The Principle Decision titled "On the Requirement for Data Controllers to Prepare Explicit Consent Texts and Obligation to Inform Separately", issued by the Turkish Personal Data Protection Board ("Board") with decision number 2026/347 dated February 18, 2026, was published in the Official Gazette dated 24 March 2026 and numbered 33203, and has thereby entered into force.

With this Principle Decision and the accompanying public announcement, significant structural changes and compliance requirements have been introduced regarding the practices of data controllers in relation to their obligation to inform and explicit consent processes.

In the public announcement published by the Turkish Personal Data Protection Authority on 16 March 2026, clarifications were provided regarding the notification of personal data processing activities carried out within the scope of joint ventures, consortia, and ordinary partnerships to the Data Controllers' Registry (VERBIS), addressing uncertainties encountered in practice.

The announcement recalls the Decision of the Personal Data Protection Board dated June 9, 2021 and numbered 2021/569 (In Turkish), stating that joint ventures, consortia, and ordinary partnerships do not possess a separate legal personality; therefore, they cannot register with VERBIS in their own name.

Pursuant to duplicated Article 298 of Tax Procedure Law, the revaluation rate has been published in the Official Gazette numbered 33090 and dated November 27, 2025. Revaluation rate announced in the rate of 25.49% (twenty five comma forty nine) for 2026.

With the Turkish Personal Data Protection Board's ("Board") Principle Decision dated 10 June 2025 and numbered 2025/1072 ("Decision"), published in the Official Gazette dated 26 June 2025 and numbered 32938, the legal nature of sending verification codes via SMS within the scope of product and service delivery processes has been examined, and the corresponding data protection obligations have been clarified.