REGULATIONS ON PERSONAL HEALTH DATA AMENDMENTS PUBLISHED IN THE OFFICIAL GAZETTE

Significant amendments were made to the Regulation on Personal Health Data, published in the Official Gazette dated June 21, 2019, and numbered 30808, with the Official Gazette dated December 3, 2025, regarding the rules on the processing, access, and protection of health data. These significant amendments are as follows:

• The requirement for explicit consent for lawyers to access health data has been removed. The article requiring a special provision in the power of attorney containing explicit consent regarding special category personal data has been completely repealed.

• The conditions for physicians to access individuals' past health data have been redefined. According to the new regulation, access to health data is determined as follows:
• For family doctors, without any time limit,
• For the examining physician, until the treatment is completed,
• For physicians at the relevant health facility, during the treatment period,
• For physicians working at the hospital where the patient is admitted, until the patient is discharged,
• For emergency room physicians, access to data will be limited to emergency services.
• Definition of “caregiver”: “The child's guardian or custodian or natural or legal persons authorized to be responsible for their care and supervision”.

• Access to health data by parents and caregivers is regulated as follows:
• The parent with temporary custody will be able to access the child's health data during the proceedings.
• The parent with custody after divorce will have direct access.
• The parent without custody will only be given data related to the child's health, with their address and contact information concealed.
• Caregivers will be able to access the data of persons with disability reports.

• Security settings have been updated on E-Nabız, allowing individuals to limit data access with their own security settings. Access to past health data is conditional on sharing the code sent to the individual's phone with the physician. In cases where the security code cannot be accessed due to reasons such as detention or imprisonment, family doctors and examining physicians are granted exceptional access within the framework of KVKK Article 6/3.

• The storage period for the health data of deceased persons has been extended from 20 years to 30 years.

• Internal data access rights have been restricted. Access to health data by users authorized at the request of the unit manager will now be limited only to the processing conditions under KVKK Article 6/3.

With these amendments to the Regulation, the processing and access processes of health data have been made much more compliant with the provisions of the KVKK. In addition, the processes for processing personal data due to medical necessity have been made more balanced.

You can access the Official Gazette announcement regarding the Amendments to the Regulation on Personal Health Data here.