I. Introduction
The Personal Data Protection Board’s Decision No. 2026/1301, dated 1 July 2026, was published in the Official Gazette dated 28 July 2026 and numbered 33323 as the Principle Decision on the Online Sharing of Personal Data by Data Controllers with Public Legal Personality. It addresses personal data published on websites, social media accounts and comparable channels by public institutions, municipalities, special provincial administrations, universities and other data controllers with public legal personality. The Decision does not set a separate transition period or a fixed number of days. It requires existing publications to be reviewed “urgently”.
Publishing a document containing personal data online discloses the data and makes it available to third parties. The Board therefore treats the publication itself as a personal data processing activity. The fact that a document relates to a public body’s statutory functions does not, by itself, justify publishing the document in full on the open internet. Each publication must rely on a processing condition under Personal Data Protection Law No. 6698 and must also comply with the general principles applicable to processing, including lawfulness and fairness, accuracy, specified and legitimate purposes, data minimisation and retention only for the period required by law or by the processing purpose.
The Principle Decision is directly addressed to data controllers with public legal personality. It does not impose its instructions as a general and direct publication rule for private-law companies, nor does it create an independent obligation for private service providers. Its addressee boundary must therefore remain confined to public-law data controllers.
II. Scope Of The Decision And The Legal Character Of Online Publication
The Principle Decision is not confined to a review of websites and social media accounts. It also requires the same standards to be observed when personal data is shared through internal or inter-institutional correspondence, emails, announcements, closed electronic environments, notice boards and bulletin boards. This additional channel layer requires a separate review of internal and restricted-access sharing alongside the audit of publicly available content.
The publications identified by the Board contain much more than names and contact details. The Decision lists parents’ names, age, Turkish identity numbers, addresses, places of birth, profession, area of expertise, workplace, title, years of service, registration number, unit, military-service and education data; block and parcel information concerning real estate subject to public lotteries; and examination or application numbers, KPSS scores, pass-fail information, correct and incorrect answers, student or candidate numbers, missing-document information and former-convict status. The breadth of these examples means that a publication review cannot be limited to obvious identifiers or to a single document type.
Online publication carries a greater data security risk than sharing the data in a more restricted environment with a more limited group. The Decision consequently treats the access channel as a separate legal design question. If the legitimate objective can be achieved by allowing access only to participants or to the individual concerned, an access-controlled method should replace open publication.
III. Processing Conditions, Data Minimisation And Publication Periods
An online publication must first rely on a valid processing condition. Article 5 of Law No. 6698 applies to ordinary personal data, while Article 6 governs special categories of personal data. The Decision gives processing expressly provided for by law and processing necessary for the data controller to comply with a legal obligation as examples. If no valid processing condition exists, the personal data should not be shared online.
A processing condition does not automatically permit publication of every field in a document or unrestricted access to the document. The data must be limited to the minimum necessary to achieve the publication purpose. If an examination result can be distinguished by a candidate-specific reference, publishing a Turkish identity number, home address, telephone number, parents’ names or unrelated personnel information would not satisfy the proportionality requirement. The connection between each data category and the purpose of the announcement must be established rather than assumed from the document template.
The duration of publication is part of the same assessment. The Decision requires the availability period to be determined by reference to the period prescribed by applicable law or required for the processing purpose, followed by the steps necessary to end publication. A lawful basis for announcing an examination, lottery, appointment or application result at the relevant time does not automatically justify keeping the document in an open archive for years. The publication date, approved availability period and removal date should be traceable in the same record.
Transparency and security obligations accompany the analysis of processing conditions, minimisation and duration. Under Article 10 of Law No. 6698 and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform, the data controller must provide the required information and be able to demonstrate that it has done so. Article 12 requires administrative and technical measures reflecting the access and reuse risks created by online publication, together with internal audits of the implementation of the Law.
IV. Measures For Existing Online Content
The correct measure is not the same for every document. For existing publications, the Decision preserves removal and masking or comparable adjustment as alternative responses after the processing condition and compliance with the general principles have been assessed together. Destruction must be considered separately where the grounds for processing have ceased, while authenticated or restricted access addresses results that still need to be available without remaining open to the public.
Removal From The Internet
Personal data for which no valid processing condition exists must not be published online, and an existing publication must not remain publicly accessible. Where both a valid processing condition and a continuing lawful publication purpose exist, but the defect concerns unnecessary fields or proportionality under the general principles, the response cannot be reduced automatically to one measure. Removal, masking or a comparable adjustment should be selected according to the nature of the defect, the data category, the publication purpose, the period of availability and the access model.
Removal makes the document unavailable on the public website or social media channel. It does not necessarily determine whether an underlying record must remain in the public body’s official file. Continued storage must be assessed under the applicable retention obligation. Taking a document off the internet and destroying all copies held by the institution are therefore separate actions.
Masking And Content Adjustment
Where publication has a valid processing condition and a continuing purpose but the document includes fields that are unnecessary for that purpose, masking or a comparable adjustment may be selected. Masking can preserve the operative content of an announcement while concealing all or the necessary part of a Turkish identity number, address, telephone number, registration number or another identifier. The fields to be masked are determined by the data category and publication purpose. Publishing every field contained in a standard document template does not replace a proportionality assessment.
Masking is not sufficient in every case. If unnecessary fields cannot be separated, the publication period has expired or open access is incompatible with the publication purpose, the content must be removed or the access model must be changed. Masking is therefore one available intervention, not a universal substitute for removal.
Destruction
Where the reasons requiring the processing have ceased to exist, the issue extends beyond ending the online publication. The Principle Decision refers to Article 7 of Law No. 6698 and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, and requires the necessary destruction measures. This assessment must also address whether retention of the data in the institution’s other systems continues to have a legal basis. Removal of the public web copy does not authorise indefinite retention of other copies for which the processing ground has ended.
Authenticated And Restricted Access
An examination, lottery or comparable result may still need to be made available without being published to the public. If the circumstances require participants to verify each other’s results, access can be limited to the participants in that activity. Where no such verification need exists, each person can be given access only to their own result. The Decision identifies suitable e-Government platforms and methods using two-factor authentication for identity verification as appropriate examples. The access model should be based on the nature of the result, the verification need, the data categories and the intended user group.
V. General Assessment
Implementation requires more than a one-time search of website domains and social media accounts. For each publication, the responsible unit, data categories, processing condition, publication purpose, audience, start and end dates, transparency record, masking or removal measure and completion date should be documented. The same record supports both the urgent review of existing content and a pre-publication check for new material. Because “urgently” is not a fixed statutory calendar period, the relevant evidence is a review initiated without delay and carried out through a traceable process.
The Principle Decision also expressly requires training and awareness work for employees, particularly those responsible for websites and social media platforms. Training should be supported by an allocation of duties showing who may approve a publication, which document fields may not be placed on the open internet, how the publication period is set and who implements a masking or removal decision. The data controller must also conduct or commission the audits necessary to ensure internal implementation of the Law.
A finding that the measures in the Decision were not taken does not produce an automatic administrative fine without an investigation. The Board states that it will assess the specific case within its investigatory powers and take action under Article 18 of Law No. 6698 against the relevant data controller. The enforcement risk therefore depends on the content and scope of the publication, the categories of data, the processing condition, the access model, the publication period and the administrative and technical measures adopted. For data controllers with public legal personality, the practical response is to classify existing publications without delay and record the legal basis for selecting open access, restricted access, masking, removal or destruction for each item.
