Turkish Personal Data Protection Authority Publishes Bulletin on “Smart Devices and Digital Privacy”

The 12th issue of the Turkish Personal Data Protection Authority Bulletin (“Bulletin”), prepared by the Turkish Personal Data Protection Authority (“Authority”) and covering the period May – September 2026, was published on the Authority's official website on September 29, 2026, under the theme “Smart Devices and Digital Privacy”.

In summary, the Bulletin covers the following:

• The thematic sections address the importance of digital privacy in the data age, the privacy by design and privacy by default approaches, the Internet of Things (IoT) and the protection of personal data, and the inferences that may be drawn about individuals when data obtained through smart devices is aggregated. In this context, it is emphasized that the personal data processed must be relevant, limited and proportionate to the purposes, that the principle of data minimization must be observed, that transparency must be ensured, and that measures concerning personal data security must be taken into account from the design stage of products and services.
• For individuals, the Bulletin includes “The 10 Golden Rules for Smart Device Users”, recommendations on protecting privacy in mobile applications, and points on the protection of personal data when using smart glasses. The section on smart glasses reminds readers that making audio or video recordings or sharing such recordings may give rise to legal or criminal liability, depending on the circumstances of the specific case.
• It includes assessments on children's awareness of digital privacy, and an evaluation tool for parents titled “Is Your Child Ready to Use a Smartphone?”.
• Regarding developments in Türkiye, the Bulletin states that:
  • pursuant to the Medium-Term Program (2027-2029), published in the Official Gazette dated 06.09.2026 and numbered 33362 (bis), the process of harmonizing the Personal Data Protection Law No. 6698 (“KVKK”) with the EU General Data Protection Regulation (“GDPR”) will be completed in the third quarter of 2027;
  • Presidential Circular No. 2026/9 on the Türkiye Artificial Intelligence Action Plan (2026-2030) was published in the Official Gazette dated 18.08.2026 and numbered 33344;
  • the Ministry of Justice announced a new era of AI-assisted judiciary with the UYAP AI Decision Support System, and stated that the final decision will continue to be rendered by members of the judiciary;
  • the Ministry of National Education sent all provinces a letter consisting of 10 articles on measures to be taken within the scope of personal data protection; and
  • the Turkish Bar Association published the “Recommendation Guide on the Use of Artificial Intelligence for Lawyers”.
• It is stated that the Turkish Personal Data Protection Board (“Board”) published the following Principle Decisions: on the processing of biometric data for the purpose of attendance tracking, dated 29.04.2026 and numbered 2026/921; on the processing of personal data of accident victims, dated 20.05.2026 and numbered 2026/1095; and on the sharing of personal data on the internet by data controllers with public legal entity status, dated 01.07.2026 and numbered 2026/1301.
• It is also stated that the Board published public announcements on matters such as the registration and notification period for data controllers that became obliged to register with VERBİS based on their 2025 financial balance sheet total, binding corporate rules applications, the use of security cameras in apartment buildings and workplaces, the use of personal data obtained from third parties for advertising and marketing purposes, and the extension of the compliance period set out in the Principle Decision on loyalty card practices.
• It is stated that the Authority published, in cooperation with the Turkish Bar Association, the “Practice Guide on the Protection of Personal Data in the Professional Activities of Lawyers”; in cooperation with RTÜK, the “Guide on the Processing of Personal Data in Live-Broadcast Reality Show Programs”; and the “Guide on Compliance with the Personal Data Protection Law for Public Institutions and Organizations and Professional Organizations with Public Institution Status”.
• Regarding international developments, it is stated that in its judgment in Case C-474/24, the Court of Justice of the European Union held that publishing on the internet the names of professional athletes who have violated anti-doping rules, together with the duration of the ban imposed on them and the grounds for that ban, may be permissible under EU law under certain conditions; and that it emphasized that such publication must comply with the GDPR, that a balancing of the interests involved must be carried out before publication, and that the principle of proportionality must be observed, particularly with regard to the duration of the publication.
• In addition, it is stated that the European Data Protection Board (EDPB) opened its guidelines on anonymization and on web scraping in the context of generative AI to public consultation until 30.10.2026, and published the final version of its guidelines on the processing of personal data through blockchain technologies.
• Furthermore, the Bulletin covers guidelines and documents published by data protection authorities in various countries on topics such as agentic AI, smart glasses, Internet of Things products, employee monitoring, conflicts of interest of data protection officers, and children's online safety.

You can access the full text of the Bulletin here.