Personal Data Protection Board Issues a Principle Decision on the Processing of Personal Data of Accident Victims

The Personal Data Protection Board (the "Board") published its "Principle Decision on the Processing of Personal Data of Accident Victims" (Decision No. 2026/1095, dated May 20, 2026) in the Official Gazette on July 1, 2026.

Through its Principle Decision dated May 20, 2026 and numbered 2026/1095, the Board has clarified the principles and procedures applicable to the unlawful access to and processing of the personal data of accident victims by unauthorized persons.

The Principle Decision states that the personal data processing activities of claims consultancy companies, insurance loss adjusters, loss adjustment firms, attorneys, and other relevant stakeholders must be carried out in accordance with the data processing conditions set forth under Law No. 6698 on the Protection of Personal Data ("Law No. 6698") and the applicable sector-specific legislation.

In addition, the Board emphasizes that data controllers are required, pursuant to Article 12 of Law No. 6698, to implement the necessary technical and administrative measures to ensure the security of personal data, restrict employees' access rights to the extent required by their duties, and establish appropriate organizational safeguards to prevent the unauthorized disclosure or transfer of personal data.

The Board further states that, where personal data are processed or transferred unlawfully, data subjects may exercise the application and complaint mechanisms available under Law No. 6698. It also notes that data controllers found to be acting contrary to the Principle Decision may be subject to administrative sanctions pursuant to Article 18 of Law No. 6698.

The Principle Decision entered into force upon its publication in the Official Gazette in accordance with Article 15(6) of Law No. 6698.

You may access the relevant announcement here. (In Turkish)