Data Monarchy in Turkey: Who Controls Customer Profiles and Digital Decisions? (2026)

Short answer. “Data monarchy” is a way to discuss concentration of information and digital decision-making power. It is not an independent offence under Turkish law. For businesses and individuals, the applicable framework includes Constitution Article 20(3), Law No. 6698 and, where market conduct is at issue, Competition Law No. 4054.

Have a general question about this article? Ask anonymously

This independent English article is written for international customers and executives working with services in Türkiye. Its examples and organisation are not a literal translation of the Turkish series.

Legal summary

The customer profile that follows a person across services

A shopper visiting a Turkish online marketplace may deliberately submit a delivery address and payment details. The same visit can also produce technical identifiers, search patterns, abandoned basket entries and advertising interactions. When a platform combines those observations, it may form a detailed profile that the shopper cannot easily reconstruct. The expression “data monarchy” describes the resulting imbalance in knowledge and practical control. It is a metaphor rather than an offence or an independent type of lawsuit in Turkish law. The relevant legal inquiry starts with what was actually collected and which natural person can be identified. Companies should resist treating every data point as their unconditional property simply because it was stored on their servers. They should equally avoid assuming that every sophisticated data analysis is unlawful. Legal consequences follow from specific processing operations, statutory obligations, and in appropriate cases competition conduct.

A scenario tailored to foreign-owned businesses in Istanbul

Consider an international retailer operating through a Turkish subsidiary and a local advertising agency. The shop uses order records to fulfil purchases, and the agency later combines that history with browsing patterns to calculate customer value scores. A manager then uses the scores to prioritise service requests. One record may have been obtained to deliver an order, while the new analysis may pursue a distinctly commercial purpose. The lawyer needs to determine the processing ground for each purpose, the controller’s identity, the information already given to customers, and whether an exclusively automated process produced a disadvantage. A foreign parent company cannot safely treat a broad global privacy policy as proof that every Turkish data flow is covered. At the same time, the presence of software-driven segmentation does not by itself establish wrongdoing. The audit should trace individual information from collection to its consequential use.

The Turkish Constitution protects more than secrecy

Article 20(3) of the Constitution of the Republic of Türkiye protects the right to personal data protection. It includes the right to be informed, to access information about one’s data, to ask for correction or deletion, and to learn whether data are used for the intended purposes. The constitutional guarantee is a legal starting point even when the application has its own lengthy privacy policy. The guarantee does not mean that all processing is forbidden: the constitution also recognises processing under legally defined conditions or valid explicit consent. For executives, the practical lesson is that users do not receive their only rights as a favour from a digital service. A contractual clause saying the provider may use “all data for any purpose forever” cannot automatically resolve purpose limitation, proportionality and other statutory conditions. The rights must be examined under Law No. 6698 and related rules.

Distinguish identifiable people from anonymous aggregates

Under Article 3 of Law No. 6698, personal data means information relating to an identified or identifiable natural person. Names are not the only identifiers. Customer numbers, linked device identifiers, transaction histories and some technical records may enable identification. Anonymisation is not established just by removing a first and last name; the ability to re-identify a person with other information remains significant. A chart showing genuinely aggregated demand may raise different issues from a table containing individually traceable preferences. Equally, purely corporate information does not automatically become personal data merely because a business regards it as confidential. Commercial secrets, database rights and contractual restrictions require separate examination. A technology company should classify datasets before assigning rights and obligations. This avoids both denying an individual’s statutory access rights and promising that a person may seize an entire database containing third-party records.

Article 4 applies even if processing has a legal ground

Article 4 requires lawful and fair processing, accuracy and updates where necessary, specified explicit legitimate purposes, purpose-connected limitation and proportionality, and retention no longer than required. These principles apply even when a controller relies on a recognised processing ground. A delivery address may be necessary to send purchased goods; that does not alone prove it is necessary to build an unrelated behavioural advertising model. The controller should therefore be able to state what a particular field accomplishes, how long it remains necessary, and why a smaller data collection would not suffice. Product teams must compare their documentation with actual analytics scripts, software development kits and backup processes. A privacy notice drafted before a major tracking system was installed can become inaccurate. The recurring discipline is to review new uses before deploying them, not after customers start requesting explanations.

Article 5: explicit consent is not the only option

A frequent misconception is that the Turkish Personal Data Protection Law requires explicit consent for every ordinary personal-data activity. Article 5(2) lists other grounds when their conditions are satisfied, including legal obligations, processing directly necessary for a contract and qualifying legitimate interests balanced against the individual’s fundamental rights. These exceptions do not turn a contract into an unlimited licence: a company cannot label unrelated advertising as indispensable merely by adding it to standard terms. Where consent is the chosen ground, the definition of explicit consent requires a specific issue, information and free will. Businesses should record the lawful ground by processing purpose rather than rely on one large checkbox. Special categories of personal data must be analysed under the amended Article 6, not simply by copying an ordinary-data assessment. Different purposes may lawfully rely on different legal bases.

