By way of background, the Personal Data Protection Board (“Board”) had published a Principal Decision dated 11 February 2026 and numbered 2026/266 on the “Use of a Loyalty Card Holder’s Mobile Phone Number or Loyalty Card Number by a Third Party During a Purchase” (“Principal Decision”).
The Principal Decision aimed to prevent loyalty card holders’ mobile phone numbers or loyalty card numbers from being used by third parties during purchases without the knowledge and consent of the relevant card holders. In this context, data controllers were required to implement appropriate verification mechanisms and were granted a six-month compliance period to do so.
On 13 August 2026, the Personal Data Protection Authority (“Authority”) announced, through a
public announcement, that the compliance period granted to data controllers had been extended.
Accordingly, pursuant to the Board’s
resolution dated 22 July 2026 and numbered 2026/1491, the compliance period stipulated under the Principal Decision has been extended until
28 February 2027.
Data controllers are therefore required to bring their loyalty card practices into compliance with the Principal Decision by 28 February 2027.
For further information on the measures to be taken and the verification methods that may be implemented in this context, please see our legal update on the Principal Decision available
here.
Aslı Kınsız, Managing Associate
Sevim Özkan, Associate