Home Page
Institutional Policies
Information Notice
Explicit Consent Texts
Data Subject Request Process
Reports

New Guidance and Principle Decision for Public Institutions Published by the Personal Data Protection Authority

The Personal Data Protection Authority (KVKK) has published the "Guidance on Compliance with the Personal Data Protection Law for Public Institutions and Organizations and Professional Organizations with Public Institution Status" to support the compliance efforts of public institutions and organizations, as well as professional organizations with public institution status, under the Personal Data Protection Law No. 6698.

The Guidance addresses the fundamental principles of personal data processing, the obligations of data controllers, technical and administrative measures for data security, personal data transfers, the rights of data subjects, and key considerations for public institutions in implementing the Law. It also provides practical guidance and recommendations to facilitate compliance with the Personal Data Protection Law.

In addition, the Personal Data Protection Board has issued the Principle Decision No. 2026/1301, dated 1 July 2026, on the Disclosure of Personal Data on the Internet by Data Controllers Having Public Legal Entity Status.

The Principle Decision sets out the principles governing the disclosure of personal data by public institutions through internet platforms. In particular, it emphasizes that personal data contained in announcements, notices, lists, examination and evaluation results, and similar content published on institutional websites must be processed and disclosed in a lawful manner, for specified and legitimate purposes, and in accordance with the principles of relevance, necessity, and proportionality. Furthermore, it highlights the importance of reviewing existing online data-sharing practices, implementing appropriate technical and administrative safeguards, and periodically evaluating published content to ensure that necessary actions are taken when the purpose of publication no longer exists.

Within the scope of our University's Personal Data Protection compliance efforts, all academic and administrative units involved in personal data processing activities are encouraged to review their existing practices in light of the Guidance and the Principle Decision. Particular attention should be given to personal data shared through institutional websites, electronically published documents, announcements, notices, and similar content to ensure compliance with the principles set forth in these publications.

The relevant documents are available at the links below.