Following this decision, will public institutions not be able to share any personal data on the internet at all?

No, public institutions may share personal data only if there is a statutory obligation or an explicitly specified processing condition, and provided that it complies with the general principles of the Personal Data Protection Statute (purposefulness, limitation, proportionality, etc.). Security measures appropriate to the type and purpose of the sharing must be taken.

What happens if public institutions do not comply with this principle decision?

In the event that violations are detected, the Personal Data Protection Authority will initiate the necessary procedures regarding the relevant data controllers pursuant to Article 18 of Statute No. 6698. These procedures may range from administrative fines to other sanctions.

Does this decision apply only to municipalities and universities?

No, the decision uses the expression 'public institutions and organizations and various other data controllers possessing public juridical personality'. This covers all institutions that have juridical personality and carry out public duties, such as municipalities, special provincial administrations, and universities.

BOARD DECISIONS28 July 2026

Data Privacy Adjustment for the Public Sector from the KVKK

Official titleDecision of the Personal Data Protection Board Dated 01/07/2026 and Numbered 2026/1301

The Personal Data Protection Authority has adopted a principle decision regarding personal data shared on the internet by data controllers with public juridical personality (municipalities, universities, etc.). This decision aims to ensure that shares comply with the Personal Data Protection Statute No. 6698 and to increase data security.

Details of the Regulation

The Personal Data Protection Authority (KVKK) has published an important principle decision regarding personal data shared on the internet by public institutions and other data controllers possessing public juridical personality (municipalities, special provincial administrations, universities, etc.). This decision, based on the sixth paragraph of Article 15 of the Personal Data Protection Statute No. 6698 (Statute), exercises the Board's authority to take principle decisions in cases where violations become widespread. In the decision, it is emphasized that personal data contained in documents published by public institutions on their websites (TR identity number, address, telephone, education details, examination results, etc.) must be processed in accordance with the general principles and processing conditions of the Statute.

The decision particularly states that sharing personal data over the internet is a data processing activity and that it is mandatory to take administrative and technical precautionary measures regarding data security in this process. It is expressed that public institutions must not make these shares if there is no valid legal ground for processing the shared personal data. Furthermore, attention has been drawn to matters such as fulfilling the obligation to inform, ensuring that data is proportionate and appropriate for the purpose of processing, and deleting or anonymizing data at the end of designated periods.

The decision also states that in sharing information such as examination results and lottery results, it must be ensured that access is open only to the relevant persons or authorized persons. In this scope, it has been stated that methods such as e-state platforms or two-factor authentication can be used. Finally, it has been announced that training on personal data protection legislation must be provided to employees by data controllers, and it has been decided unanimously to publish this principle decision in the Official Gazette.

REGAS Commentary

This decision is in the nature of a response to the concerns of citizens regarding the sharing of their personal data on the internet by public institutions. Now, public institutions have to be much more careful when publishing personal information on the internet. Examination results, student information, or other personal data of citizens cannot be placed on the internet without a legal reasoning and without taking the necessary security precautions. This situation will make a significant contribution to the protection of citizens' privacy by increasing the confidentiality and security of personal data. Citizens have the right to apply to the KVKK if they believe that their personal data has been shared unlawfully.

Questions You Might Have

Following this decision, will public institutions not be able to share any personal data on the internet at all?: No, public institutions may share personal data only if there is a statutory obligation or an explicitly specified processing condition, and provided that it complies with the general principles of the Personal Data Protection Statute (purposefulness, limitation, proportionality, etc.). Security measures appropriate to the type and purpose of the sharing must be taken.
What happens if public institutions do not comply with this principle decision?: In the event that violations are detected, the Personal Data Protection Authority will initiate the necessary procedures regarding the relevant data controllers pursuant to Article 18 of Statute No. 6698. These procedures may range from administrative fines to other sanctions.
Does this decision apply only to municipalities and universities?: No, the decision uses the expression 'public institutions and organizations and various other data controllers possessing public juridical personality'. This covers all institutions that have juridical personality and carry out public duties, such as municipalities, special provincial administrations, and universities.

Key Terms

Kişisel Verileri Koruma Kanunu (KVKK): It is the fundamental statute regulating the rights of persons over their personal data and determining the procedures and principles regarding the processing, storage, and protection of data.
Veri Sorumlusu: It is the natural or juridical person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. Public institutions can also be data controllers.
İlke Kararı: These are decisions adopted by the Personal Data Protection Authority to determine the general framework regarding the implementation of the Statute and announced to the public by being published in the Official Gazette.
Özel Nitelikli Kişisel Veriler: It refers to more sensitive information such as persons' race, ethnic origin, political opinion, philosophical belief, religion, sect, dress and clothing, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions and data related to security precautionary measures, as well as biometric and genetic data.
Veri İşleme Faaliyeti: It encompasses all kinds of operations performed on data, such as obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data by fully or partially automated means, or by non-automated means provided that it is part of any data recording system.

Follow Turkish legal developments

REGAS analyzed all 37 items in the Official Gazette of 28 July 2026; we published only 3 of them here.

REGAS summarizes every change in the Turkish Official Gazette in plain language and notifies you.

The REGAS app is currently Turkish-only. If you would like English in the app, the best way to make it happen is to support the developer: get the app and just say so.