KVKK in 2026: principle decisions and their effect on data operations

2026 is the year Türkiye’s data protection authority made its expectations of data controllers concrete. Two principle decisions, a series of public announcements, a webinar and refreshed guides all point in one direction: compliance will be measured in the systems where data actually sits, not in the policy binder. This article lists the 2026 developments published on kvkk.gov.tr and explains what each one changes in the day-to-day data operation of a controller.

This article is not legal advice; the interpretation of each decision for your organization should be confirmed with your legal function.

Why the Authority’s 2026 agenda is different

For readers outside Türkiye: KVKK is the name used both for the country’s Personal Data Protection Law and for the Authority that enforces it. The Authority’s Board publishes “principle decisions”, which set out how a recurring practice is to be assessed, alongside guides and public announcements. In earlier years the output was dominated by guides and summaries of individual decisions. In 2026, two principle decisions targeted two practices found in almost every mid-sized and large organization: biometric attendance tracking and the monitoring of corporate e-mail and other communication channels.

Around those decisions, the Authority published a compilation titled “Selected Current Developments” dated 10 September 2026, announced a webinar for 13 October 2026 under the title “Current Developments in Personal Data Protection: 2026 Principle Decisions and Public Announcements”, and scheduled events such as the “Workshop on the Protection of Personal Data in Clinical Research” and the symposium “Personal Data Protection in the Age of Artificial Intelligence”. In October 2026 the Authority also shared several data breach notifications with the public.

For compliance teams the message reduces to one sentence: the Authority is applying its principles to specific business processes and asking how the data accumulated in those processes is managed. The question is no longer “do you have a policy” but “where is the data, who can reach it, how long do you keep it, and can you prove it”.

Biometric data for attendance tracking: Principle Decision 2026/921

The Authority’s public announcement of 27 August 2026 responds to requests for opinion on Principle Decision 2026/921 of 29 April 2026 on the Processing of Biometric Data for Attendance Tracking. The decision was published in the Official Gazette on 2 June 2026. Its core is unambiguous: processing biometric data solely for attendance tracking does not rest on any lawful processing condition, and even where explicit consent has been obtained, proportionality is not satisfied.

The announcement corrects two technical misconceptions that are common in Turkish workplaces. First, fingerprints, vein patterns and palm prints are biometric data. Second, storing them in coded form (as a template or hash) does not remove their biometric character. The familiar explanation that “the device does not keep the raw image, it only generates a code” is therefore no longer an adequate defence.

The decision is deliberately narrow: it covers only processing for attendance tracking. Limited and proportionate use for access to critical areas in high-security facilities is stated to remain possible. Door control for a data centre’s server room and clock-in tracking at an office entrance are not assessed in the same way.

For data operations the first consequence is a discovery question: where are the biometric templates, the device logs and their exported copies, which usually live as CSV or Excel files in an HR folder? The second consequence is a disposal question: records whose purpose has fallen away must be deleted or anonymized, and the organization must be able to prove that this happened.

Monitoring corporate e-mail and communication channels: Principle Decision 2026/2035

Board Principle Decision 2026/2035 of 16 September 2026 sets out the procedures and principles to be followed when employers monitor corporate e-mail accounts and other communication channels assigned to employees for work. The decision defines monitoring as a data processing activity that requires a “fair balance” between the employer’s management right and the employee’s private life and freedom of communication.

The distinction most likely to be quoted is the one between “being technically able to access and being legally able to access”. Ownership of the tool does not give the employer unlimited monitoring authority. Rules must be clear, understandable and knowable; a general notice is not considered sufficient, and the purpose, scope, method and retention period of monitoring must be explained explicitly. Explicit consent cannot be the primary legal basis in every case within an employment relationship.

Under the principles of proportionality and a graduated approach, content review must be limited to a concrete suspicion or incident, and content reviews that are “indeterminate in scope, general and continuous” must be avoided. Access must be restricted to a limited set of personnel, access logs must be kept, and the retention period must be limited. When the employment relationship ends, the data does not remain accessible indefinitely.

For operations teams, the decision brings two separate data sets to the front: live mailboxes and archive files (PST, OST, MSG). The mail archives of former employees typically sit for years on a file server, a backup disk or a SharePoint library, and nobody knows who can open them. The decision’s emphasis on access logs and on data not being “accessible indefinitely” is aimed squarely at those archives. We cover the decision in depth in what the 2026 e-mail monitoring decision changes.

Webinar, workshop and symposium: the Authority’s discussion agenda

The title of the Authority’s webinar of 13 October 2026 summarizes the year’s frame: “Current Developments in Personal Data Protection: 2026 Principle Decisions and Public Announcements”. Presenting the decisions and announcements together with a training event signals that the Authority cares about how they are read in practice.

