October 2026 – Important developments in artificial intelligence and data protection took place in Türkiye in September 2026. The government’s Medium-Term Programme for 2027–2029 outlined plans to align Turkish data protection legislation with the GDPR and establish a national AI legislative framework. Meanwhile, the Turkish Personal Data Protection Authority (the “DPA”) published guidance on personal data protection obligations in legal practice, including the use of generative AI.
A series of data breach notifications also highlighted the cybersecurity risks associated with third-party service providers and the potential impact of a single security incident on multiple organisations.
In this edition of Quick Read, we highlight the key developments and their practical implications for organisations operating in Türkiye.
Developments in Artificial Intelligence
Türkiye Sets Out Plans for AI Regulation and GDPR Alignment
On 6 September 2026, the Medium-Term Programme for 2027–2029 was published in the Official Gazette, setting out the government’s priorities for data protection reform and AI regulation.
The Programme outlines two key regulatory objectives:
- GDPR Alignment: to complete the legislative and administrative preparations to bring the Turkish Personal Data Protection Law (the “DP Law”) more closely into line with General Data Protection Regulation (“GDPR”) by the third quarter of 2027;
- AI legislation: to develop a national AI legislative framework, taking into account the EU’s regulatory approach, by the first quarter of 2027.
The Programme also seeks to strengthen Türkiye’s domestic AI capabilities by supporting Turkish-language generative AI models, expanding computing infrastructure, and encouraging AI adoption across public institutions.
The proposed timelines relate to preparatory legislative work and should not be interpreted as confirmed dates for the enactment or entry into force of new legislation.
Data Protection Highlights
1. Data Protection in Legal Practice: DPA Guidance for Lawyers
On 22 September 2026, the DPA published on its website the Guide on the Protection of Personal Data in the Professional Activities of Lawyers, prepared with the contribution of the Union of Turkish Bar Associations.
The Guide addresses the application of data protection requirements to legal practice, including lawful processing, domestic and international data transfers, the use of generative AI tools, and data security.
It clarifies that lawyers generally act as data controllers where they determine the purposes and means of processing personal data. It also emphasises that exemption from specific requirements, including registration with the VERBIS, do not remove other obligations under the DP Law.
The Guide also addresses the use of generative AI in legal practice. It highlights the risks associated with uploading client documents and personal data to AI tools and adopts a risk-based approach to different uses of AI in legal practice. The Guide emphasises that lawyers remain responsible for their legal work and must verify AI-generated outputs before relying on them.
2. September's Data Breach Notifications
During September, the DPA published several data breach notifications involving unauthorised access to systems operated by third-party service providers.
A number of notifications concerned organisations whose data was held in data processor systems, illustrating how a security incident affecting a service provider can expose multiple customers to data protection and operational risks.
These incidents underscore the importance of assessing cybersecurity risks throughout the lifecycle of a service provider relationship, rather than relying solely on checks conducted during onboarding.
Businesses should review the security arrangements of service providers that process personal data on their behalf. In particular, they should:
- Assess security safeguards: Evaluate providers' technical and organisational security measures and verify the scope and validity of relevant security certifications.
- Strengthen contractual protections: Include clear security standards, incident notification obligations, cooperation requirements, and appropriate audit rights in service agreements.
- Maintain ongoing oversight: Periodically review providers' security practices and ensure that incident response procedures allow for timely assessment and notification of data breaches.
These measures can help businesses identify vulnerabilities, respond more effectively to incidents, and manage their obligations under the DP Law.
3. Data Breach Notification
The DPA's data breach notifications published for September 2026 may be accessed from this link.