The Personal Data Protection Board (“the Board”), within its legal authority, may impose various administrative sanctions on data controllers who act in violation of personal data protection legislation. These sanctions may take the form of administrative fines or administrative measures depending on the nature of the violation. The Board is authorized to impose administrative fines particularly in the following situations:

• Failure to fulfil the obligation to inform: If data controllers fail to inform data subjects regarding their personal data processing activities, an administrative fine between TRY 68,083 and TRY 1,362,021 may be imposed.
• Failure to fulfil obligations relating to data security: If data controllers fail to take the necessary technical and administrative measures to ensure the security of personal data, an administrative fine between TRY 204,285 and TRY 13,620,402 may be imposed.
• Failure to comply with the decisions of the Board: If a data controller fails to comply with a decision issued by the Board, an administrative fine between TRY 340,476 and TRY 13,620,402 may be imposed.
• Violation of the obligation to register with the Data Controllers’ Registry (“VERBIS”): Data controllers who are legally obliged to register with or notify VERBIS but fail to do so may be fined between TRY 272,380 and TRY 13,620,402.
• Failure to notify the Authority of standard contracts within 5 business days: If standard contracts used for the international transfer of personal data are not notified to the Board within the prescribed period, a fine between TRY 71,965 and TRY 1,439,300 may be imposed.

In addition to the aforementioned fines, the Board may also take administrative actions such as ordering the rectification of the violation or suspending data processing and transfer activities, depending on the severity and nature of the breach.

Within the systematic framework of the law, the administrative fines imposed by the Board are regulated under the heading of “Misdemeanours.” The updated fine amounts for 2025 have been determined in accordance with the revaluation rate stipulated under the repeated Article 298 of the Tax Procedure Law No. 213 and the relevant provisions of the Law No. 6698 on the Protection of Personal Data (“LPPD”).

Prior to legislative amendments, legal remedies against administrative fines and other administrative sanctions imposed by the Board were not explicitly provided for in the Law. In practice, since such violations were considered misdemeanours, the judicial remedies provided under the Misdemeanour Law No. 5326 were being used, and criminal judges of peace were accepted as the competent authorities in such cases. However, considering the technical and specialised nature of personal data protection law, it had long been criticized that criminal judges of peace were not suitable authorities for the judicial review of the Board’s decisions. Observations that the decisions rendered by these judges were superficial and lacked sufficient legal reasoning led to concerns about violations of rights. Moreover, since objections to the decisions of criminal judges of peace were reviewed by another criminal judge of peace, the decisions became final without higher judicial review, thereby hindering the development of precedents in personal data protection law.

Because first-instance criminal judges apply a simplified trial procedure and their decisions become final, the only remedy at the higher court level was an application to the Constitutional Court. Indeed, in a recent decision, the Constitutional Court found that the judicial process related to an administrative fine imposed by the Board on a data controller who violated data security obligations infringed the right to property. The Court emphasized that administrative fines constitute an interference with the right to property, and therefore, any interference with property rights must comply with the general principles for the restriction of fundamental rights and freedoms under Article 13 of the Constitution. It further noted that, within the principle of proportionality, the effective judicial review of the alleged unlawfulness by a competent court is of great importance for ensuring the proportionality of such interference. As a result, the Constitutional Court held that the criminal judges of peace had failed to address the objections raised by the applicant and therefore had not provided adequate protection of the right to property within the scope of the right to a fair trial.

As clearly demonstrated by this decision of the Constitutional Court, effective judicial review of alleged unlawful acts by a competent court is critical in ensuring the proportionality of interferences with fundamental rights and freedoms.

The aforementioned shortcomings in judicial remedies against the Board’s administrative fines, the criticisms directed at criminal judges of peace, and the determination that they are not suitable judicial authorities for matters of personal data protection were confirmed by the Constitutional Court’s ruling. In the Human Rights Action Plan published by the Ministry of Justice, it was previously announced that the Law would be aligned with European Union standards and that administrative fines imposed by the Board could be challenged before administrative courts instead of criminal judges of peace.

A legislative amendment was made to address these issues by explicitly providing that administrative lawsuits may be filed before administrative courts against administrative fines imposed by the Board. Accordingly, these sanctions are now recognized as administrative acts and subject to judicial review by administrative courts, thereby eliminating uncertainties in practice. This new regulation establishes a mechanism that enables more effective judicial oversight of the Board’s decisions. As a result of this amendment, it is expected that the previous issues related to legal certainty will diminish and that more guiding precedent-setting decisions will emerge.

A transitional provision in the Amendment Law, which entered into force on 1 June 2024, stipulates that cases already pending before criminal judges of peace as of this date shall continue to be concluded by those courts.

According to this transitional provision, cases pending before criminal judges of peace as of 1 June 2024 will be finalized by those courts. However, lawsuits filed after 1 June 2024 will be handled by administrative courts.

Although the application of the Law in terms of time has been clarified through the legislative amendment and the added transitional provision, some uncertainties have arisen in practice—especially due to other transitional provisions stipulating that the previous practice concerning the international transfer of personal data may continue until 1 September 2024.

To eliminate these uncertainties, the Authority published an information note on 19 December 2024 to provide guidance on implementation. This note emphasized that the provisions of the Turkish Penal Code No. 5237 relating to the temporal application of laws should be taken into account.

In this context, the applicable administrative sanction shall be determined according to the basic principles of the Turkish Penal Code and based on the time the act was committed and the time the complaint was filed. Accordingly:

• If the act was completed before the legislative amendment: If the violation occurred and concluded prior to the legislative amendment, regardless of when the complaint was filed, the provision that is more favourable to the offender will be applied, even if the judicial decision is rendered after the new law came into force.
• If the act began before and continued after the legislative amendment (continuing or chain offences): If the act ended before the new law entered into force, the more favourable provision shall apply. However, if the act continued after the new law entered into force, the new legal provisions shall apply.
• If the act occurred after the legislative amendment: In such cases, there will be no issue concerning temporal application, and the new provisions shall be applied directly.