I. Introduction
The Turkish Personal Data Protection Board’s Decision dated 22 July 2026 and numbered 2026/1491 was published in the Official Gazette dated 13 August 2026 and numbered 33339. The Decision extends the compliance period for verifying third-party use in loyalty-card transactions until 28 February 2027.
The extended period was established by the Board’s Principle Decision dated 11 February 2026 and numbered 2026/266. Published in the Official Gazette dated 28 February 2026 and numbered 33182, the Principle Decision requires an end to practices that allow a third party to use a cardholder’s mobile telephone number or loyalty-card number during a purchase without verification. Data controllers must establish appropriate mechanisms to verify that the transaction is carried out with the cardholder’s knowledge and consent.
The Principle Decision gave data controllers a six-month compliance period, running from the date of its publication in the Official Gazette, to establish these mechanisms; that period was due to end on 28 August 2026. Following requests from the sector, Decision No. 2026/1491 extended only the end date of the compliance period to 28 February 2027. The legal assessment, verification objective, and technical and administrative measures in the Principle Decision remain unchanged.
II. Scope and Legal Basis of the Principle Decision
Transactions Subject to Verification
Principle Decision No. 2026/266 addresses the practice whereby a third party gives a cardholder’s mobile telephone number or loyalty-card number to checkout staff and the purchase is associated with the cardholder’s account without the cardholder’s involvement. The Board found that this method was used to obtain discounts and promotions or accrue points, and that purchase information—and, in some cases, an invoice—could be attributed to the cardholder. Recording in a customer account a transaction that the cardholder neither made nor knew about is incompatible with the principle that personal data must be accurate and, where necessary, kept up to date.
The Board considered that processing carried out in this manner could not rely on any of the processing conditions under Article 5 of Law No. 6698 on the Protection of Personal Data. A provision in the loyalty-card membership agreement prohibiting third-party use of the card does not relieve the data controller of its data-security obligations under Article 12. Leaving responsibility solely with the cardholder therefore cannot replace a verification mechanism.
Transactions Covered by Verification
The verification requirement under the Principle Decision is not limited to the redemption of accumulated points. It applies whenever a loyalty card is used for different purposes during a purchase, including the creation of a membership, the accrual of points, and access to a discount or promotion. For each of these transactions, the matter to be verified is whether the transaction was carried out with the cardholder’s knowledge and consent.
The same verification method need not be used for every transaction type. Data controllers may select different mechanisms for membership verification, earning points or discounts, and redeeming points, depending on the nature and risk of the transaction. Compliance work should first identify the transactions and channels in which the loyalty card is used and then assign an appropriate verification method to each one.
III. Designing the Verification Mechanism
Alternative and Risk-Proportionate Methods
The Principle Decision does not prescribe a single technical method. One-time codes sent by SMS, barcodes or QR codes provided through a mobile application, and similar tools are identified as familiar examples of verification. Data controllers may offer alternative methods to accommodate differences in age, education, economic circumstances, and technological literacy. Different controls may likewise be used for membership verification, point accrual, access to discounts, and point redemption in proportion to the risk involved.
The chosen methods must establish a transaction trail capable of showing that a particular purchase was made with the cardholder’s knowledge and approval. If the programme can be used at a physical checkout, through a website or mobile application, via a call centre, or through another channel, every actual flow exposed to third-party use must be tested against the same control objective. Strong verification in one channel does not remedy unauthorised use through another channel with weaker safeguards.
Distinguishing Transaction Verification from Explicit Consent
The expression “with the knowledge and consent of the data subject” in the Principle Decision concerns verification of whether a transaction involving third-party use of the loyalty card or membership details was carried out with the cardholder’s knowledge and approval. The customer must therefore be told clearly which purchase or account transaction is being approved through the code or other verification method.
The cardholder’s approval of a particular transaction should not be treated as general explicit consent for other personal-data processing activities within the loyalty programme. Verification of the transaction does not replace the explicit consent that must be obtained separately for marketing, profiling, commercial electronic communications, or another processing activity that requires explicit consent. The Board’s Principle Decision dated 10 June 2025 and numbered 2025/1072 (Official Gazette dated 26 June 2025 and numbered 32938) likewise confirms that legally distinct actions—such as approving a membership agreement, giving explicit consent, and consenting to commercial electronic communications—should not be bundled into a single SMS verification code, and requires the purpose of the code to be explained to the data subject. Each action must be managed through a separate choice and record-keeping process consistent with its own purpose and legal requirements.
