I. INTRODUCTION
In its Decision dated 10 July 2025, the Constitutional Court found no violation of the Constitution of the Republic of Türkiye (the “Constitution”) in respect of: subparagraphs (e) and (g) of paragraph (3) of Article 6 of the LPDP as amended by Article 33 of Law No. 7499; paragraph (9) of Article 9 of the LPDP as amended by Article 34 of Law No. 7499; and the wording “…from TRY 50,000 to TRY 1,000,000…” contained in subparagraph (d) added to paragraph (1) of Article 18 of the LPDP by Article 35 of Law No. 7499.
The Constitutional Court reviewed the amendments to Article 6(3)(e) and (g) and Article 9(9) of the LPDP under Articles 13 and 20 of the Constitution, and reviewed the wording regarding the fine range introduced into Article 18(1)(d) under Articles 2 and 38 of the Constitution. Concluding that the impugned provisions were not unconstitutional, the Constitutional Court dismissed the annulment requests as well as the requests for stay of execution relating to the relevant paragraph, subparagraphs, sentence and wording.
II. SCOPE OF THE IMPUGNED PROVISIONS AND GROUNDS FOR THE ANNULMENT REQUEST
1. With Respect to Subparagraphs (e) and (g) of the Amended Paragraph (3) of Article 6 of the LPDP, as Amended by Article 33 of Law No. 7499
Article 6 of the LPDP governs the processing of special categories of personal data, and the permissible grounds are enumerated on a limited basis. The first sentence of paragraph (3) provides that the processing of special categories of personal data is prohibited, except for the exemptions set out in the same paragraph.
Within this framework, the Constitutional Court noted that: under subparagraph (e) (as challenged), the processing is permitted where it is necessary for the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning, management and financing of health services, by persons bound by a duty of confidentiality or by authorised institutions and organisations; and under subparagraph (g) (as challenged), the processing is permitted where it relates to existing or former members and affiliates, or persons in regular contact with foundations, associations and other non-profit entities or formations established for political, philosophical, religious or trade-union purposes—provided that the processing is compliant with the applicable legislation and the entity’s purposes, limited to its field of activity, and not disclosed to third parties.
As grounds for the request of annulment, it was argued, in summary, that the challenged provisions are uncertain as to which categories of special categories of data may be processed by public bodies and other undertakings; that the circumstances set out do not justify processing without the data subject’s consent; that the provisions do not satisfy the legal certainty required by the principle of legality; that they do not correspond to a compelling social need in a democratic society; that they contain no objective criteria regarding the scope and procedure of interference with the right to request protection of personal data; that the legal persons authorised to process personal data are not limited at the statutory level, thereby undermining public interest; that no special protective rules are established for health data and membership data; that general safeguards are insufficient; and that the provisions are inconsistent with comparable international regulations-thereby allegedly violating Articles 2, 5, 12, 13, 20 and 90 of the Constitution.
2. With Respect to Paragraph (9) of the Amended Article 9 of the LPDP, as Amended by Article 34 of Law No. 7499
Article 9 of the LPDP regulates the procedure for transferring personal data abroad. Under the challenged paragraph (9), personal data may be transferred abroad-without prejudice to provisions of international treaties-only with the authorisation of the board, and after obtaining the opinion of the relevant public institution or organisation, where the interests of Türkiye or of the data subject would be seriously harmed.
As grounds for the request of annulment, it was argued, in summary, that the scope and limits of the board’s authorisation power are not defined; that the opinion to be obtained from the relevant public body is merely consultative; that the provision does not satisfy the legality requirement and may lead to arbitrary administrative practices; that this violates the principles of legality of administration and non-delegation of legislative power; that it may give rise to unequal treatment without objective justification, conflicting with equality; that the uncertainty creates serious risks for the data subject’s interests in matters of national interest; that safeguards and measures are likewise uncertain; that the provision lacks a public interest purpose and is inconsistent with the State’s constitutional duties to protect fundamental rights and to create conditions for the development of individuals’ material and moral existence; and that it is incompatible with comparable international regulations-thereby allegedly violating the Preamble and Articles 2, 5, 7, 10, 12, 13, 20, 90 and 123 of the Constitution.
3. With Respect to the Wording “…from TRY 50,000 to TRY 1,000,000…” Contained in Subparagraph (d) Added to Paragraph (1) of Article 18 of the LPDP by Article 35 of Law No. 7499
As grounds fort he request of annulment, it was argued that there is a manifest disproportionality between the gravity of the act subject to the administrative fine and the fine imposed, and that the sanction remains inadequate in view of the act, thereby creating a sphere of impunity for the conduct concerned. It was further contended that this is incompatible with the State’s positive obligations to protect personal data as part of the protection of fundamental rights and freedoms, and thus violates Articles 2, 13 and 20 of the Constitution.
