Turkish Data Controllers Registry's Online System VERBIS Is Live!

On 10 October 2026, the Regulation on the Provision of Differentiated Services for Children and Age Verification by Social Network Providers (the "Regulation") was published in the Official Gazette. Issued by the Cyber Security Presidency, the Regulation introduces mandatory age verification, restrictions on children's access to social networks and additional safeguards for users aged 15 to 17.

The Regulation will take effect on 1 November 2026 and allows until 31 March 2027 for existing accounts, and as the relevant sanction provisions of Law No. 5651 will apply to breaches of its obligations, social network providers should review their registration flows, child accounts and objection processes before the effective date.

While the widespread use of social media by children offers significant opportunities for communication and access to information, it also presents various risks, including exposure to harmful content, cyberbullying, online exploitation, and threats to the protection of personal data. These risks have increased the importance of legal regulations aimed at protecting children in the digital environment.

Turkey's new regulation mandates strict age verification and child-specific protections for social media platforms, prohibiting services to users under 15 and requiring segregated, privacy-enhanced accounts for those aged 15-17. Social network providers must implement parental controls, restrict targeted advertising and profiling, and establish transparent appeal mechanisms, with enforcement beginning November 2026.

This article examines the protection of minors in digital services through a comparative legal analysis directed at foreign platforms and families. It distinguishes access restrictions, age assurance, parental authority, personal-data processing and routes of challenge.

In January 2026, the Turkish Personal Data Protection Authority (the "DPA") issued several public announcements and published six data breach notifications.

Türkiye'de kişisel verilerin yurt dışına aktarılması süreci, 10 Temmuz 2024'te yayımlanan yönetmelik ve 2026 yılı itibarıyla tam kapasite çalışan dijital bildirim...

Following numerous filings from Turkish citizens, residing abroad, concerning transfer and sharing of their personal data with institutions and organizations of other countries, the Personal Data Protection Authority ...

6698 sayılı Kişisel Verilerin Korunması Kanunu’nun (“KVKK”) 9 uncu maddesi kapsamında kişisel verilerin yurtdışına aktarımlarının uygulanması ile Kişisel Verileri Koruma Kurulu’nun (“Kurul”) beklediği uygun güvenceler hakkında kamuoyunun aydınlatılması amacıyla Kişisel Verileri Koruma Kurumu (“Kurum”) tarafından 2 Ocak 2025 tarihinde Kişisel Verilerin Yurt Dışına Aktarılması Rehberi (“Rehber”) yayımlanmıştır.

This article examines Turkey's personal data protection framework under Law No. 6698 from the perspective of companies operating in, selling into or otherwise handling data connected with the Turkish market. It addresses the distinction between data controllers and processors, lawful processing, the information duty, the 2024 reform of special-category data and cross-border transfers, the 2025 VERBIS exemption update, data subject requests, breach response and enforcement.

6102 sayılı Türk Ticaret Kanunu'nun ("TTK") 376. maddesi halk arasında "teknik iflas" olarak da bilinen şirketlerin sermayenin kaybı ve borca batık olma durumuna ilişkin yükümlülüklerini düzenlemektedir.

The Turkish Data Protection Board's (‘TDPB') decision regarding Amazon Turkey Perakende Hizmetleri Ltd. Şti. ("Amazon Turkey") was published on the...

Pursuant to article 4 of the Law, the definition of trademark has been broadened to include all kinds of symbols.

The Ministry of Trade announced today that deadlines for service providers to register with the IYS and upload their approvals to the system has been postponed once again, considering the negative effects of the new type of Coronavirus ...

The deadlines for registration with the Data Controllers Registry ("Registry") are extended by the Data Protection Board ("Board") with its decision dated 27th December 2019 and numbered 2019/387.

9. Boğaziçi Siber Güvenlik ve KVKK Kariyer Zirvesi'nde yönetici ortaklarımızdan Avukat Selen Ibrahimoglu Gures "Uzaktan Çalışmada Hukuki Süreçler" konusunu anlattı.

If you have not registered with the Message Management System ("IYS") and have not uploaded the consents that you have previously received from your customers...

The Law is expected to enter into force in the course of April 2016.

The long-awaited Advocate General Saugmandsgaard Øe's opinion on Schrems II case was finally published today.

The Turkish Data Protection Board announced on 3 September 2021 that it had imposed an administrative fine on Whatsapp LLC after concluding an ex-officio investigation concerning the controller's data processing and cross-border data transfer operations.