Breaking News: Update On Administrative Fine Amounts For 2024 Unveiled For Non-Compliance With Data Protection Law

In January 2026, the Turkish Personal Data Protection Authority (the "DPA") issued several public announcements and published six data breach notifications.

6698 sayılı Kişisel Verilerin Korunması Kanunu’nun (“KVKK”) 9 uncu maddesi kapsamında kişisel verilerin yurtdışına aktarımlarının uygulanması ile Kişisel Verileri Koruma Kurulu’nun (“Kurul”) beklediği uygun güvenceler hakkında kamuoyunun aydınlatılması amacıyla Kişisel Verileri Koruma Kurumu (“Kurum”) tarafından 2 Ocak 2025 tarihinde Kişisel Verilerin Yurt Dışına Aktarılması Rehberi (“Rehber”) yayımlanmıştır.

Pursuant to Article 3 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), personal data is defined as any information relating to an identified or identifiable natural person. Although the concept is expressed in these terms under Turkish law, different legal systems adopt different approaches.

This article examines the protection of minors in digital services through a comparative legal analysis directed at foreign platforms and families. It distinguishes access restrictions, age assurance, parental authority, personal-data processing and routes of challenge.

Technological developments, the widespread use of cloud-based services, the operation of companies within multinational group structures and the increasing reliance on service providers located abroad have made cross-border transfers of personal data an integral part of companies’ day-to-day business activities.

On July 10, 2023, the European Union ("EU")-United States of America ("US") adequacy decision for adequate level of protection regarding the transfer of personal data under the EU-US Data Privacy Framework ("DPF") was formally adopted by the European Commission.

This comprehensive report examines the evolving landscape of personal data protection in Türkiye, analyzing regulatory developments, enforcement trends, and emerging compliance challenges through 2025 and into the first half of 2026. The analysis covers the Turkish Personal Data Protection Authority's expanding guidance framework, significant enforcement actions totaling TRY 352.5 million in fines, and critical regulatory shifts including new cybersecurity legislation and constitutional court decisions

As of November 14, 2023, five data breach notifications were published on the website of the Personal Data Protection Authority ("Authority").

Kişisel Verileri Koruma Kanunu'nun ("Kanun") "Kişisel verilerin yurt dışına aktarılması" başlıklı 9. maddesinin uygulanmasına yönelik usul ve esasların belirlenmesi amacıyla 10 Temmuz 2024 tarihinde "Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik" ("Yönetmelik")[1] Resmî Gazete'de yayımlanarak yürürlüğe girmiştir

Türkiye'de kişisel verilerin yurt dışına aktarılması süreci, 10 Temmuz 2024'te yayımlanan yönetmelik ve 2026 yılı itibarıyla tam kapasite çalışan dijital bildirim...

SPK, halka açık olmayan ortaklıkların halka arz başvurularını ilan edilen sıradan bağımsız olarak önceliklendirmek üzere üç alternatif kriter belirledi

Borsa Istanbul’s BIST 100 index came under significant selling pressure over three consecutive trading sessions between 15-17 September 2026. The index closed down 5.54% on 16 September, a move that triggered Borsa Istanbul’s index-linked circuit breaker, and negative momentum continued into the morning of 17 September. The sell-off was primarily triggered by a default at Pusula Portföy Yönetimi A.Ş., a portfolio management company, which failed to meet investor redemption requests from certain funds it manages in a timely manner. A similar liquidity problem emerged at Tera Portföy Yönetimi A.Ş., and this situation put pronounced pressure on the shares of both companies as well as on broader market indices.

The Capital Markets Board of Türkiye (“CMB” or the “Board”), through its principle decision No. i-SPK.15.2 (dated 03.09.2026 and numbered 54/1614) (“Resolution”), has lowered to 3% the minimum shareholding disclosure threshold under the Material Events Disclosure Commu-niqué No. II-15.1 (“Communiqué”). The Reso-lution will apply as from the end of the day on 11.09.2026.

With its decision No. 57/1708 dated 17.09.2026, the Capital Markets Board (the “CMB”) set out the liquidation procedures for the 131 investment funds established by Tera, A1 Capital, Atlas, Bulls, Hedef, Pardus and Pusula Portföy Yönetimi, whose liquidation had been ordered under its previous decision, and updated the relevant list of funds in the same decision.

Türkiye Emisyon Ticaret Sistemi Yönetmeliği (“Yönetmelik”), 27 Ağustos 2026 tarihli ve 33353 sayılı Resmî Gazete’de yayımlanarak aynı tarihte yürürlüğe girmiştir. Yönetmelik ile 7552 sayılı İklim Kanunu (“İklim Kanunu”) uyarınca Türkiye Emisyon Ticaret Sistemi’nin (“ETS”) kapsamı sera gazı emisyon izni, izleme, raporlama ve doğrulama, tahsisatlandırma ve piyasa işleyişine ilişkin temel kuralları düzenlemektedir.

On 16 September 2026, the money market funds founded by Pusula Portföy Yönetimi A.Ş. defaulted after failing to meet the cash redemption requests received from investors, triggering a sharp sell off on Borsa Istanbul. The BIST 100 index lost 5.54% that same day and hit a circuit breaker; the selling soon spread to Tera Portföy funds as well. It became apparent that the problem was not confined to those two firms but also extended to Hedef, Atlas, A1 Capital, Pardus and Bulls Portföy.

The Türkiye Emissions Trading System Regulation (the “Regulation”) was published in the Official Gazette No. 33353 dated August 27, 2026, and entered into force on the same date. Pursuant to the Climate Law No. 7552 (the “Climate Law”), the Regulation sets out the fundamental rules governing the scope of the Türkiye Emissions Trading System (“ETS”), greenhouse gas emissions permits, monitoring, reporting and verification, the allocation of allowances, and the operation of the market.

Recent Developments in Turkish Capital Markets

The European Commission initiated a voluntary initiative under the AI Act to facilitate early compliance and encourage information sharing among companies.

Recent amendments to Turkish Law No. 5651 "On the Regulation of Broadcasts via the Internet and Prevention of Crimes Committed through Such Broadcasts" have widened the scope of Law No. 5651 to cover social network providers.