New KVKK Agenda for Public Institutions: Principle Decision No. 2026/1301 on the Online Publication of Personal Data

The Turkish Personal Data Protection Board's Principle Decision No. 2026/1301, dated July 1, 2026, addresses the online publication of personal data by public legal entities acting as data controllers within the framework of the fundamental principles and legal bases for processing set out in the Personal Data Protection Law No. 6698 ("KVKK"). The Decision was published in the Official Gazette No. 33323 dated July 28, 2026.

1. Publishing Personal Data Online Constitutes "Personal Data Processing"

One of the most significant aspects of the Board's approach is its recognition that publishing a document containing personal data on a website should not merely be regarded as a form of public announcement or information sharing. Making personal data contained in a document available to third parties through the internet constitutes the processing of personal data within the meaning of the KVKK.

Accordingly, public institutions should conduct a personal data protection assessment before publishing online content such as:

• Personnel lists,
• Examination and application results,
• Lottery or draw results,
• Documents relating to tender or evaluation procedures,
• Lists of students or applicants,
• Decisions of various boards and commissions and
• Information concerning individuals benefiting from social assistance or public services.

2. Being a Public Institution Does Not Automatically Authorize Online Publication

One of the Decision's key practical implications is that acting in the performance of a public duty does not, by itself, justify making all personal data publicly available on the internet.

The Board emphasizes that the online disclosure of personal data must first be based on one of the legal grounds for processing set out in Article 5 of the KVKK, or, where special categories of personal data are concerned, one of the conditions provided under Article 6. In the absence of a valid legal basis, the data should not be published. However, the analysis does not end there.

"Even where a valid legal basis exists, this does not mean that personal data may be published without limitation." Public bodies must also comply with the general principles governing personal data processing set out in Article 4 of the KVKK.

3. The Key Test: Relevance, Necessity and Proportionality

Perhaps the most important practical message of the Decision for public institutions concerns the principle of proportionality.

The mere fact that a public institution requires certain personal data to carry out an administrative procedure does not automatically justify making that information publicly accessible on its website.

For example, where examination results need to be announced, publishing a candidate's:

• Turkish Republic identity number,
• Full residential address,
• Telephone number,
• Place of birth,
• Public Personnel Selection Examination (KPSS) score and
• Educational background

in the same announcement would require separate justification.

According to the Board, only the minimum amount of personal data necessary to achieve the intended purpose should be published online. Information that is not required should not be disclosed, and where appropriate, techniques such as masking or anonymisation should be used.

The Board's approach may therefore be summarised as follows:

Before asking "Can we publish this information?", public institutions should first ask "Is it truly necessary to publish all of this personal data?"

4. Is the Era of Publishing Comprehensive Examination Result Lists Coming to an End?

The Decision also has significant practical implications for the publication of examination results, lottery outcomes, and similar announcements.

While the Board notes that each case should be assessed on its own merits, it recommends, wherever possible, the use of secure systems that allow individuals to access only their own results.

Examples include:

• Individual result inquiries through the e-Government Gateway (e-Devlet),
• User authentication mechanisms,
• Two-factor authentication and
• Personalised result portals.

This approach seeks to strike a better balance between the public interest in announcing results and the protection of individuals' personal data.

5. Retention Periods for Online Publications Are Also a Compliance Issue

The lawful publication of personal data does not mean that such information may remain available on a website indefinitely.

The Board reiterates the principle that personal data should be retained only for the period prescribed by applicable legislation or for as long as necessary for the purposes for which it is processed. Accordingly, public institutions should review not only future publications but also documents uploaded to their websites in previous years.

Once the relevant retention period expires, institutions should assess, depending on the circumstances, whether the data should be:

• Removed,
• Erased,
• Destroyed or
• Anonymised.

6. Website Administrators Are Also Part of the KVKK Compliance Framework

Another noteworthy aspect of the Decision is its recognition that personal data protection is not solely the responsibility of legal or human resources departments.

The Board highlights the importance of providing regular training and awareness programmes for employees responsible for managing institutional websites and social media accounts, as well as other relevant personnel.

Accordingly, introducing a KVKK compliance review as part of the internal publication approval process would constitute an important organisational safeguard.

You may access the relevant announcement here. (In Turkish)