The Integrated Insurance Regulation and the Protection of Personal Data

"The Regulation on Integrated Insurance" ("Regulation"), prepared by the Insurance and Private Pension Regulation and Supervision Agency ("Agency"), and the "Regulation Amending the Regulation on Activities to Be Assessed within the Scope of Insurance and on Insurance Contracts Concluded at a Distance" ("Amending Regulation") were published together in the Official Gazette dated November 12, 2026 and numbered 33428 and entered into force on the date of their publication.

In this article, after briefly setting out the structure introduced by the two arrangements, we address the consequences of that structure for the protection of personal data.

The Two Arrangements Must Be Assessed Together

Integrated insurance is not a new subject in Turkish law. Article 10 of the Regulation on Activities to Be Assessed within the Scope of Insurance and on Insurance Contracts Concluded at a Distance, published in the Official Gazette dated June 16, 2021 and numbered 31513, governed the insurance offered in connection with the sale of goods and services.

The scope of that article was narrow. It was limited to the electronic device, machinery breakdown and theft insurance offered in connection with the sale of devices such as computers, tablets, mobile telephones and household appliances.

By the Amending Regulation that article was repealed and the subject was moved to a free-standing Regulation. The same Amending Regulation also simplified the purpose and scope articles of the Regulation dated 2021 and removed the persons and entities providing the commercial environment from the scope of that Regulation. For those entities, the arrangement is now contained in the new Regulation.

A further important consequence of the Amending Regulation concerns the fourth paragraph of Article 9. That paragraph prohibits, as a rule, the offering for sale of insurance products in electronic commerce environments in which goods and services are sold, other than the authorised institutions' own electronic commerce environments. The exception to that prohibition was previously the insurance under Article 10. By the amendment, the exception has been redefined as the insurance offered within the scope of the Regulation on Integrated Insurance. Integrated insurance therefore constitutes the exception to the general prohibition on the sale of insurance in electronic commerce environments belonging to third parties.

Brief Information on the Integrated Insurance Regulation

The Regulation was prepared on the basis of the Insurance Law No. 5684 and Articles 4 and 18 of Presidential Decree No. 47.

Article 4 of the Regulation defines "integrated insurance as insurance containing coverage offered to the purchaser, limited to risks directly connected with the good, the service or the financing thereof, in the physical or electronic environment in which the sale or lease of a good and the sale of a service take place".

The scope has expanded considerably by comparison with the repealed article. The arrangement now covers not only the sale of devices but the whole of the sale of goods and services, and includes, alongside coverage for damage to goods, coverage for pets, for travel, transport, accommodation, event, subscription, bill payment and cyber security services, for shared and short-term vehicle rental, for residence permit and visa insurance, and for the insurance offered by banks in connection with individual loans.

As regards the persons covered, the matter standing out is that the arrangement covers not only insurance companies, pension companies, insurance intermediaries and banks holding agency authorisation, but also the persons and entities providing the commercial environment for integrated insurance. It is considered that electronic commerce platforms, retailers, vehicle rental companies, subscription service providers and those offering travel and accommodation services may be assessed within that scope, to the extent that they enable insurance to be offered in their own sales environments.

The Regulation further lists, in twelve items, the insurance that may not be offered, introduces a ceiling on the annual gross premium by reference to the minimum wage, limits the coverage period to a maximum of two years, and lays down two important prohibitions concerning sales. Under Article 8 of the Regulation, the purchase of insurance may not be made a condition of the purchase of the good or the service, and the failure to purchase insurance may not constitute a ground for differentiating the sales conditions to the detriment of the purchaser.

The following sections assess the consequences of that structure for the protection of personal data:

The Three-Party Structure and the Determination of Data Controller Status

As a rule, there are three parties to an integrated insurance sale. The insurance company or the pension company providing the coverage that bears the risk, the intermediary or bank defined in the Regulation as the authorised institution, and the undertaking providing the commercial environment in which the sale takes place.

The Regulation contains no provision as to the capacity in which those parties are to act under the Personal Data Protection Law No. 6698 ("Law"). That capacity must therefore be determined separately for each concrete structure within the framework of the definitions in Article 3 of the Law.

It may be considered that, as regards the insurance relationship, the party determining the purposes and means of the processing is the insurance company, and that the insurance company accordingly holds data controller status. The position of the undertaking providing the commercial environment will not, however, be the same in every case. Where the undertaking transfers data solely on the instruction of the insurance company and for the purposes determined by it, it may be in the position of a data processor. Where it also uses, for its own purposes, the data obtained within its own customer relationship, its assessment as a separate data controller or as a joint data controller in the same activity may arise.

