Protecting Personal Data When Dealing with Public Authorities in Türkiye: A Guide for 2026

سفير طرابزون · Oct 8, 2026

Protecting Personal Data When Dealing with Public Authorities in Türkiye: A Guide for 2026

A privacy concern sometimes begins with something small: a form requesting an identity-document copy, a message sent to the wrong number, or a document containing your details appearing somewhere unexpected. Handling these situations well means identifying the data, organisation and purpose before making broad claims. Collecting data is not automatically unlawful, and dealing with a public authority is no reason to overlook how information is used or corrected.

This guide explains data-subject rights and how to organise correspondence with the controller in 2026, using official information reviewed up to 8 October 2026. It includes a practical reminder issued by the Personal Data Protection Authority (KVKK) on 1 October: a telephone conversation or oral explanation does not replace the final written or electronic response to a data-subject request. This distinction helps you document the process and understand its outcome without relying on memory alone.

Archive photograph of Ankara taken from the International Space Station on 11 April 2009; this general view of the capital does not depict its built environment in 2026.

What question do you need answered?

Before choosing a form or drafting a complaint, describe the event in one sentence. Is information in a record incorrect? Do you not know to whom your data were transferred? Does an old application still retain documents for reasons you do not understand? These are different questions, each supporting a specific request. “I want to protect my privacy” expresses an understandable concern, but does not identify the action you want the institution to consider.

Collect the facts you actually know: the service name, date of the form or message, information in question and organisation identified on the document. Keep these separate from assumptions about the cause. For example, a message arriving at an old telephone number establishes that this contact method was used; it does not, by itself, establish that an entire database was leaked. Precise wording prevents an unproven conclusion from obscuring the problem you can document.

Consider the practical objective too. You may want to update a contact number, understand why a piece of information is processed, learn the recipients of transferred data or seek examination of allegedly unlawful processing. Do not combine all these aims in one demand if they are unrelated to the event. Set them out in ordered points, placing the main request first, so that each part of the response can be followed up.

Who is the data controller?

The controller determines the purposes and means of processing, according to the authority’s definition. In practice, read the service’s privacy or information notice to identify the responsible organisation. An institution may use a technology provider, or a service may appear through a shared portal. The software name on screen is therefore insufficient to identify whom to approach about the data.

Do not rely on an email address from an old search result without checking that it remains the institution’s current channel. Open the official website and look for its data-protection information, privacy notice and data-subject request procedure. Record the published contact channel and the date you checked it. If the notice does not explain the organisation’s relationship to your service, ask for clarification rather than sending your documents to several organisations experimentally.

Where several institutions are involved in the same procedure, write a simple account for yourself: who first collected the data, who sent the message and who holds the record you want corrected? This requires separating roles, rather than drawing a complex technical diagram. The response may differ according to the record and organisation involved, so keep a separate correspondence reference for each controller you contact.

Read the information notice before consenting

KVKK identifies the information to be provided: the controller’s identity, processing purposes, possible recipients and transfer purposes, collection method and legal basis, and the data subject’s rights. Read these as useful questions for understanding the service. Looking for a consent button should not distract you from the institution’s identity or the distinction between data necessary for the procedure and additional choices in the interface.

Explicit consent is not the law’s only possible basis for processing. Official guidance identifies other conditions, including statutory provisions and legal obligations, subject to their requirements. An absent consent checkbox therefore does not automatically make processing unlawful, while ticking a general box does not make every use lawful. The specific questions are what purpose and legal basis the institution has stated for this processing, and what data it actually requests.

Imagine a public-service form containing mandatory and optional fields. Check why each field is requested and what happens if it is left blank. Do not enter guessed information merely to get past the screen. If the reason is unclear, enquire through the official channel. Retain the notice you read or its version date: comparing the purpose stated at submission with a later explanation is easier when the details are documented.

Rights you can ask about

The official rights page explains that a data subject may ask whether their data are processed and for what purpose, request information, identify recipients and seek correction of incomplete or inaccurate data. Rights also include requesting erasure or destruction under the applicable rules; notification to recipients of relevant corrections, erasure or destruction; objection to an adverse outcome resulting exclusively from automated analysis; and redress for harm caused by unlawful processing.

These rights do not mean every request must be accepted exactly as the applicant wishes. A correction request, for example, requires identifying the inaccurate information, whereas deleting a record raises the question of its retention basis. If a document relates to a public procedure, ask the institution to explain the scope of any correction or removal and its reasons. Removing an unnecessary copy differs from removing an entire transaction from an institutional record.

Distinguish your data from other people’s too. A connection to a family or administrative file does not mean all its contents relate solely to you or may be published. When discussing a problem on a forum, explain the type of error and how it was handled while concealing personal details. Retain the full version only for the necessary official procedure; publicly describing the case should not expose additional information.

Drafting a clear request to the controller

Begin with a subject line identifying a request concerning your data in a particular service. Identify the record or transaction to the extent necessary, then describe the information or action you are asking about. For example, explain that a message about a specific transaction reached a contact number you no longer use, and request information about the recorded details and an update to the relevant field through the approved procedure. This illustrates how to organise a request; it is not a form guaranteed to be accepted by every institution.

Attach evidence of the event where it helps: the message, its reference or an image of the relevant error. Do not send your entire administrative history or unrelated pages. If the institution needs identity verification, follow its published method and ask what is required if anything is unclear. Limiting unnecessary attachments protects your privacy and makes the central problem easier to understand.