The “Workshop on the Protection of Personal Data in Clinical Research” brings forward scenarios in which health data is processed for research. This is one of the areas where special-category data accumulates most densely: patient files, ICD-coded diagnoses, laboratory results and the copies shared with research teams. The symposium “Personal Data Protection in the Age of Artificial Intelligence” opens the question of how personal data is to be treated in model training and generative AI use.

We refrain from commenting on the content of these events; their titles and their presence on the Authority’s agenda are enough to show which data types are in focus: biometrics, health, communication records and data on its way to AI systems.

October 2026 breach notifications and “Selected Current Developments”

In October 2026 the Authority shared several data breach notifications with the public. What such notifications have in common is that the affected data is very often a copy the organization did not have in its own inventory: an old export, a test database, a backup in a shared folder. The duty to notify a breach requires the controller to say quickly which data was affected, and that requires discovery to have happened before the incident, not during it.

The Authority’s compilation “Selected Current Developments” dated 10 September 2026 gathers the year’s decisions and announcements in one place. Its practical value for compliance teams is a single reference for internal training and policy updates.

The guides: special-category data, generative AI, international transfer, disposal

The Authority’s guides page hosts four texts that complement the 2026 decisions. The “Guide on the Processing of Special-Category Personal Data” describes the technical and administrative measures expected for categories such as health and biometric data. The “Guide on Generative Artificial Intelligence and the Protection of Personal Data” addresses the risks of sending personal data to external AI services. The “Guide on the Transfer of Personal Data Abroad” explains the obligations that arise when data sits in a system outside Türkiye. The page “Deletion, Destruction or Anonymization of Personal Data” governs what happens to data whose retention period has expired.

The shared assumption behind all of these is that the organization knows which data it holds and where. In practice that assumption rarely holds. The measures in the special-category guide cannot be applied if the organization does not know which folder, which table and which archive contains that data.

What each development means for data operations

Development	Data in focus	Operational question
2026/921 (biometric attendance)	Fingerprint/vein/palm templates, device logs, exports	Where is it, who can reach it, has it been disposed of?
2026/2035 (e-mail monitoring)	Live mail, PST/OST/MSG archives, former employees’ mailboxes	Who can open it, is access logged, is retention enforced?
October 2026 breach notifications	Copies outside the inventory, test and backup data	Can affected data be listed within hours?
Special-category data guide	Health (ICD), biometrics, criminal records	Is it widely shared, is there a public link?
Generative AI guide	Content sent to external AI services	Is enrichment done inside the organization?
Deletion/destruction/anonymization	All data past its retention period	Is the redacted copy and destruction of the original evidenced?

The table shows the common denominator of the 2026 agenda: every development reduces to a discovery question, an access question and an evidence question.

How Seratus closes these gaps

Gap 1: Copies of biometric records are unknown. Exports from attendance devices circulate in HR folders and e-mail attachments. Seratus’s agentless discovery scans SMB/NFS shares, Microsoft 365 libraries and PST/OST/MSG archives over a read-only connection, and presents special-category findings with a confidence percentage and a masked sample. “Special-category data widely shared” is listed as its own item in the KVKK readiness score.

Gap 2: Nobody knows who can reach former employees’ mail archives. Seratus scans e-mail archives without connecting to a live mailbox, and writes the ACLs and sharing links of the share that holds the file into the access and exposure graph. Orphaned and departed-user access, unresolved SIDs and “everyone in the organization” sharing are brought to the front.

Gap 3: Data past its retention period stays in the system. Seratus’s retention calendar binds classification labels to retention and disposal processes. Expired data lands on the “gaps” list; disposal is carried out by producing a redacted copy and destroying the original, with quality measured through a uniqueness check.

Gap 4: Affected data cannot be listed when a breach occurs. A VERBİS inventory built from real discovery and source-level detail reports say in advance which data category sits in which system. Breach records are kept in the same console.

Gap 5: AI enrichment sends data outside. Seratus performs document-type and request-summary enrichment with a private, on-premises LLM; no data goes to an external AI service, and it works in an air-gapped installation.

Gap 6: There is no evidence of what was done. Every remediation action is assigned to an owner, approved by a separate approval authority and written to the audit log with who, when and why. The KVKK readiness summary and the audit report export to PDF, Excel or CSV.

Takeaway

The 2026 developments look independent but point the same way: the Authority is asking how its principles are applied in specific business processes and how that application is proven. For biometric templates, mail archives, health records and data past its retention period, the right answer is not a policy text but a current discovery, a visible access map and an auditable action record. Seratus provides those three components in one console, on the organization’s own infrastructure.