The Principle Decision titled "On the Requirement for Data Controllers to Prepare Explicit Consent Texts and Obligation to Inform Separately", issued by the Turkish Personal Data Protection Board ("Board") with decision number 2026/347 dated February 18, 2026, was published in the Official Gazette dated 24 March 2026 and numbered 33203, and has thereby entered into force.
With this Principle Decision and the accompanying public announcement, significant structural changes and compliance requirements have been introduced regarding the practices of data controllers in relation to their obligation to inform and explicit consent processes.
Pursuant to Presidential Decree No. 11066, published in the Official Gazette No. 33199 dated March 17, 2026, amendments were made to the procedures and principles governing the determination of companies subject to independent audit.
According to the mentioned amendment, the threshold values to be considered for companies not falling under any specific scope or exemption have been revised as follows:
In the public announcement published by the Turkish Personal Data Protection Authority on 16 March 2026, clarifications were provided regarding the notification of personal data processing activities carried out within the scope of joint ventures, consortia, and ordinary partnerships to the Data Controllers' Registry (VERBIS), addressing uncertainties encountered in practice.
As it is known, with the addition of temporary Article 112 to the Social Insurance and General Health Insurance Law No. 5510, the minimum wage support to be provided to employers in 2026 was regulated.
You can access our publication on the subject here.
Regarding the minimum wage support to be provided in 2026, the Social Security Institution has published Circular No. 2026/8 dated March 5, 2026, outlining the procedures to be carried out.