If that determination is not made, it will remain unclear by whom the obligation to inform is to be fulfilled, to whom data subject applications are to be addressed and by whom a data breach notification is to be made. As Article 12 of the Law provides that the data controller and the data processor are jointly responsible for the obligations relating to data security, the uncertainty gives rise to risk for all parties. It is therefore important that the allocation of roles be expressly set out in the agreement between the parties.

Contractual Consent and Explicit Consent Are Not the Same

The third paragraph of Article 9 of the Regulation requires the insurance company or the pension company providing the coverage to inform the policyholder before the conclusion of the contract and to obtain their consent by a secure method enabling the verification of their identity and the determination or recording of their declaration.

The consent in question is a declaration of intent directed at the conclusion of the insurance contract. It is not the same institution as the explicit consent under Article 5 of the Law. In the processing of personal data necessary for the conclusion and performance of an insurance contract, the legal ground is, as a rule, the condition relating to the conclusion or performance of a contract. For this reason, it may be considered that no separate explicit consent is required in respect of the data necessary for the conclusion of the contract.

Combining the two institutions in a single consent box is an error frequently encountered in practice. In that case an impression arises that the withdrawal of the policyholder's consent also removes the legal ground for the processing, and the requirement that explicit consent relate to a specific matter and be given by free will is undermined. It would be appropriate for the contractual consent, the privacy notice and any explicit consent declaration to be presented separately.

Where Health Data Is Processed, the Legal Grounds Narrow

Some of the insurance that may be offered within the scope of Article 5 of the Regulation may be such as to require the processing of health data. The insurance required to be submitted in applications for residence permits and visas, and the life and personal accident insurance offered by banks in connection with individual loans, may be assessed within that scope.

Health data constitutes a special category of personal data under Article 6 of the Law. That article contains no separate processing condition specific to the conduct of insurance activities. Although the conditions listed in the article include the protection of public health and the conduct of medical diagnosis, treatment and care services, that condition is laid down for persons under an obligation of secrecy or for authorised institutions and organisations. It appears difficult to assess a health declaration taken during an insurance sale within that scope.

For this reason, it may be considered that in integrated insurance requiring the processing of health data the legal ground will, as a rule, be explicit consent. Whether that explicit consent may be regarded as given by free will depends on the purchase of the insurance not being made compulsory. The prohibitions on tied sales and on price differentiation in Article 8 of the Regulation are supportive in that respect. The sales flow must nevertheless be designed so that the process can continue without interruption where consent is not given.

In addition, under Article 6 of the Law it is mandatory to take the adequate measures determined by the Board in the processing of special categories of personal data. The measures listed in the Board's decision dated January 31, 2018 and numbered 2018/10 include the existence of a separate policy and procedure, the restriction of access rights, the storage of data in electronic environments by cryptographic methods and the regular keeping of access records.

Placing the Privacy Notice within the Sales Flow

The distinguishing feature of integrated insurance is that the sale is appended to the sale of the principal good or service and is, in most cases, completed within seconds on a mobile screen. That gives rise to a practical difficulty in terms of the obligation to inform.

Under Article 10 of the Law, the information must be provided at the time the personal data is obtained. The Communiqué on the Procedures and Principles to Be Complied With in Fulfilling the Obligation to Inform requires the information to be provided in clear, comprehensible and plain language.

The third paragraph of Article 8 of the Regulation provides for the information relating to the insurance to be presented by means of visuals placed where they can easily be seen in the physical environment, and by means of a link in the electronic commerce environment. That structure lends itself to the use of a layered privacy notice. Presenting summary information on the sales screen and the full text through a link may be considered. By which party the privacy notice is to be presented will be determined according to the allocation of roles referred to above.

Data Minimisation and Transfers Between the Parties

The undertaking providing the commercial environment holds a broad data set relating to its customer by reason of the principal sales relationship. Transferring that entire set to the insurance company during the offering of insurance may not be compatible with the principles in Article 4 of the Law.

That article lays down the principle that personal data be relevant, limited and proportionate to the purposes for which they are processed. It may therefore be recommended that the data items to be transferred be limited to those necessary for the conclusion of the insurance contract and the assessment of the risk, and that the items transferred be listed individually in the agreement between the parties.

Where the undertaking providing the commercial environment or the infrastructure provider used is located abroad, the regime on transfers abroad will have to be assessed separately. In that case the establishment of an appropriate transfer mechanism within the framework of the provisions of the Law on transfers abroad will arise.

