The Personal Data Protection Board's ("Board") Principle Decision dated February 10, 2026 and numbered 2026/266 regarding the processing of personal data within the scope of loyalty programs was published in the Official Gazette dated February 28, 2026 and numbered 33182. The six-month compliance period granted to data controllers under the Principle Decision for the purpose of implementing the necessary technical and organizational measures will be expired on February 28, 2026.

However, this period has been extended until February 28, 2027 by the decision of the Board published in the Official Gazette dated August 13, 2026 and numbered 33339.

The Turkish Personal Data Protection Board's Principle Decision No. 2026/1301, dated July 1, 2026, addresses the online publication of personal data by public legal entities acting as data controllers within the framework of the fundamental principles and legal bases for processing set out in the Personal Data Protection Law No. 6698 ("KVKK"). The Decision was published in the Official Gazette No. 33323 dated July 28, 2026.

The Turkish Personal Data Protection Authority (KVKK), in its public announcement published on July 21, 2026, provided important guidance regarding the use of contact information obtained from third parties for advertising and marketing activities.

During its investigations, the Authority found that companies have been contacting prospective customers using telephone numbers, email addresses, and other contact information obtained from existing customers, business partners, referrals, or other third parties. However, it was observed that the obligations set forth under the Turkish Personal Data Protection Law (Law No. 6698) have not always been fulfilled in these processes.

The Personal Data Protection Board (the "Board") published its "Principle Decision on the Processing of Personal Data of Accident Victims" (Decision No. 2026/1095, dated May 20, 2026) in the Official Gazette on July 1, 2026.

Through its Principle Decision dated May 20, 2026 and numbered 2026/1095, the Board has clarified the principles and procedures applicable to the unlawful access to and processing of the personal data of accident victims by unauthorized persons.