The Turkish Data Protection Authority (DPA) has issued a principle decision dated 11 February 2026, addressing the widespread practice of allowing loyalty card benefits to be used at the checkout solely by declaring the membership holder's mobile phone number or loyalty card number, without any form of verification.
The DPA determined that this practice gives rise to material compliance risks under Turkish Law No. 6698 on the Protection of Personal Data (DPL), particularly in relation to lawful processing conditions, the principles of accuracy and data being kept up to date, and data security obligations.
Decision background and scope
In its assessment, the DPA noted that loyalty card programmes are widely used across sectors such as grocery, cosmetics, technology, DIY and apparel, and confirmed that verification methods applied at the membership creation stage, including one‑time SMS codes or barcode/QR code scanning via mobile applications or websites, are generally considered
