Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 24 MARCH 2026

Protection Of Personal Data In Mergers And Acquisitions

Pekin & Pekin
Explore more from Pekin & Pekin

The due diligence process in mergers and acquisitions is a critical stage in which extensive information and document exchange occurs between the buyer and the target company. The buyer aims to obtain comprehensive data about the target company to make an informed decision regarding the planned transaction and to assess legal, financial, and operational risks.

TurkeyPrivacy
Özge Öztürk
Özge Öztürk

I. Introduction

The due diligence phase of mergers and acquisitions ("M&A") requires intensive information sharing, making it particularly sensitive in terms of personal data protection. This article addresses the responsibilities of the parties under the Turkish Personal Data Protection Law ("KVKK"), the importance of the obligation to inform, the principle of data minimization, Non-Disclosure Agreements ("NDAs"), data destruction obligations, and key considerations for the processing of special categories of personal data.

II. Data Controller Status and the Due Diligence Phase

The due diligence process in mergers and acquisitions is a critical stage in which extensive information and document exchange occurs between the buyer and the target company. The buyer aims to obtain comprehensive data about the target company to make an informed decision regarding the planned transaction and to assess legal, financial, and operational risks.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Turkiye Introduces New Age Verification And Child Protection Requirements For Social Network Providers

On 10 October 2026, the Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers (the "Regulation") was published in the Official Gazette. Issued by the Cyber Security Presidency, the Regulation introduces mandatory age verification, restrictions on children's access to social networks and additional safeguards for users aged 15 to 17.
TurkeyPrivacy
Balcıoğlu Selçuk Eymirlioğlu Ardıyok Keki Attorney Partnership
Balcıoğlu Selçuk Eymirlioğlu Ardıyok Keki Attorney Partnership
Article

New Regulations For Protecting Children On Social Media In Turkey Minimum Age, Age Verification & Parental Controls

While the widespread use of social media by children offers significant opportunities for communication and access to information, it also presents various risks, including exposure to harmful content, cyberbullying, online exploitation, and threats to the protection of personal data. These risks have increased the importance of legal regulations aimed at protecting children in the digital environment.
TurkeyPrivacy
ADMD/Mavioglu & Alkan Law Office
ADMD/Mavioglu & Alkan Law Office
Article

New Age Verification And Child-Specific Service Obligations Introduced For Social Network Providers

Turkey's new regulation mandates strict age verification and child-specific protections for social media platforms, prohibiting services to users under 15 and requiring segregated, privacy-enhanced accounts for those aged 15-17. Social network providers must implement parental controls, restrict targeted advertising and profiling, and establish transparent appeal mechanisms, with enforcement beginning November 2026.
TurkeyPrivacy
Moroglu Arseven
Moroglu Arseven
Article

Data Protection Law In Turkey (KVKK): Compliance Obligations For Businesses

This article examines Turkey's personal data protection framework under Law No. 6698 from the perspective of companies operating in, selling into or otherwise handling data connected with the Turkish market. It addresses the distinction between data controllers and processors, lawful processing, the information duty, the 2024 reform of special-category data and cross-border transfers, the 2025 VERBIS exemption update, data subject requests, breach response and enforcement.
TurkeyPrivacy
ONGUR & PARTNERS
ONGUR & PARTNERS
Article

Sosyal Ağlarda Yaş Doğrulaması Ve Çocuk Hesaplarına İlişkin Yeni Yükümlülükler

Yönetmelik 1 Kasım 2026’da yürürlüğe girecek olup mevcut hesaplar için 31 Mart 2027’ye kadar süre tanımaktadır. Yükümlülüklere aykırılık hâlinde 5651 sayılı Kanun’un ilgili yaptırım hükümleri uygulanacağından sosyal ağ sağlayıcılarının kayıt akışlarını, çocuk hesaplarını ve itiraz süreçlerini yürürlük tarihinden önce gözden geçirmesi gerekmektedir
TurkeyPrivacy
ASY Legal
ASY Legal
Article

Technical Bankruptcy Under The Turkish Commercial Code

The deterioration of a company’s (namely joint stock companies, limited liability companies and partnerships limited by shares are subject to this provision) financial standing and its legal consequences are governed by Article 376 of the Turkish Commercial Code numbered 6102 (published in the Official Gazette dated February 14, 2011 and numbered 27846 (“TCC”) and the Communiqué on the Procedures and Principles regarding the Implementation of Article 376 of the TCC published in the Of
TurkeyInsolvency/Bankruptcy/Re-Structuring
Pekin & Pekin
Pekin & Pekin