Not The Final Word: How To Challenge Personal Data Protection Board Decisions In Türkiye

1. INTRODUCTION

For many businesses in Türkiye, a single decision of the Personal Data Protection Board can now mean multimillion-lira fines, suspended data transfers, and immediate operational disruptions. The Law on the Protection of Personal Data No. 6698 ("LPPD") constitutes a core component of Türkiye's personal data privacy framework. It safeguards individuals' fundamental right to privacy and regulates the entire lifecycle of personal data processing. The LPPD also provides legal remedies for decisions made by the supervisory administrative authority, the Personal Data Protection Board ("Board").

Despite the criminal penalties regulated under the Turkish Criminal Code No. 5237 and other applicable legislation, this article focuses on the administrative consequences of non-compliance with the LPPD, outlines the sanctions available under the LPPD, and examines the avenues for judicial review and procedural routes for legal recourse.