The Court of Justice of the European Union (CJEU), in its judgment dated March 19, 2026 in Case C-526/24 (Brillen Rottler) ("Decision"), has established an important precedent regarding the limits of data subject rights under the GDPR. The Decision clarifies under which conditions the right of access under Article 15 GDPR may be restricted within the framework of Article 12(5) GDPR, while also reassessing the scope of the right to compensation under Article 82 GDPR.

The European Data Protection Board (EDPB) has published a comprehensive report under the 2025 Coordinated Enforcement Framework (CEF), examining how the right to erasure, as regulated under Article 17 of the GDPR, is implemented across Europe. Within the scope of this study, 764 controllers were assessed through investigations conducted by 32 data protection authorities, and the structural challenges encountered in the implementation of the right to erasure, as well as examples of good practices, were identified.

Leave management is a critical human resources function that encompasses the entitlement, accrual, request, approval, recording, and reporting processes of employee absences such as annual leave, personal leave, sick leave, maternity leave, and unpaid leave within an organization. In many institutions, this process is often perceived as an “operational” task. However, in practice, leave management directly affects areas such as labor law compliance, payroll accuracy, consistency of social security (SSI) notifications, and the management of incentive-related risks.

The Personal Data Protection Board's (Kişisel Verileri Koruma Kurulu) Principle Decision No. 2026/266 (In Turkish), published in the Official Gazette dated February 28, 2026 and numbered 33182, has significantly clarified both the legal nature of loyalty card programmes and the obligations incumbent on data controllers.

QR code technology has become one of the key tools of the digital economy. From restaurant menus to public services, from e-commerce to financial transactions, QR codes are used across a wide range of contexts and—because they are fast and practical—have become a natural part of user behaviour. However, this widespread adoption also creates an exploitation ground with a low level of suspicion from the attacker’s perspective.

In its Information Note dated 26 February 2026 titled “The Risk Coming with QR Codes: Quishing” (“Information Note”), the Turkish Data Protection Authority (“KVKK”) examines phishing attacks carried out via QR codes in detail and assesses this threat from a personal data security perspective. The Information Note clearly demonstrates that the issue is not merely a technical cybersecurity risk; it is also an area that must be addressed directly within the scope of data protection law.

Recruitment processes have become one of the areas most rapidly transformed by digitalization. Today, many organizations rely on artificial intelligence–enabled systems in candidate screening and evaluation stages. CV-screening algorithms, video interview analytics tools, and automated scoring mechanisms increasingly shape decisions such as shortlisting, interview invitations, and candidate rejection through data-driven models.

When employees obtain a medical report due to illness, an occupational accident, or maternity, this situation affects not only human resources processes, but also SSI notification obligations, payroll calculations, and the temporary incapacity benefit process directly.

In Türkiye, the social security system aims to provide protection against risks that every employee may encounter throughout their lifetime. (such as illness, unemployment, old age, disability, death, etc.)

The institutional framework of this system is established under Law No. 5502 on the Social Security Institution (SSI) and Law No. 5510 on Social Insurance and General Health Insurance, and as of 2004, the former systems of the Social Insurance Institution (SSK), the Social Security Organization for Artisans and the Self-Employed (BAĞ-KUR), and the Pension Fund were consolidated under a single institutional structure.

Administrative monetary penalties imposed by the Social Security Institution (SSI) are not merely "fees for late notifications." In many cases, they trigger a chain of consequences such as the loss of incentive eligibility, increased inspection intensity, disruption of labour cost models, and even the escalation of legal disputes. For this reason, instead of an approach based on "paying the fine and closing the matter," businesses that understand which obligation has transformed into a penalty based on which legal or evidentiary grounds, and that plan their processes accordingly, will be in a far more advantageous position.