September 2022 - In August 2022, the Turkish
Personal Data Protection Authority
("Authority") published guidelines on
the protection of personal data in the banking sector, opened draft
guidelines on the processing of genetic data, and announced two
data breach notifications.
New Guidelines for the Banking Sector
On 5 August 2022, the Authority published guidelines on the
processing of personal data in the banking sector
("Guidelines"), which evaluates personal
data processing in detail. You can access the Guidelines here (available only in
Turkish).
In summary, the Guidelines determine the status of banks.
Accordingly, within the scope of activities stipulated in Article 4
of Turkey's Banking Law, banks are considered to be data
controllers. In cases where banks act as an agency (e.g., in
insurance services) or an intermediary institution, it is necessary
to evaluate the conditions of each specific case when deciding
whether the bank is a data controller or
