An Important Development On Data Protection Compliance!

İtalyan veri koruma otoritesi (Garante), 18 Haziran 2026 tarihli ve 476 sayılı kararı ile Piaggio & C. S.p.A.'ya, işten çıkarılan iki çalışanın kurumsal e-posta hesaplarına erişim ve bu verilerin uzun süre saklanması nedeniyle 460.000 avro idari para cezası uygulamıştır.

By its decision no. 476 of 18 June 2026, the Italian data protection authority (the "Garante") imposed an administrative fine of EUR 460,000 on Piaggio & C. S.p.A. for accessing the corporate email accounts of two dismissed employees and retaining that data for an extended period.

Dijital iletişim araçlarının iş hayatının temel unsurlarından biri haline gelmesiyle birlikte, işverenler tarafından çalışanlara tahsis edilen kurumsal e-posta hesaplarının, bilgisayarların ve diğer iletişim araçlarının kullanımının denetlenmesi ile çalışanların özel hayatın gizliliği ve haberleşme hürriyetine ilişkin haklarının korunması arasındaki dengenin sağlanması oldukça önemli bir konu haline gelmiştir.

As digital communication tools have become a fundamental part of professional life, striking a balance between monitoring of corporate email accounts, computers, and other communication tools assigned to employees by the employers and the protection of employees’ rights to privacy in their personal lives and freedom of communication has become a critical issue.

Turkey's Personal Data Protection Authority has issued a public announcement clarifying the scope and application of biometric data processing for employee attendance tracking, addressing questions about when such systems comply with data protection law. The announcement distinguishes between routine attendance monitoring and security-critical applications, establishing different standards for each context.

Teknolojik gelişmeler, bulut tabanlı hizmetlerin yaygınlaşması, şirketlerin uluslararası grup yapıları içerisinde faaliyet göstermesi ve iş süreçlerinde yurt dışında yerleşik hizmet sağlayıcılardan yararlanılması, kişisel verilerin yurt dışına aktarılmasını şirketlerin günlük faaliyetlerinin önemli bir parçası hâline getirmiştir.

Technological developments, the widespread use of cloud-based services, the operation of companies within multinational group structures and the increasing reliance on service providers located abroad have made cross-border transfers of personal data an integral part of companies’ day-to-day business activities.

Türk hukukunda kişisel verilerin korunması 6698 sayılı KVKK ile düzenlenirken, AB'de GDPR uygulanmaktadır. Her iki düzenleme de bireylerin mahremiyetini korumayı amaçlasa da kapsam...

Turkey's Constitutional Court has ruled that imposing administrative fines based on the undefined concept of 'purpose of disclosure' violates the principle of legality in criminal law.

The Constitutional Court, in its decision dated 27.01.2026 and numbered 2020/32193, published in the Official Gazette dated 16.06.2026, determined that the administrative fine imposed by the Personal Data Protection Board (the “Board”) on a data controller on grounds that the concept of the ‘purpose for which the data was made public’ is not regulated under the law and administrative fine imposed based on the relevant concept violates the principle of legality of offences and penalties (which also applies to misdemeanours).

The Turkish Court of Cassation's Grand General Assembly has issued a landmark decision establishing that lawsuits stemming from violations of non-compete obligations under the Turkish Code of Obligations fall within the jurisdiction of commercial courts of first instance. This precedent-setting ruling, published in the Official Gazette in September 2025, provides crucial clarity on the proper judicial forum for employers seeking to enforce restrictive covenants against former employees. The decision resolve

Turkey's Constitutional Court has upheld the Competition Board's authority to conduct on-site inspections at its discretion, marking a pivotal moment in defining the balance between administrative oversight powers and constitutional protections. The ruling addresses fundamental questions about the scope of regulatory inspection authority and its implications for businesses subject to competition law enforcement.

Presidential Decision No. 11066 introduces significant changes to the threshold values that determine which companies must undergo independent audits in Turkey. This regulatory update has important implications for corporate compliance and financial reporting requirements across various business sectors.

Significant changes to M&A transaction regulations have introduced increased turnover thresholds, clarified coordination analysis requirements for joint ventures, and refined technology undertaking exceptions. These amendments streamline the notification process with particular advantages for financial investors navigating merger control requirements.

A new amendment to Turkey's commercial books regulation has been published, introducing changes to the requirements for maintaining electronic records of business documents unrelated to enterprise accounting. The Amendment Communiqué modifies existing provisions governing digital record-keeping obligations for commercial entities.

Significant developments in law and technology emerged in February 2026, including a new Turkish Personal Data Protection Board principle decision, proposed digital copyright regulation for online platforms, pay transparency discussions, OECD guidance on artificial intelligence, and a DSA investigation concerning TikTok. This update provides insights on these developments alongside recent judicial decisions in labour law and personal data protection.

Turkey has initiated a comprehensive reform process to streamline licensing procedures in the energy and mining sectors through new omnibus legislation. The most significant change involves the centralization of permitting processes, fundamentally altering how licenses are obtained and managed. This legislative overhaul, enacted through Law No. 7554 and complemented by Law No. 7555, represents a major shift in regulatory framework affecting multiple industries.

The Presidential Decision amending the criteria for determining which companies are subject to independent audit under Article 397 of the Turkish Commercial Code (No. 6102)...

The Law No. 7499 on Amendments to the Code of Criminal Procedure and Various Laws ("Law No. 7499"), known in the public as the "8th Judicial Package", is published in the Official Gazette on March 12, 2024.

Climate Law No. 7552 entered into force after being published in the Official Gazette dated 9 July 2025. This information note summarises the main provisions of the Climate Law and its implementation mechanisms.