Data Protection Law Updates September 2026

Summary

• Key developments on the data protection agenda in September included:
  1. the timetable for aligning the PDPL with the GDPR,
  2. the practical guidelines on data protection in legal practice,
  3. investigations into the unlawful use of personal
• The 92 data breach notifications published by the Authority drew attention to risks arising particularly from external service providers’ systems. These notifications highlighted the importance of extending companies’ data security practices to cover their service providers.
• In Europe, the €403 million fine imposed on Google for its processing of location data and the EU KIDS Act proposal on children’s online safety brought users’ control over their personal data and privacy protection in the design of digital services into focus.

1.     Data Protection Objectives in the Medium-Term Programme

Published by the Presidency of Strategy and Budget on 6 September 2026, the Medium-Term Programme (2027–2029)¹ sets out economic objectives and reforms in areas such as employment, public finances, investment and digital transformation for the next three years. The key initiatives relevant to data protection law are as follows:

• Alignment with the GDPR: Legislative and administrative work to align personal data protection rules with the EU framework is targeted for completion in the third quarter of 2027. However, the provisions to be amended have yet to be announced. The timetable for legislative measures concerns the completion of preparations for submission to the Turkish Grand National Assembly; it is therefore not yet possible to determine when these amendments will enter into force.
• AI Legislation: The national legislative framework for artificial intelligence is expected to be developed in the first quarter of 2027, taking alignment with the EU into The aim is to provide a legal framework to support activities in the field of AI.
• Data Management: The Programme envisages a national policy covering data ownership and specifying who may share data, under which responsibilities and through which methods. It also aims to establish overarching legislation and infrastructure for data governance.

• Public Sector Data and AI: Work on the rules and processes enabling public sector data to be used in AI applications is targeted for completion in the second quarter of

2.     Data Protection Guidelines for Lawyers

On 22 September 2026, the Personal Data Protection Authority published the “Practical Guidelines on the Protection of Personal Data in Lawyers’ Professional Activities”, prepared with contributions from the Union of Turkish Bar Associations. The Guidelines use practical examples to explain data protection issues arising in legal practice, from initial client consultations to the retention of case files.²

Key explanations concerning lawyers’ rights and obligations under the PDPL and the rules governing data processing include:

• Data controller status varies by practice structure: A lawyer practising independently is the data controller for their own activities. Lawyers sharing an office may be separate data controllers if they manage their case files and data processing independently. For activities carried out on behalf of a law partnership, the partnership is the data controller.
• Delegated and employed lawyers have distinct roles under the PDPL: The status of a lawyer acting under delegated authority depends on whether they act solely within the instructions given to them. For activities carried out by employed lawyers, trainee lawyers and support staff under their employer’s instructions, the employing lawyer or law partnership is the data controller. As these individuals act within the employer’s organisation, they are not considered separate data controllers or data processors.
• Data processing must be limited to what the legal work requires: The collection and use of information concerning clients, opposing parties, debtors or witnesses must rely on a legal ground under the Law and be limited to the information necessary for the work undertaken. For special categories of personal data, such as health data and data relating to criminal convictions, the processing conditions under Article 6 of the Law must also be met.

The Guidelines also highlight the following points on AI use, data security and lawyers’ other obligations under the PDPL:

• Document uploads to AI tools and data transfers: Uploading client data to AI systems may result in its processing by the service Where the provider, servers or subprocessors are located abroad, the conditions for cross-border data transfers must be assessed. This requires examining where the system stores data, particularly whether in Türkiye or abroad, with whom it shares data and for what purposes it uses it.
• Data minimization when using AI tools: Only information necessary for the task should be shared, and personal data should be masked or anonymized wherever possible. Uploading special categories of personal data should be Whether data may be used for model training or made available for human review should also be checked beforehand.
• Professional confidentiality and data security: Alongside the duty of confidentiality, technical and organisational measures must be taken to prevent unlawful access to case files and loss of Applications that allow identity and contact details to be retrieved from unlawfully obtained data must not be used.
• Continuing obligations despite the VERBIS exemption: Lawyers’ exemption from registration with the Data Controllers Registry does not remove their obligations concerning transparency, data security, retention and disposal. Professional retention periods must also be considered when retaining case files. Data must be erased, destroyed or anonymized once there is no longer a justification for its processing and

3.     Recent Criminal Investigations

Two investigations announced in September brought allegations that unlawfully obtained personal data had been supplied to law firms through paid lookup systems and intermediaries and used to solicit clients into focus. Responsibility extends beyond those who initially obtained the data to those who acquired and used it. Obtaining a power of attorney afterwards does not render earlier unlawful processing lawful.

·       Access to Personal Data Through “Panel” Systems 

Unlawfully obtained personal data was found to have been sold to third parties through lookup systems known as “panels”, either for a fee or on a subscription basis.

The investigation centres on allegations that information obtained through these systems was used to contact individuals with whom no legal relationship existed and make false representations.

