Compliance Perıod For Loyalty Card Practices Extended Until 28 February 2027

The compliance period prescribed for data controllers in relation to loyalty card practices has been extended until 28 February 2027 pursuant to the Decision of the Personal Data Protection Board (the “Board”) dated 22 July 2026 and numbered 2026/1491 (the “Decision”), published in the Official Gazette dated 13 August 2026 and numbered 33339.

The Decision concerns the 6-month compliance period granted to data controllers under the Board’s Principle Decision dated 11 February 2026 and numbered 2026/266 on the “Use of the Mobile Phone Number or Loyalty Card Number of a Loyalty Card Member by a Third Party During a Purchase” (the “Principle Decision”).

The Principle Decision required data controllers to establish appropriate mechanisms to verify that, where the mobile phone number or loyalty card number of a loyalty card member is used by a third party during a purchase, the transaction is carried out with the knowledge and approval of the relevant data subject.