If using a translator or representative, ensure they understand the difference between an enquiry, correction, erasure and complaint. Keep the wording actually submitted, rather than only your first draft. Explain the permitted use of documents to anyone helping you, especially where they contain health, financial or family information. Resolving a record problem does not require circulating copies in public groups or sending them to people uninvolved in the procedure.

Archive photograph of the Turkish Constitutional Court building from October 2020; it does not document a judgment or hearing in 2026.

What did the October 2026 announcement reiterate about written responses?

On 1 October 2026, the authority reiterated that the final response must be communicated in writing or electronically, stating whether the request was accepted or refused and giving reasons for refusal. Telephone or face-to-face contact may clarify a request or obtain additional information, but does not replace the required response. The announcement also restated the Article 13 requirement to resolve a request as soon as its nature permits, within a maximum of 30 days.

In practice, if an institution calls to ask for a file reference, record that the conversation sought additional information rather than necessarily answering all your requests. If an employee explains a solution orally, ask for the outcome through the approved written or electronic method. You can then establish which field was corrected, which point was not examined and when the outcome was communicated, instead of relying on a general impression that the matter has ended.

Keep the response with your original request and read them together. Mark each point as answered, needing clarification or refused with reasons. Do not read more into a short message than it states: updating one contact number does not establish that all the institution’s systems changed unless the response says so. Asking for the scope to be clarified is more precise than resending the entire request without identifying what remains unanswered.

The sequence from request to complaint

The authority explains that approaching the controller precedes a complaint to the Personal Data Protection Board, and distinguishes this sequence from taking a matter directly to court. Do not build a complaint file from scratch while ignoring the first request and response. Assemble both, with evidence of submission and notification dates, then read the authority’s current admissibility and submission requirements. The appropriate channel depends on the procedure you are pursuing, rather than every piece of correspondence simply being called a complaint.

The official complaint page explains refusal, an inadequate response and failure to respond within the prescribed period, together with deadlines linked to when the response became known and when the initial request was made. Do not reduce these relationships to one deadline supposedly applying to everyone. If a time limit is approaching or the issue overlaps with court proceedings, examine the current provisions and your circumstances separately. This article explains organisation and interpretation; it does not calculate a deadline for a transaction whose details are unknown.

Being in Türkiye or using an online portal does not settle every procedural question. Check identity-verification, representation and submission requirements appropriate to your status and documents. If you cannot access a digital service, seek official guidance on the approved alternative. Difficulty with an interface is not a legal determination of your rights or your complaint’s admissibility.

Reducing data exposure during follow-up

Keep an original document in an organised location, and use a redacted copy for public discussion. Remove identity numbers, barcodes, file references, contact details and signatures from the public version where unnecessary. Combined details can identify someone even after a name is concealed, such as a precise address and the date of an unusual event. Review the whole account, rather than only the name field, before sharing it.

For official correspondence, retain the information needed for verification and investigation, but send it only through the correct channel. Do not give your password or verification code to someone offering help, or submit documents through an untrusted link. Technical assistance may only require a redacted screenshot of the error message. The practical aim is to give the relevant organisation what the procedure needs while limiting circulation elsewhere.

If you discover a recipient error, stop adding attachments until you have confirmed the correct address, and record what you sent and where. Do not invent the cause of the error or the extent of document access. State the known facts and questions requiring an answer, then follow up with the competent organisations. This keeps the event verifiable and helps you seek an appropriate action instead of relying on general allegations of a leak.

Checklist before completing your follow-up

Identify the controller from the service’s official information notice.
Specify the information or action in question rather than making a general accusation.
Review the processing purpose, legal basis and rights described in the notice.
Submit a clear request through the published channel and retain proof.
Obtain a written or electronic response and examine its scope and reasons.
Keep the complete official version separate from a redacted public copy.
Check current complaint requirements and deadlines before taking another step.

Start with KVKK’s official website and its sections on data-subject rights, requests and complaints. Searching for the Turkish term corresponding to the right you need can help locate the relevant explanation, such as correction, provision of information or responses to requests. Your own message need not contain many technical terms: what matters is that its reader understands which data you mean and what outcome you want clarified.

Frequently asked questions

Is a telephone call saying the error was corrected enough?
The October 2026 reminder distinguishes contact to clarify a procedure from the final response required in writing or electronically. Request the response through the approved method, then check its description of the action taken. You may also need to examine the record or service through the institution’s procedure, because a brief oral statement does not always establish the extent of a correction.

Can I ask a public institution to delete all my data?
You can make a request under your rights and the applicable rules, but should not assume every record must be deleted. Specify the data and purpose of the request, and ask for the retention basis, outcome and reasons. Removing an unnecessary copy differs from handling a record linked to a legal obligation or an ongoing transaction; the response needs to explain what applies to the particular data.

Does every identity-document request establish a privacy violation?
No. Examine the organisation, purpose, legal basis, channel and information necessary for verification. If an additional request concerns you, ask why the procedure needs it and how it will be used, then retain the answer. Assessing the situation requires its content and circumstances, rather than merely noticing an identity field in a digital interface.

Should I publish the complete document so others understand the problem?
You can often explain the type of problem with a redacted copy or an account of the facts. Official procedures have their necessary attachments, whereas public discussion need not reveal your data or anyone else’s. Aim to exchange understanding and experience, keeping identifying details out of the discussion where they serve no necessary purpose.
Related topics

Protecting Personal Data When Dealing with Public Authorities in Türkiye: A Guide for 2026

سفير طرابزون

Active member