The Information Security Declaration and the Relationship with the Cybersecurity Law

Another document required in the application is a written declaration that the necessary measures have been taken to ensure the confidentiality, integrity, availability and security of the data subject to the activity and of the information systems in which those data are processed and stored.

That declaration constitutes an undertaking placing the applicant under administrative responsibility. It is important that the declaration does not remain a mere abstract sentence and that the information security policies, access controls, logging and backup processes underlying it are documented. The existence of a management system within the scope of ISO/IEC 27001 may facilitate such documentation.

As regards the geospatial data shared with the Ministry, the Regulation expressly refers to the Law and to the Cybersecurity Law No. 7545 and provides for the taking of measures aimed at the protection of personal data and at ensuring confidentiality and security. The geospatial data regime has thereby been linked directly to data protection and cybersecurity legislation.

Geospatial Data May Constitute Personal Data

"Geospatial data" and "personal data" are frequently treated as separate concepts. However, some of the themes within the scope of the Matrix contain data capable of being associated directly with individuals.

The address theme, the building theme and the population distribution theme stand out in this respect. Although it may be argued that an address does not in itself constitute personal data, it is considered that where the address is associated with an individual or, when combined with other data, renders their identity determinable, it will be subject to the personal data regime.

As location data enables detailed inferences to be drawn about individuals' daily movements and the places they visit, the approach of data protection authorities in this field is becoming stricter.

For this reason, it is important for companies obtaining a geospatial data permit to analyse separately whether the data sets subject to the permit contain personal data and, where they do, to manage the legal ground, the retention period and the transfer conditions for such data under a separate heading.

Actions to Be Taken by Companies

Following the Regulation, it is important for companies to review the following matters:

• Determining on a theme basis whether the activities carried out fall within the scope of the National Geospatial Data Responsibility Matrix. The address, building, transport networks and infrastructure themes should be examined first in this assessment.
• In companies holding an existing licence or permit certificate, determining the validity period of the certificate and planning to apply under the provisions of the new Regulation at the end of that period.
• Separating on a purpose basis the purposes for which address and location data are processed, and distinguishing the uses falling within the exemption from other uses.
• Analysing whether the data sets subject to the permit contain personal data and, where they do, determining the legal ground, the retention period and the transfer conditions.
• Updating employee privacy notices on account of the processing of personnel identity information and criminal records in the application, and adding the transfer to the Ministry to the personal data processing inventory and VERBIS records.
• Ensuring that the criminal record is processed solely for the purposes of the permit process and applying, once the process is completed, the period determined in the retention and destruction policy.
• Documenting the policies, procedures and technical measures underlying the information security declaration to be submitted in the application.
• Establishing an internal reminder mechanism to track the twelve-month period for the activity report and metadata recording obligations.
• Tracking the fifteen-day notification period for changes in the trade name, shareholders, responsible person, vehicles and personnel.
• Where geospatial data activities are carried out in Türkiye on behalf of foreign group companies, assessing the separate application and fee regime applicable to foreign persons.

Conclusion

The Regulation brings the permit and licence regimes together in a single text and subjects geospatial data activities to a more detailed framework of permits, reporting and inspection.

The arrangement has two aspects in terms of data protection. On the one hand, the geospatial data subject to the permit may contain personal data; on the other hand, the permit process itself requires the processing of data such as employees' identity information and criminal records. For this reason, it may be considered that the process should be addressed not merely as a technical or administrative permit process but also as a personal data processing activity.

You can access the details on this matter in the "Regulation on Geospatial Data Permits" published in the Official Gazette. (In Turkish)