The decision (“Decision”) regarding the administrative fine amounts applicable in 2026 pursuant to Article 18 of the Personal Data Protection Law No. 6698 (“Law”) was published by the Personal Data Protection Authority ("Authority") on December 31, 2025.
With the Decision entering into force on January 1, 2026, the Authority may impose administrative fines ranging from TRY 85,437 to TRY 17,092,242 depending on the type of violation of the obligations under the Law.
Accordingly, as of 2026:
- Failure to fulfill the obligation to inform may result in fines ranging from TRY 85,437 to TRY 1,709,200,
- Failure to fulfill obligations related to data security may result in fines ranging from TRY 256,357 to TRY 17,092,242,
- Failure to comply with the decision of the Personal Data Protection Board may result in fines ranging from TRY 427,263 to TRY 17,092,242,
- Failure to comply with the obligation to register with and notify the Data Controllers’ Registry may result in fines ranging from TRY 341,809 up to TRY 17,092,242,
Failure by the data controller or data processor to notify the Authority within five business days following the execution of the SCC may result in fines ranging from TRY 90,308 to TRY 1,806,177.When imposing administrative fines with lower and upper limits determined in accordance with Article 18 of the Law, the Authority evaluates factors such as the nature of the violation, the severity of the fault, the duration of the non-compliance, and the impact of the violation on the data protection system. In this context, the discretion granted to the Authority is exercised in accordance with the principle of proportionality, taking into account the specific characteristics of each case.
The updated administrative fines strengthen the deterrent effect of compliance with data protection obligations and enhance the practical enforceability of the personal data protection regime. Accordingly, as of 2026, it is crucial s for data controllers and data processors to carefully assess their compliance risks that may give rise to administrative fines.
You can reach the full text of the decision via this link.