Criminal proceedings have been brought against 10 suspects. As the investigation expanded, detention orders were issued for 31 lawyers, and searches and seizures were carried out at 39 law firms.

·       Use of Accident Victims’ Personal Data 

Personal data relating to traffic accident victims was found to have been obtained unlawfully and passed to third parties, including law firms and claims consultancy companies.

Following findings that persistent calls and misleading statements had been used to obtain specific powers of attorney from 253,000 individuals and generate TRY 15.6 billion in unlawful gains, an investigation was launched into 825 individuals. Searches and detention operations were carried out at six law firms and 20 companies.

4.     Data Breach Notifications

The Authority published 92 data breach notifications in September, marking a notable increase compared with previous months. The vast majority reported unauthorised access to the systems of external service providers or data processors holding personal data. These notifications indicate that security measures in the infrastructure used by companies’ service providers were insufficient to protect personal data.³

A similar pattern emerges particularly in notifications from e-commerce companies: access to a service provider’s server or exploitation of a vulnerability in its software also affects the data of its client companies. The number of notifications should therefore not be interpreted as the number of separate attacks. A security issue in shared infrastructure can affect customers of several companies simultaneously.

The risks are not limited to software vulnerabilities. Canva’s notification reported access through a third-party tool, while Papara Menkul Değerler’s notification described a phishing email sent to the data processor’s employees. In the latter case, although the processor detected the breach on 5 September, it did not notify the controller until 18 September. This illustrates the importance of timely communication during a breach alongside the service provider’s security measures.

These incidents demonstrate that service providers cannot be selected solely on price and functionality. Companies must also assess who can access the data, how vulnerabilities are addressed and how quickly a breach will be reported to them. Storing data externally does not remove the need for companies to monitor its security.

5.     Global Data Protection Updates

• Record Fine Against Google for Location Data Processing

On 21 September 2026, Ireland’s Data Protection Commission (DPC) announced a €403 million administrative fine against Google for GDPR infringements involving the processing of location data through its “Web & App Activity”, “Location History” and “Location Accuracy” features. The inquiry found infringements of lawfulness, fairness, transparency and retention requirements, as well as a failure by Google to meet its accountability obligation to demonstrate compliance.

The DPC noted that users’ lack of awareness that their location data was used to determine advertisements and infer interests, together with excessive retention, weakened their control over their personal data. Google was also ordered to bring the relevant processing activities into compliance with the GDPR within six months.

·       Children’s Online Safety

The EU KIDS Act proposal announced by the European Commission on 17 September 2026 envisages prohibiting children under 13 from opening social media accounts, allowing those aged 13–14 to use restricted accounts managed by parents for up to one hour a day, and permitting independent accounts from age 15.

The proposal also seeks to restrict designs that encourage excessive use, disable tracking-based personalisation by default and prevent designs in AI chat services that could foster emotional dependency in children. It proposes age verification through certified solutions independent of platforms, with platforms receiving only confirmation of whether the user meets the relevant age threshold, rather than their identity.

6.     Key Takeaways

Developments in September show that legislative reform and the application of existing data protection rules are progressing in parallel. While the timetable for aligning the PDPL with the GDPR points to future reforms, the Guidelines for lawyers and the criminal investigations have highlighted the limits governing current practices. The distinction between processing data to provide legal services and collecting it to contact individuals and solicit clients is particularly important. Pending amendments under the alignment process, the lawfulness of existing data collection and use practices should also be reviewed.

The prominence of external service providers’ systems in the vast majority of the 92 data breach notifications published in September demonstrates that protecting companies’ own infrastructure is insufficient on its own. A vulnerability in a shared system can affect customers of multiple companies, while delayed notification by a provider can also delay those companies’ response. Service providers’ security should therefore be assessed throughout the relationship, rather than only when the contract is signed, with ongoing monitoring of security measures, access permissions and incident notification procedures.

European developments highlight the relationship between service design and control over personal data. The Google decision on location data underscores the importance of users understanding the purposes for which their data is processed, while the EU KIDS Act proposal offers a model for verifying age without disclosing identity information to the platform. Taken together, these developments show how transparency and data minimization complement each other: providing clear information to users is as important as avoiding the collection of data that the service does not need.

These developments demonstrate that data protection compliance cannot be achieved solely by preparing privacy notices and contracts. An organisation that does not know the source of the data it uses, how its service provider accesses that data or how long it is retained cannot adequately assess significant risks, even if its documentation is complete. Compliance is measured by how written rules are applied in day-to-day operations and supported by effective cybersecurity measures. The priority should therefore be to verify how these rules inform decisions on data collection, service provider selection, access and retention, rather than to add further general commitments.

Footnotes

¹ Medium-Term Programme (2027–2029): https://www.sbb.gov.tr/wp-content/uploads/2026/09/Orta-Vadeli-Program-2027-2029.pdf

² The Guidelines: https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/MTZhYjI0ZTE1NWIwMWM.pdf

³ Data Breach Notifications: https://www.kvkk.gov.tr/veri-ihlali-bildirimi?page=1