Administrative Fine of TRY 1,000,000 Imposed for Unlawful Processing of Personal Data

The Personal Data Protection Board (Board) issued its Decision dated 10 June 2026 and numbered 2026/1183 (Decision) following its examination of a savings finance company.

In the complaint submitted to the Board, it was alleged that the data controller collected contact information of third parties from its customers under its “brand ambassador” program, paid premiums to brand ambassadors in return for providing such information and obtained the data subject’s contact number through this method and subsequently contacted the data subject by SMS and phone calls for marketing purposes.

In its defense, the data controller stated, in summary, that the data subject’s phone number had been entered into the system by a customer on the grounds that the data subject wished to receive information, and that during the subsequent call with the call center, the obligation to inform was fulfilled and the data subject gave explicit consent by stating that they wished to continue receiving information. The data controller further stated that the data subject’s application was responded to within 30 days and that the data subject’s personal data was deleted from the system following the application.

In the Decision, the Board made the following findings and assessments:

The data subject’s continuation of the conversation did not constitute valid explicit consent.

The Board found that, after the data subject’s contact information had been entered into the system by a third party, the data subject was contacted and the promotion of the campaign continued without the data subject being informed or directed to a channel through which the relevant information could be provided. The data subject’s interest in the promotion and continuation of the conversation was considered to constitute merely implied consent and were not accepted as valid explicit consent under the Personal Data Protection Law No. 6698 (Law).

The Board emphasized that explicit consent must relate to a specific subject, be based on information and be given freely, and that the data subject must be informed before the processing of personal data begins. The Board also found that the data subject had not been duly provided with the required information regarding the recording of the calls.

The processing of personal data without a valid legal basis under the brand ambassador program was unlawful.

The Board found that the data subject’s personal data was processed without relying on any of the legal bases for processing set forth under Article 5 of the Law. The Board further concluded that this assessment also applied to other individuals whose personal data was processed through the same method under the brand ambassador program and that such processing activities carried out under the program were therefore unlawful.

Data security obligations were not fulfilled.

The Board found that recording contact information obtained from third parties in the system without a valid legal basis and subsequently using such information for marketing purposes violated the obligation under Article 12 of the Law to take the necessary administrative and technical measures to prevent the unlawful processing of personal data. Although the Board did not separately specify the measures that should have been taken, it considered the process that allowed personal data to be obtained and processed without a valid legal basis under the brand ambassador program to be insufficient in terms of data security obligations.

The Board also decided that there was no need for a separate examination regarding the obligation to inform, considering that the data subject’s personal data had been processed without any valid legal basis. In addition, since it was established that the data controller had responded to the data subject’s application within the statutory period, the Board decided that no further action was required in this respect.

Accordingly, the Board imposed an administrative fine of TRY 1,000,000 on the data controller pursuant to Article 18(1)(b) of the Law.

The Decision is particularly relevant for data controllers operating referral, recommendation or brand ambassador programs based on contact information obtained from third parties. In this context, it is important to assess the legal basis for processing personal data obtained through third parties and to implement necessary administrative and technical measures in connection with such processing activities.