Introduction
On 1 October 2026, the Turkish Personal Data Protection Authority (the “Authority”) published a public announcement addressing a practice identified in complaint reviews: some data controllers had responded to data subject applications solely by telephone, face-to-face communication or similar verbal means.
The Authority clarified that verbal communication may be used during the assessment process, for example, to request additional information, clarify the application or provide a status update, but it does not constitute the formal response required under Article 13 of the Turkish Personal Data Protection Law No. 6698 (“Law”) and Article 6 of the Communiqué on the Procedures and Principles of Application to Data Controllers (“Communiqué”). The final response must be notified in writing or electronically.
What the Authority Clarified
The Authority clarified that:
- Applications must be concluded as soon as possible and, in any event, within 30 days.
- A telephone call, face-to-face meeting or other verbal communication cannot replace the final written or electronic response.
- The final response should clearly state whether the application is accepted, rejected or partially fulfilled, specify any action taken and explain the reasons for any rejection.
- The written or electronic response should create a clear record of its content and the date on which it was notified.
What Companies Should Do
Companies should review their data subject request procedures, particularly where call centres, customer service teams, stores or other front-line functions communicate with applicants.
Each application should be logged, escalated to the responsible team and closed only after a written or electronic response has been sent through a channel that allows the content and notification date to be evidenced. Any verbal communication should be treated as an interim step and documented accordingly.
For the full text of the Authority’s announcement, please click here.