Decision of the Personal Data Protection Board Granting VERBIS Exemption to Micro-Enterprises

3 Eki 2025 Publications

The Official Gazette dated 1 October 2025 has published the Decision of the Personal Data Protection Board, dated 04/09/2025 and numbered 2025/1572. Pursuant to the Board’s Decision of 04.09.2025, numbered 2025/1572, data controllers whose principal activity involves the processing of special categories of personal data, but who employ fewer than ten (10) persons and have an annual financial balance sheet of less than ten million Turkish Lira (₺10,000,000), shall also be exempted from the obligation to register with VERBIS (the Data Controllers’ Registry).

This Decision aims to alleviate the compliance burden of micro-enterprises by updating the previous exemption criteria relating to the number of employees and financial thresholds.

The full text of the Decision can be accessed via the following link: https://www.resmigazete.gov.tr/eskiler/2025/10/20251001-4.pdf

The Principle Decision of the Personal Data Protection Authority Regarding the Use of Verification Codes for Obtaining Consent for Commercial Electronic Messages

26 Haz 2025 Publications

In its decision dated 10 June 2025 and numbered 2025/1072, published in the Official Gazette, the Personal Data Protection Authority (“the Authority”) examined certain practices whereby data controllers, during the provision of services (such as making payments, creating accounts, registering for memberships, etc.), send verification codes to users via SMS and simultaneously obtain consent for the delivery of commercial electronic messages.

Upon evaluation, the Authority stated that the sending of verification codes via SMS must be strictly limited to the purpose of verification and that using this process as a means to obtain consent for commercial communications raises concerns in terms of the conditions required for obtaining explicit consent.

The decision emphasized that explicit consent, as defined under the Law, must relate to a specific subject matter, be based on informed choice, and be given freely. It was noted that, if consent is obtained during the verification process, it must be clearly and distinctly separated from the verification function, and the user must be adequately informed.

The Authority reiterated that in such practices, the processes concerning the processing of personal data and the sending of commercial electronic communications must be clearly separated, and that explicit consent must be obtained separately and in accordance with the legal requirements. Otherwise, the matter may be subject to further assessment within the scope of Law No. 6698 on the Protection of Personal Data.

The full text of the decision is available via the following link: https://www.resmigazete.gov.tr/eskiler/2025/06/20250626-7.pdf

Information Note Regarding the Amendments to the Regulation on Distance Contracts

2 Haz 2025 Publications

The “Regulation Amending the Regulation on Distance Contracts” published in the Official Gazette on 24 May 2025 introduces important consumer protection measures. These amendments cover key issues, including the expansion of the right of withdrawal, ensuring that return shipping costs cannot be imposed on the consumer, and mandating that pre-contractual information clearly state that mediation is required before initiating legal action.

In the Information Note we prepared as Koyuncuoğlu&Köksal Law Firm, we provide brief, summarized information and our evaluations regarding the Authority’s work.

Click here to access our study.

Information Note on Chatbots (Example: ChatGPT)

11 Nis 2025 Publications

An information note about chatbots (example: ChatGPT) was published by the Personal Data Protection Authority on November 8, 2024. This information note, issued by the Personal Data Protection Authority, addresses topics such as defining chatbots, their purposes, the types of personal data they process, and how AI chatbot applications can be evaluated in terms of personal data security, as well as the considerations to keep in mind during their development.

In the Information Note we prepared as Koyuncuoğlu&Köksal Law Firm, we provide brief, summarized information and our evaluations regarding the Authority’s work.

Click here to access our study.

Legislative Proposal For Amendment in The Personal Data Protection Law

11 Nis 2025 Publications

The proposed law on amendments to the Code of Criminal Procedure and Certain Laws, known as the 8th Judicial Package, which includes important amendments to the Personal Data Protection Law (“KVKK”) is expected to be enacted shortly.

The planned amendments to the KVKK aim to harmonize the Turkish laws with the EU General Data Protection Regulation (“GDPR”). With the enactment of the Proposal, important amendments will enter into force in terms of the processing of special categories of personal data, data transfer abroad, administrative sanctions and the ways of appeal against the decisions of the Personal Data Protection Board.

You may find our Publication regarding the Proposal from here.

Information Note On The Decision Of The Constitutional Court No 2019/40991 On The Violation Of The Right To Immunity Of Residence By Competition Board’s On-Site Inspection

11 Nis 2025 Publications

The decision of the Constitutional Court, application numbered 2019/40991 and dated 23.03.2023 stating that the on-site inspection carried out by the Competition Board at the applicant’s workplace without a judge’s decision violates his right to immunity of residence which is protected by Article 21 of the Constitution, published in the Official Gazette dated 20 June 2023 and numbered 32227.

The Constitutional Court stated that, pursuant to the right to immunity of residence that is protected by Article 21 of the Constitution, it is not possible to enter a residence without a duly issued judge’s decision, and that in cases where a delay may cause any damages, a written decision of the authority authorized by law must be presented to a judge within 24 hours. Accordingly, it has been considered that the on-site inspection carried out at the applicant’s workplace which is considered to be “residence” without permission constitutes an interference with the right to immunity of residence.

As to whether this interference constitutes a violation with regards to Article 21 of the Constitution, the Constitutional Court stated that a judge’s decision is not required by the Competition Board to conduct an on-site inspection except in cases where the on-site inspection is prevented. However, as per Article 21 of the Constitution, it is required to present a duly issued judge’s decision in order to be able to enter a person’s residence.

Accordingly, the Constitutional Court ruled that the on-site inspection carried out by the Competition Board without the consent of the persons concerned and without a judge’s decision, violates the right to immunity of residence and that Article 15 of the Law on the Protection of Competition that doesn’t limit the Board’s authority to carry out on-site inspections to cases in which a delay may cause damages is not in accordance with the right to immunity of residence.

Public Announcement on Technical and Administrative Measures Recommended to be Taken by Data Controllers Regarding User Security

11 Nis 2025 Publications

The “Public Announcement on Technical and Administrative Measures Recommended to be Taken by Data Controllers Regarding User Security” was published on the website of the Personal Data Protection Authority (“Authority”) on February 15, 2022. You may find our publication regarding the announcement from the link below.

KK Hukuk_User Security_Recommendations_Information Note

1 2 3 4

Search

+