Who actually determines the purposes and means?

An international data chain may include a Turkish subsidiary, a foreign parent, a local agency and an overseas cloud company. Article 3 distinguishes the controller, which determines purposes and means, from a processor acting on the controller’s authority. The entities’ contractual labels matter, but real conduct must also be examined. Who chooses the segmentation fields? Who can reuse records for its independent business? Which company decides how long records are retained? Who must answer a person’s request? The answers shape contractual responsibilities, transparency and security controls. A customer should not be passed endlessly between a local help desk and a foreign headquarters while the statutory response clock continues. Good governance documents the roles, access permissions and instructions with a detailed data-flow map. A group-wide privacy notice without local operational clarity is not the same as a legally adequate procedure.

An algorithmic score may have legal consequences

Article 11(1)(g) gives individuals a right to object to a result against them that arises from analysis exclusively by automated systems. The conditions are narrower than the proposition that all artificial intelligence outputs may be appealed in exactly the same way. A music recommendation and an automated refusal of an important opportunity are materially different. Determine whether the system made the decision exclusively, whether the result adversely affected the person and which information was used. Wrong input records may require correction. Automated profiling should not be presented as unchallengeable simply because the model is complex. Conversely, an individual does not acquire an unconditional right to receive proprietary source code merely by invoking Article 11. Requests should identify the contested outcome and the relevant legal entitlement rather than rely on a vague demand to reveal “the entire algorithm.”

What personal information can the customer request?

Article 11 allows individuals to learn whether their data are processed, obtain information about processing, understand the purpose and its proper use, and learn the third parties to whom their personal data are transferred in Türkiye or abroad. It also addresses correcting incomplete or inaccurate records and erasure or destruction when the conditions of Article 7 are met. Requests must concern personal data relating to the applicant; the provision is not a universal route to acquire another customer’s file or the platform’s confidential business methods. A carefully written application names the account and specific records or activities at issue. It explains whether the applicant seeks information, correction or erasure. The company should answer the actual statutory questions instead of sending the person to a general marketing page. Both sides benefit from keeping evidence of the request and response.

A request begins with the controller under Article 13

The normal statutory path is an application to the data controller in an accepted manner under Article 13. The controller must conclude the matter as soon as possible and no later than thirty days. Under Article 14, rejection, an insufficient response or failure to reply may permit a complaint to the Turkish Personal Data Protection Board within the applicable time limits. The precise time calculation depends on the date of response and statutory provisions. Foreign customers should keep the form submitted, message receipt, copy of the information notice and every dated reply. When a consumer claims harm from unlawful processing, administrative complaint and a potential claim for compensation under general rules are not identical remedies. A lawyer needs to choose the correct process for the actual claim rather than assume that a regulator can award every category of compensation.

Data concentration does not automatically equal market dominance

Personal-data regulation and competition law overlap in facts, not in every legal test. Law No. 4054 Article 4 addresses anticompetitive agreements and concerted practices, Article 6 prohibits abuse of dominance, and Article 7 addresses mergers and acquisitions that significantly impede effective competition. Possessing a large dataset or serving many users is not by itself an Article 6 infringement. An analyst must define the relevant market and examine the undertaking’s position and challenged behaviour. Switching costs, network effects and exclusive access to certain records may be relevant economic evidence. A marketplace’s use of third-party sellers’ trading information to compete against those sellers raises issues different from a merchant examining its own inventory. Competition allegations should identify the actual market conduct, dates and measurable exclusion or disadvantage instead of repeating a slogan about data power.

Lessons from the Meta and Threads proceedings

The Turkish Competition Authority’s proceedings regarding Meta and Threads illustrate the importance of procedural accuracy. In February 2024 the authority imposed a temporary measure connected with combining information obtained through Threads and Instagram. Commitments accepted in November 2024 ended the relevant investigation through that process. In June 2026 the Competition Board assessed a proposed arrangement for offering Threads again in Türkiye under those commitments. A temporary measure should not be described as a final finding on every alleged violation, nor does acceptance of competition commitments automatically establish universal compliance with privacy law. The actual business lesson is that combining information across services may deserve scrutiny beyond ordinary website analytics. Companies should record both the processing ground for the individual’s information and the competitive effect of access and combination in the relevant market.

