Deadline Extended for Loyalty Cards
Official titleDecision of the Personal Data Protection Board Dated 22/07/2026 and Numbered 2026/1491
The Personal Data Protection Board (KVKK) has extended the compliance period granted to data controllers regarding the establishment of a verification system (SMS verification code, etc.) for purchases made by declaring a loyalty card and phone number until 28 February 2027.
Details of the Regulation
With the Principle Decision numbered 2026/266 taken by the Personal Data Protection Board on 11.02.2026 and published in the Official Gazette dated 28.02.2026, it was made mandatory to take technical and administrative precautionary measures (verification mechanisms) to prevent third persons from conducting unauthorized transactions during checkout transactions carried out by declaring a loyalty card or mobile phone number, and data controllers were granted a 6-month compliance period.
Since the said compliance period was due to expire on 28.08.2026, the intensive postponement and technical compliance requests received from sector representatives were evaluated by the Board. As a result of the evaluation conducted, an extension of time was decided upon in order for system integrations to be completed soundly.
Pursuant to the Board Decision dated 22.07.2026 and numbered 2026/1491, the final deadline granted to data controllers to establish these verification infrastructures has been unanimously extended until 28.02.2027. Administrative sanctions may be imposed on companies that do not complete the integration by this date.
Questions You Might Have
- When will I be prevented from getting a discount by stating someone else's phone number at the checkout?
- Since the final compliance date for companies has been determined as 28 February 2027, security steps such as SMS verification will become mandatory in every checkout transaction as of this date.
- Why was the process postponed?
- The period was extended due to the difficulties experienced by companies in the retail and service sectors in integrating technical verification infrastructures and the postponement requests received.
Key Terms
- Veri Sorumlusu
- The natural or juridical person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.
- İlke Kararı
- The generalizing and binding decision taken by the Personal Data Protection Board in order to prevent personal data breaches or disputes of a similar nature.
- Uyum Süresi
- The transition period granted for the addressees to adapt their own systems to newly entered into force legal or technical rules.
Where we posted this
Follow Turkish legal developments
REGAS analyzed all 32 items in the Official Gazette of 13 August 2026; we published only 4 of them here.
REGAS summarizes every change in the Turkish Official Gazette in plain language and notifies you.
The REGAS app is currently Turkish-only. If you would like English in the app, the best way to make it happen is to support the developer: get the app and just say so.
REGAS Commentary
This postponement decision directly affects our shopping habits in our daily lives at supermarkets, clothing stores, and all businesses that use loyalty points. Under normal circumstances, as of August 2026, SMS verification codes would have started arriving on our phones to prevent providing someone else's phone number at checkouts to earn points. Due to the sector's infrastructural inadequacy, the mandatory implementation date of this security measure was pushed back by approximately 6 months to February 2027. Companies are obliged to update their software infrastructures during this period.