Transaction Records, the Durable Medium and Data Security

Article 12 of the Regulation holds the authorised institutions responsible for ensuring the security of the information systems and integrations used in offering integrated insurance and for keeping transaction records.

It should not be overlooked that those records contain personal data. The information as to who purchased which coverage on which date, how identity verification was carried out and by which method consent was obtained is capable of being associated with the data subject. Accordingly, transaction records should also be included in the personal data processing inventory, their retention period determined and access rights restricted.

The definition of durable medium in Article 4 of the Regulation covers short messages, electronic mail, the internet, disks, CDs, DVDs and memory cards, as well as structures to be established through the Insurance Information and Monitoring Centre or e-Devlet. Where the policy is delivered by one of those means, the security level of the chosen means becomes important. Sending a policy containing health data by unencrypted electronic mail may give rise to a problem in terms of the data security obligation under Article 12 of the Law.

Termination of the Contract, Retention and Destruction

The fourth paragraph of Article 10 of the Regulation provides that, where the right of withdrawal, termination, cancellation or rescission is exercised in the contract relating to the good or service that is the subject of the integrated insurance, the insurance contract terminates automatically.

That provision gives rise to two consequences in terms of the protection of personal data. First, the information that the principal contract has terminated must reach the insurance company from the undertaking providing the commercial environment. That is a separate data flow which must be planned. Secondly, upon the termination of the contract, Article 7 of the Law and the provisions of the Regulation on the Deletion, Destruction or Anonymization of Personal Data will apply in respect of the data items for which the purpose of processing has ceased.

The retention periods arising from insurance legislation must be assessed together with the obligation of destruction. Where the data that must be retained is not separated from the data whose purpose has ceased, non-compliance may arise in both directions.

Use for Marketing Purposes

The subsequent use for marketing purposes of data obtained during an integrated insurance sale is a separate processing activity. The condition relating to the conclusion and performance of the insurance contract does not cover that purpose.

Separate explicit consent, given by free will, must therefore be obtained for use for marketing purposes. Where commercial electronic messages are to be sent, the obligations under the Law No. 6563 on the Regulation of Electronic Commerce and those relating to the Message Management System will also have to be assessed separately.

In practice, the insurance consent and the marketing consent are frequently obtained on the same screen and by a single tick. It may be considered that this method may not be compatible with the conditions for the validity of explicit consent.

Actions to Be Taken

It is important for undertakings offering integrated insurance or providing the sales environment to review the following matters:

• Determining, on the basis of the concrete structure, which of the capacities of data controller, joint data controller or data processor each party to the sales flow holds, and setting this out in the agreement between the parties.
• Deciding by which party, at which stage and by which method the obligation to inform is to be fulfilled, and establishing a layered privacy notice structure.
• Presenting the consent relating to the conclusion of the insurance contract and the explicit consent declaration separately, and not combining them in a single consent box.
• Determining whether health data is processed and, if so, determining the legal ground and, where reliance is placed on explicit consent, ensuring that the sales flow can continue without interruption where consent is not given.
• Where special categories of personal data are processed, applying and documenting the adequate measures listed in the Board decision numbered 2018/10.
• Identifying individually the data items to be transferred between the parties and limiting them to those necessary for the conclusion of the insurance contract.
• Establishing a transfer mechanism for transfers abroad where infrastructure or a platform located abroad is used.
• Entering identity verification records, consent records and transaction records into the personal data processing inventory and VERBIS records and determining their retention periods.
• Assessing the durable medium through which the policy is to be delivered in terms of its security level and applying additional protection to documents containing health data.
• Structuring the flow of information relating to the automatic termination of the insurance contract upon the termination of the principal contract, and defining the destruction process that follows.
• Obtaining separate explicit consent for use for marketing purposes and ensuring compliance with the legislation on commercial electronic messages.
• Determining by agreement who is to make the notification in the event of a data breach within the three-party structure, and the period for informing the other parties.

Conclusion

While the Regulation introduces a comprehensive framework in terms of insurance legislation, it addresses the protection of personal data only indirectly. Obligations such as identity verification, the recording of consent, the keeping of transaction records and the delivery of the policy by means of a durable medium have been laid down, but the position of those activities under the Law has not been regulated.

That gap must be filled by the agreements between the parties. In particular, for undertakings that do not conduct insurance activities but fall within the scope because they provide the commercial environment, it may become necessary to extend the existing compliance structure so as to cover insurance processes.

You can access further details on this matter in the "Integrated Insurance Regulation" and "Regulation Amending the Regulation on Activities to Be Assessed within the Scope of Insurance and on Insurance Contracts Concluded at a Distance" published in the Official Gazette. (In Turkish)