The Personal Data Protection Authority’s bulletin titled “Selected Recent Developments Regarding the Protection of Personal Data—No. 62”

The Personal Data Protection Authority has published a bulletin titled “Selected Recent Developments Regarding the Protection of Personal Data – 62,” which compiles national and international developments in the field of personal data protection. On the national front, the bulletin includes the publication in the Official Gazette of the Decision on Principles regarding the monitoring of corporate email and communication channels, a practical guide for attorneys, a public announcement regarding the notification procedure for responses to data subject requests, and the 12th issue of the KVKK Bulletin.

The main focus of international developments is artificial intelligence governance and cybersecurity. The topic that could have the most direct implications for corporate data controllers is the European Data Protection Board’s draft guidance outlining a five-step approach to the exercise of its authority to impose administrative fines. Assessments of “Shadow AI” and “Agentic AI” applications, along with the “EU KIDS Act” proposal aimed at protecting children online, are other prominent topics in the bulletin.

National Developments

• A Decision on Principles regarding the monitoring of corporate email and communication channels has been published. The Personal Data Protection Board’s Decision No. 2026/2035 dated September 16, 2026, titled “Procedures and Principles to Be Observed in Personal Data Processing Activities Conducted Through the Monitoring of Communication Channels Used for Business Purposes, Communication Channels Used for the Purpose of Conducting Business,” was published in the Official Gazette No. 33394 dated October 8, 2026. For a detailed review, see our announcement on the Principle Decision on Corporate Email Monitoring.
• An implementation guide for attorneys has been published. The “Implementation Guide on the Protection of Personal Data in the Professional Activities of Attorneys,” prepared in collaboration between the Authority and the Union of Turkish Bar Associations, was published on September 22, 2026. For a detailed analysis, see our announcement regarding the KVKK implementation guide for attorneys.
• The notification procedure for responses to data subject requests has been clarified. In the “Public Announcement Regarding the Notification Procedure for Responses to Data Subjects’ Requests,” published on the Authority’s website on October 1, 2026, it was clarified that responses provided solely via telephone calls, in-person briefings, or similar verbal communication methods are not considered valid responses as required by law. For a detailed assessment, see our announcement on the notification procedure for responses to data subject requests.
• The 12th issue of the KVKK Bulletin has been published. Published on September 29, 2026, and focusing on the theme “Smart Devices and Digital Privacy,” this issue covers the importance of digital privacy in the data age, privacy by design, the Internet of Things, the ten golden rules for smart device users, mobile applications, the use of smart glasses, and children’s digital privacy. For a detailed review, see our announcement regarding KVKK Bulletin Issue 12.

