The Turkish Personal Data Protection Board (KVKK) has adopted Principle Decision No. 2026/1301, introducing new guidance on how public institutions should handle the online publication of personal data.
The decision reinforces the obligation of public authorities to balance transparency with the fundamental right to privacy. While certain information may legitimately be published to fulfil legal obligations, institutions are expected to ensure that personal data is disclosed only where strictly necessary and in accordance with the principles of the Turkish Personal Data Protection Law (Law No. 6698).
For organisations interacting with Turkish public bodies, the decision highlights the growing importance of robust data governance and compliance procedures.
Why the Decision Matters
Government agencies increasingly publish announcements, administrative decisions, disciplinary measures, procurement notices and other official documents on their websites.
In many situations these publications contain personal information relating to individuals, employees, contractors or third parties.
The Personal Data Protection Board has clarified that even when publication serves a legitimate public interest, institutions must carefully assess whether every personal data element included in the document is genuinely necessary.
Publishing excessive or unnecessary personal information may constitute a violation of Turkish data protection legislation.
Reinforcing the Principles of Data Minimisation
A central objective of the new decision is the application of the principle of data minimisation.
Public institutions should ensure that:
- only information required by law is published;
- unnecessary identifiers are removed;
- excessive personal details are omitted;
- publication periods remain proportionate;
- documents are reviewed before being made publicly accessible.
These obligations are consistent with the general principles contained in Article 4 of the Turkish Personal Data Protection Law, including proportionality, purpose limitation and data minimisation.
Public Disclosure Does Not Remove Privacy Obligations
The Board reiterates that the fact a document is published online by a public authority does not eliminate the obligation to protect personal data.
Institutions remain responsible for ensuring that publication complies with:
- the applicable legal basis;
- necessity requirements;
- proportionality principles;
- retention obligations;
- security measures designed to prevent misuse of personal information.
Each publication should therefore be assessed individually before being made available to the public.
Practical Measures for Public Institutions
To reduce compliance risks, organisations should consider implementing internal review procedures before publishing documents online.
Good practices include:
- anonymising unnecessary personal information;
- replacing names with reference numbers where appropriate;
- limiting access to sensitive documents;
- defining publication periods;
- periodically reviewing online archives;
- removing documents that no longer need to remain publicly accessible.
These measures help reconcile transparency obligations with privacy protection.
Lessons for Private Companies
Although the decision primarily addresses public institutions, it also provides valuable guidance for private organisations.
Companies frequently publish information on their websites, including:
- employee announcements;
- customer testimonials;
- procurement results;
- disciplinary notices;
- shareholder information;
- litigation outcomes.
Businesses should review these practices to ensure that personal data is disclosed only when supported by an appropriate legal basis and limited to what is necessary under the KVKK.
How Azkan Group Assists International Businesses
Compliance with Turkish data protection legislation requires continuous monitoring of regulatory developments.
Azkan Group supports international companies operating in Türkiye through:
- GDPR and KVKK compliance reviews;
- corporate governance advisory;
- HR compliance;
- Employer of Record (EOR) services;
- payroll administration;
- internal compliance policies;
- data protection awareness;
- legal and administrative coordination.
Our multidisciplinary teams help foreign investors integrate privacy compliance into their day-to-day operations while reducing legal and operational risks.
Recommendations for Organisations
Both public institutions and private companies should regularly review the personal information published on their websites.
Questions worth considering include:
- Is publication legally required?
- Is every personal data element necessary?
- Can certain information be anonymised?
- How long should the document remain online?
- Are internal approval procedures in place before publication?
Answering these questions proactively significantly reduces the risk of non-compliance.
Principle Decision No. 2026/1301 reflects the Turkish Personal Data Protection Board’s continuing efforts to strengthen privacy standards in the digital environment.
The decision reminds organisations that transparency should never result in unnecessary disclosure of personal information.
By adopting appropriate governance procedures and applying the principles of proportionality and data minimisation, organisations can improve compliance while maintaining public confidence in the way personal data is handled.
Frequently Asked Questions
Who is primarily affected by Principle Decision No. 2026/1301?
The decision is principally directed at Turkish public institutions that publish official information online, although private organisations may also draw important compliance lessons from its principles.
Does the decision prohibit publishing personal data?
No. It requires organisations to ensure that any publication has a valid legal basis, is necessary for the intended purpose and complies with the principles established under the Turkish Personal Data Protection Law.
Why is data minimisation important?
The KVKK requires personal data processing to remain relevant, limited and proportionate to the purpose pursued. Publishing unnecessary information may therefore expose organisations to regulatory action.
How can Azkan Group help?
Azkan Group advises foreign investors and international businesses on KVKK compliance, corporate governance, HR administration, Employer of Record (EOR) services, payroll outsourcing and broader regulatory compliance throughout Türkiye.
