Implementation Guide on the Protection of Personal Data in the Professional Activities of Attorneys Has Been Published

The Implementation Guide on the Protection of Personal Data in the Professional Activities of Attorneys (“Guide”) prepared by the Turkish Personal Data Protection Authority (the “Authority”) was published on the Authority’s official website on 22 September 2026.

The Guide was prepared within the scope of the cooperation protocol signed between the Authority and the Union of Turkish Bar Associations (“UTBA”) on 14 December 2022, taking into consideration the opinions and contributions of the UTBA.

The following matters are addressed in the Guide and may be summarized as follows:

• The Guide draws attention to the balance between the trust-based principle of confidentiality, which constitutes the foundation of the attorney-client relationship, and the right to request the protection of personal data within the scope of the “right to a fair trial,” as well as to the necessity for attorneys to adopt best practices concerning the protection of personal data in the exercise of their profession.
• It is emphasised that, by virtue of their profession, attorneys process the personal data not only of their clients but also of third parties with whom their clients are in a legal relationship (potential clients, parties to the dispute, data subjects in relation to advisory services, etc.) within the scope of the Personal Data Protection Law No. 6698 (the “Law”).
• The circumstances in which personal data processing activities may be wholly or partially exempted from the scope of the Law pursuant to Article 28 of Law No. 6698, and whether the data processing activities carried out by attorneys may be assessed within this scope, are addressed.
• Within the framework of the concepts of data controller and data processor, the status under Law No. 6698 of attorneys practising their profession independently, attorneys working together in the same office and attorney partnerships, substitute attorneys, employed attorneys, trainee attorneys, and support staff working in law offices has been assessed separately.
• The client, potential client, parties subject to advisory services or disputes, and other third parties who may have the status of “data subject” in the data processing activities of attorneys are defined.
• The conditions for processing personal data (explicit consent, being expressly provided for by laws, actual impossibility, the establishment or performance of a contract, the fulfilment of a legal obligation, having been made public by the data subject themselves, the establishment, exercise or protection of a right) and the conditions for processing special categories of personal data are explained with examples, specifically in relation to attorneys’ activities of obtaining and disclosing personal data.
• The principles governing the transfer of personal data domestically and abroad are set out; in this context, the use of generative artificial intelligence tools in the legal profession and the transfer of personal data through such tools are assessed under a separate heading.
• General principles such as lawfulness and fairness, accuracy and being kept up to date, processing that is relevant, limited and proportionate to the purpose, and compliance with retention periods, together with the data controller’s obligation to inform, the obligation to register with the Data Controllers’ Registry, the obligation of retention and destruction, the management of data subject rights and complaints, the implementation of decisions of the Personal Data Protection Board (the “Board”), and the obligation to notify data breaches, as well as matters relating to data security, are addressed.
• The final section of the Guide contains recommendations for attorneys and examples of good practice based on Board decisions, judicial decisions, and other sources.

You can access the full text of the Guide here.

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr

All information and documents on our website have been prepared by Zümbül Law and Consultancy solely for general information purposes, taking into account the Attorneyship Law and other relevant legislation as well as the Professional Rules for Attorneys of the Union of Turkish Bar Associations, and these publications are by no means intended for advertising and/or commercial purposes. All information and documents on our website are of a general nature, and no guarantee or undertaking is given in any manner whatsoever that these publications are complete, accurate, up to date, or reliable. No action should be taken in reliance on the information and documents in these publications without consulting an attorney/expert. The links included in the publications on our website have been obtained from publicly available sources and are provided solely to facilitate visitors’ access to other information and documents. These links do not in any way constitute a recommendation and/or endorsement of the persons, institutions, or organisations to which they are linked. The publications on our website in no way constitute the provision of legal advice or the establishment of an attorney-client relationship with visitors who access our website in any manner. All content on our website is the property of Zümbül Law and Consultancy, and no content may be copied, reproduced, or used without attribution, without prior written permission.