International Developments

• The EDPB has opened its guidance on the authority to impose administrative fines for public comment. The guidance outlines a five-step method that data protection authorities can follow when deciding whether to impose an administrative fine: determining whether the violation is subject to a fine; assessing whether an administrative fine can be imposed on the party under investigation for the relevant violation; examining whether the violation was committed intentionally or through negligence; taking into account aggravating and mitigating factors; and evaluating whether the administrative fine will be effective, proportionate, and deterrent.
• The EDPB has published the final version of its guidance on the interaction between the DSA and the GDPR. Published following a public consultation process, the guidance addresses the interaction between the Digital Services Act and the General Data Protection Regulation.
• The European Commission has presented the “EU KIDS Act” proposal aimed at protecting children online. Under the proposal, children under the age of 13 would be prohibited from creating social media accounts; those aged 13–14 would be able to use accounts under parental supervision and subject to certain conditions; and those aged 15 and older would be able to create independent accounts.
• The Irish Data Protection Authority published its report on artificial intelligence oversight activities. The report, covering the years 2021–2025, notes a significant increase in AI-related engagements; emphasizes that innovation and data protection are not mutually exclusive concepts; and highlights significant improvements in the areas of legal basis, transparency, data minimization, and the protection of children with regard to large language models and recommendation systems. The application of the legitimate interest legal basis and the assurance of transparency in AI training are listed among the Authority’s key focus areas; it is stated that the Authority stands ready to intervene immediately in cases where risks cannot be adequately mitigated.
• The NCSC addressed the cybersecurity risks posed by “shadow AI.” The UK National Cyber Security Center defines shadow AI as the use of AI technologies that fall outside an organization’s approved systems and processes; it highlights that a study found nearly three-quarters (71%) of employees use AI tools not approved by their employers. Risks include the exposure of sensitive information, a reduction in the organization’s visibility and control over its data, and the creation of new opportunities for attackers; recommendations include understanding why employees turn to unauthorized tools, adopting a positive cybersecurity culture that encourages open communication, and securely integrating AI systems into the workplace.
• The OECD shared its early-stage findings on the use of active AI in organizations. Based on interviews with 25 organizations across various regions and sectors, the study notes that active AI systems are moving beyond experimental applications and beginning to be incorporated into organizational workflows; the level of maturity varies among organizations, and governance and technical measures are still in the early stages. Measures adopted by organizations include gradually increasing the level of autonomy, establishing human checkpoints for high-risk actions, and designing systems in collaboration with domain experts; the report also notes that challenges persist in the areas of assessment and assurance, cybersecurity, accountability, and traceability in multi-agent systems.
• On the cybersecurity front, two comprehensive guides have been published. The European Union Agency for Cybersecurity (ENISA) released its “Threat Landscape 2026” report, which analyzes incidents observed between January 1, 2025, and December 31, 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has shared an updated version of its guidance on mitigating insider threats; the update addresses issues raised by the increasing prevalence of hybrid and remote work arrangements and the use of artificial intelligence in relation to insider threats.
• The European Parliamentary Research Service (EPRS) published a briefing note addressing the relationship between artificial intelligence and crime. The note, prepared by the European Parliamentary Research Service, covers AI-enabled attacks (social engineering, phishing and fraud, deepfakes, and AI-generated malware), malicious actions stemming from vulnerabilities in AI models, the use of AI in law enforcement, and the legal framework surrounding the issue.
• The EDPS examined the secure multi-party computation method. As part of its TechDispatch series, the European Data Protection Supervisor published a document addressing “secure multi-party computation,” a privacy-enhancing technology.
• Artificial intelligence in education was evaluated in three separate studies. UNESCO published a compilation of 26 evaluation papers on the future of education in the age of artificial intelligence and algorithms. The European Commission shared a report examining the impacts of the use of generative artificial intelligence in education on students, teachers, and parents. The European Parliamentary Research Service, meanwhile, published a briefing note on strengthening the European cloud and artificial intelligence ecosystem.

Recommended Steps for Data Controllers

• Under Principle Decision No. 2026/2035, which entered into force upon publication in the Official Gazette, existing audit practices regarding corporate email and other communication channels, employee disclosure notices, and workplace communication policies should be reviewed as a matter of priority.
• To address the risk of “shadow AI,” identify AI tools actually in use within the organization; create a list of approved tools, implement technical control and monitoring mechanisms, and adopt an approach that encourages open communication by understanding the reasons why employees turn to unapproved tools.
• If active AI systems are in use or planned, the level of autonomy should be increased gradually; human control points should be defined for high-risk actions; traceability should be ensured in multi-agent systems; and the existing governance framework should be adapted to cover these systems.
• When personal data is processed during the training of AI models or in recommendation systems, the legal basis—particularly the balancing test if based on legitimate interest—and transparency measures must be documented in writing; additional assessments must be conducted regarding data minimization and the protection of children.
• The organization’s position in the event of a potential data breach must be assessed in advance; factors such as intent or negligence, as well as aggravating and mitigating circumstances, must be identified and reflected in the breach response procedure and documentation practices.
• For organizations that provide services to children or have access to child users, age verification, parental supervision, and account creation processes must be reviewed.
• Updating internal threat and cybersecurity programs to account for hybrid and remote work arrangements and the use of artificial intelligence; reassessing access permissions, monitoring, and incident response processes within this framework.

You can access other announcements regarding the protection of personal data prepared by MC Legal on our Announcements page.