IV. Records, Contracts and Organisational Measures
Verification Records and Process Ownership
The ability to explain a verification event after it occurs is as important as the operation of the mechanism itself. The data controller should establish a proportionate record-keeping framework showing the transaction channel, time, type, verification method, and outcome, together with any error or exception process used. Rather than retaining the full verification code or personal data unnecessary for the transaction, the controller should prefer limited evidence sufficient to show that the control was completed successfully and which rule determined the outcome.
Principle Decision No. 2026/266 does not prescribe a specific log format or retention period. The scope and retention of records should be determined by the processing purpose within the loyalty programme, the transaction risk, dispute and breach-management needs, and the controller’s general retention and destruction policy. Legal and data-protection teams should define the applicable processing conditions and evidentiary standard, technology teams should own the technical controls, and operational teams should own checkout and customer-service procedures.
Technology Providers and Audit
Under Article 12 of Law No. 6698, where personal data is processed by another natural or legal person on behalf of the data controller, the controller and processor are jointly responsible for taking the necessary measures. Using external providers for the loyalty platform, messaging services, mobile application, customer relationship system, or call-centre infrastructure does not relieve the retailer of its control and audit obligations.
Supplier agreements should clearly regulate roles in the verification flow, access rights, change management, security-incident notification, use of sub-processors, provision of records, and audit rights. The technical provider’s service-level commitments should cover not only system availability, but also controls preventing verification from being attributed to the wrong account and the evidence required to correct an erroneous transaction.
Regular training for checkout and customer-service staff is a separate administrative measure. Staff should distinguish the purpose of requesting a transaction-verification code from the process for obtaining marketing consent. They should not enter the code on the customer’s behalf, should use the defined authorisation route for exception requests, and should not complete a transaction through another account after verification fails.
V. Compliance Before 28 February 2027
Decision No. 2026/1491 changes only the end date of the compliance period. The legal assessment, verification objective, and technical and administrative measures set out in Principle Decision No. 2026/266 remain unchanged. The extension does not, however, provide a basis for continuing unverified third-party use indefinitely. The additional period should be used to design, implement, and demonstrably test multi-channel systems.
The first phase should identify every channel, transaction type, data flow, and supplier involved in the use of the loyalty card. The controller should determine which transactions can be completed using only a telephone or card number, which records are attributed to the cardholder’s account, and who authorises existing exceptions. This inventory should inform the choice of whether higher-risk actions such as point redemption or account changes and lower-risk flows such as point accrual should be subject to the same control.
The next phase should approve the verification options, accessible alternatives, and customer communications. End-to-end testing should then cover the physical checkout, e-commerce, mobile application, and support channels. Testing should address not only successful transactions, but also incorrect codes, expiry, customers without access to the registered device, refunds, cancellations, account corrections, and service interruptions. Supplier agreements, staff instructions, incident-management procedures, and audit evidence should then be completed so that the production system is validated before 28 February 2027.
Data controllers found to continue practices contrary to Law No. 6698 without taking the measures specified in the Principle Decision will be subject to action under Article 18. This enforcement link means that the compliance file should contain more than policy documents: it should demonstrate an operating technical control, training records, test results, and audit evidence.
VI. General Assessment
The loyalty-card verification requirement is a data-security measure intended to prevent a purchase made without the cardholder’s knowledge from being associated with that person’s transaction history, point balance, or documents issued in their name. The Board does not require a single verification tool and permits alternative methods for different groups and transaction risks. However, leaving a channel exposed to third-party use without verification, or attempting to transfer all responsibility to the customer through the membership agreement, is insufficient.
The work to be completed by 28 February 2027 should separate transaction approval from explicit-consent processes, test every usage channel, create proportionate verification records, update processor agreements, and train operational teams. Compliance therefore means establishing a lawful and auditable transaction trail throughout the loyalty programme, rather than merely introducing a code prompt at the end of the period.