The international transfer question has changed since 2024

A foreign-backed Turkish business may use global customer-management software, cross-border technical support and cloud data centres. International processing must be mapped against Article 9 as amended by Law No. 7499, effective 1 June 2024. The amended framework includes adequacy decisions, appropriate safeguards and narrowly defined exceptional situations. Standard contracts are one possible safeguard; Article 9(5) requires the relevant signed standard contract to be notified to the authority within five business days. The authority’s guidance also concerns the suitable contract model and authorised signatures. A generic statement that data are hosted “around the world” does not demonstrate fulfilment of these obligations. Nor does locating one server in Türkiye prove that remote support or backups never involve cross-border information flows. Actual recipients, purposes, countries and access permissions must be checked.

Security and retention remain separate obligations

Article 12 requires necessary technical and organisational measures to guard against unlawful processing and access and to protect personal data. An international vendor’s certificate cannot substitute for a client’s own access controls. Practical checks include role-based permissions, multifactor authentication, records of exports, encrypted channels, backup recovery tests and incident procedures. The storage period should relate to the documented purpose and continuing legal obligations. A company may need to retain some transaction records after a customer closes an account, but it should not preserve all profiling data indefinitely merely because the storage space is inexpensive. Successful data protection requires the operational ability to locate, correct and, where required, destroy records. A lawful international transfer arrangement does not waive the separate requirements of security, proportionality and transparency. Each obligation should have an accountable employee and an auditable procedure.

What an overseas board should demand from management

A board reviewing a Turkish operation should ask for a concise processing register organised by product, purpose and controller. For every major customer dataset, management should identify the lawful ground, recipient groups, retention rule, security owner and foreign-transfer mechanism if one exists. It should demonstrate how an individual may contact the controller and how the organisation counts the statutory response period. When a new predictive model is deployed, it should document data inputs, the decisions affected and the possibility of correcting wrong records. The procurement team should verify subcontractors and service-exit conditions. Compliance is not established by describing the company’s culture as “ethical AI”; it is demonstrated by evidence that the controls are functioning. This approach can lower the chance that a marketing technology deployment becomes a litigation, regulatory or reputation problem.

Evidence, remedies and institutional boundaries

A user alleging unlawful data processing should preserve the applicable notice, consent choices, dated correspondence, the contested automatic outcome and a record of what information was requested. A merchant alleging exclusionary marketplace conduct must collect different material: contract versions, access restrictions, comparative treatment, commercial records and the affected market. Loss of access to paid software may also create contractual claims separate from an individual’s data rights. The Turkish data protection authority, Competition Authority and civil courts do not offer interchangeable procedures. A powerful argument therefore begins with one specific event and an identifiable legal duty. Technical records should be obtained lawfully and third-party personal data in evidence should be protected. Where foreign actors and servers are involved, jurisdiction and the applicable law should be reviewed rather than assumed. This disciplined approach turns the broad “data monarchy” metaphor into practical legal analysis.

Related Turkish and English articles

• Turkish legal analysis: Veri Monarşisi
• Turkish SaaS provider locks an international business out of its records
• KVKK Article 11(1)(g): automated decisions

Official sources

• Turkish Data Protection Authority: Personal Data Protection Law (English)
• Authority guidance on international transfers
• Competition Authority: 2026 Threads decision
• Turkish Constitution

Frequently asked questions

1. Is data monarchy a crime in Türkiye?

No. The phrase is an analytical description, not a distinct statutory offence.

2. Can I discover which businesses received my data?

Article 11 provides access rights about recipients of personal data, subject to applicable conditions.

3. Must a platform always obtain explicit consent?

No. Article 5(2) contains defined alternative legal grounds for ordinary personal data.

4. Can an entirely automated result be challenged?

Article 11(1)(g) concerns an adverse result arising exclusively from automated analysis.

5. Are all data points automatically personal data?

No. The information must relate to an identified or identifiable natural person.

6. How long does the controller have to answer?

Article 13 provides a period of up to thirty days, with a duty to act sooner when possible.

7. Can I demand every source-code file?

Article 11 does not create an unconditional right to every proprietary software file.

8. May a foreign company use overseas cloud hosting?

Possible international transfers must comply with the amended Article 9 and other applicable rules.

9. Is collecting more data always illegal?

No, but Article 4 requires legitimate purposes, limitation and proportionality.

10. Does a large digital platform automatically abuse dominance?

No. The market and the specific conduct require a competition-law assessment.

11. What happens after a controller refuses a request?

Article 14 provides a complaint mechanism subject to procedural conditions and deadlines.

12. Where should a foreign customer begin?

Identify the Turkish data controller, relevant account and precise statutory information request.