The Turkish Personal Data Protection Board's Principle Decision No. 2026/1301, dated July 1, 2026, addresses the online publication of personal data by public legal entities acting as data controllers within the framework of the fundamental principles and legal bases for processing set out in the Personal Data Protection Law No. 6698 ("KVKK"). The Decision was published in the Official Gazette No. 33323 dated July 28, 2026.

The Turkish Personal Data Protection Authority (KVKK), in its public announcement published on July 21, 2026, provided important guidance regarding the use of contact information obtained from third parties for advertising and marketing activities.

During its investigations, the Authority found that companies have been contacting prospective customers using telephone numbers, email addresses, and other contact information obtained from existing customers, business partners, referrals, or other third parties. However, it was observed that the obligations set forth under the Turkish Personal Data Protection Law (Law No. 6698) have not always been fulfilled in these processes.

The Personal Data Protection Board (the "Board") published its "Principle Decision on the Processing of Personal Data of Accident Victims" (Decision No. 2026/1095, dated May 20, 2026) in the Official Gazette on July 1, 2026.

Through its Principle Decision dated May 20, 2026 and numbered 2026/1095, the Board has clarified the principles and procedures applicable to the unlawful access to and processing of the personal data of accident victims by unauthorized persons.

With the Principle Decision on the Processing of Biometric Data for Attendance Tracking Purposes, dated April 29, 2026 and numbered 2026/291, published in the Official Gazette dated June 2, 2026 and numbered 33268 (the "Decision"), the Personal Data Protection Board emphasized that the increasing use of biometric identification systems (such as fingerprint, facial recognition, and iris/retina scanning) for the digitalization and security of employee attendance tracking must comply not only with a valid legal basis, but also with the principles of proportionality, necessity, and data minimization, given that biometric data constitutes special category personal data and possesses an irreversible nature.