The Regulation on Obtaining Informed Consent in Electronic Form ("Regulation"), prepared by the Ministry of Health ("Ministry"), was published in the Official Gazette dated October 27, 2026 and numbered 33413 and entered into force on the date of its publication.

The Regulation governs, where the informed consent required before a medical intervention is obtained in electronic form, the process relating thereto, the delivery of the consent form to the patient in a secure and accessible manner, and the recording of the consent.

The Geospatial Data Permits Regulation ("Regulation"), prepared by the Ministry of Environment, Urbanization and Climate Change ("Ministry"), was published in the Official Gazette dated October 14, 2026 and numbered 33400 and entered into force on the date of its publication.

The Regulation repealed the Geospatial Data Permits Regulation and the Geospatial Data Licence Regulation published in the Official Gazette dated February 10, 2021 and numbered 31391, thereby bringing the permit and licence regimes together in a single text. Licence and permit certificates previously issued remain valid until the end of the periods for which they were granted.

Principle Decision No. 2026/2035 of the Personal Data Protection Board ("Board"), dated September 16, 2026, titled "Principle Decision on the Procedures and Principles to Be Complied With in Personal Data Processing Activities Carried Out Through the Monitoring of Communication Channels Used for the Conduct of Business, Primarily Corporate E-Mail Accounts Allocated to Employees by Employers" ("Principle Decision"), was published in the Official Gazette dated October 8, 2026 and numbered 33394.

On October 1, 2026, the Personal Data Protection Authority ("Authority") published the "Public Announcement on the Notification Procedure for Responses to Be Given to Data Subject Requests." The announcement addresses an issue frequently encountered in practice and clarifies the procedure by which the response given to a data subject request must be notified.

The starting point of the announcement is the finding, established in the examinations conducted within the scope of the complaints submitted to the Authority, that certain data controllers respond to requests solely by oral methods. The Authority has clearly stated that such a practice is not accepted as a response complying with the legislation.