III. THE CONSTITUTIONAL COURT’S ASSESSMENT
1. With Respect to Subparagraphs (e) and (g) of the Amended Paragraph (3) of Article 6 of the LPDP, as Amended by Article 33 of Law No. 7499
In its review, the Constitutional Court stated that the explanatory memorandum to the provision containing the challenged rules notes that certain personal data may cause the data subject to suffer harm or be subjected to discrimination if learned by others, and that such data are therefore regarded as special categories (sensitive) data; and, in this context, it is clear that, under the exceptions set out in the rules, the data that may be processed-namely individuals’ political opinions, philosophical beliefs, religion, sect or other beliefs, association, foundation or trade union membership, health data, sexual life, as well as biometric and genetic data-constitute special categories of personal data. Accordingly, it was stated that the said rules impose a restriction on the right to request the protection of personal data and that, pursuant to Article 13 of the Constitution, restrictions on fundamental rights and freedoms must be prescribed by law and comply with the principle of proportionality. The Constitutional Court further concluded that the rules satisfy the requirement of legality, considering that the scope, purpose and limits of the circumstances in which personal data may be processed are set out clearly, including the persons subject to a duty of confidentiality and the authorised institutions and organisations under Article 6(3)(e) of the LPDP, as well as the purposes of the foundations, associations and other non-profit entities or formations falling within Article 6(3)(g), and the manner in which the persons “in regular contact” are defined in the rule. The Constitutional Court went on to state that Article 6(3)(e) of the LPDP serves the aim of protecting public health and, in this regard, contributes to preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning, management and financing of health services, and that it is therefore clear that the rule pursues a legitimate aim in constitutional terms.
The Constitutional Court also found that recording the personal data of persons connected to foundations, associations and other non-profit entities formed for political, philosophical, religious or trade-union purposes-taking into account the restrictions on collecting such information (compliance with legislation and purposes, limitation to the field of activity)-is directed at establishing suitable conditions for individuals to exercise their fundamental rights and freedoms and thereby maintaining public order, and thus likewise serves a legitimate aim.
In assessing the rules within the framework of the principle of proportionality, the Constitutional Court noted that proportionality comprises the sub-principles of suitability, necessity and proportionality stricto sensu; and, taking into account the legislature’s margin of discretion, stated that it cannot be concluded that the restriction envisaged by the rules is unsuitable for achieving the legitimate aim or that it is unnecessary.
Considering that safeguards are ensured in relation to the rules-such as conducting the processing of personal data in a transparent manner; granting data subjects access to their personal data; keeping personal data accurate and up to date and ensuring its security; not retaining personal data longer than necessary for the legitimate purpose; limiting the data to be processed or otherwise used to what is required for the intended purpose; and having recourse to judicial remedies in the event that the safeguards afforded by the right are breached-the Constitutional Court concluded that the restriction imposed by the rules on the right to request the protection of personal data cannot be regarded as disproportionate, and therefore held that the rules do not contravene Articles 13 and 20 of the Constitution.
2. With Respect to Paragraph (9) of the Amended Article 9 of the LPDP, as Amended by Article 34 of Law No. 7499
The Constitutional Court held that the rule governing the conditions for transferring personal data abroad where the interests of Türkiye or of the data subject would be seriously harmed constitutes a restriction on the right to request protection of personal data under Article 20 of the Constitution. It further stated that, given the variety of ways in which such situations may arise, it is not mandatory for the legislature to enumerate each scenario in the statutory text, and that this is inherent in legislative drafting technique.
For the purposes of the legality review, considering that the provision in which the rule is set out expressly specifies the procedures and principles to be followed in transferring personal data abroad, as well as the authority competent to grant permission, it was concluded that the rule is clear, comprehensible and sufficiently delimited and therefore satisfies the requirement of legality
It was stated that the rule requires, in addition to the other conditions set out in the LPDP, obtaining the board’s permission for the transfer of personal data abroad in cases where the interests of Türkiye or the data subject would be seriously affected, and that it is therefore clear that the rule pursues a legitimate aim in constitutional terms, directed at ensuring the conditions necessary for individuals’ material and moral development and safeguarding national security; that, pursuant to paragraph (8) of the same article, the safeguards provided under the LPDP will also be ensured in respect of onward transfers of personal data transferred abroad and transfers to international organisations, and that the provisions of Article 9 will apply in this regard; and that, upon a complaint or an ex officio examination initiated by the board, the board may, pursuant to paragraph (7) of Article 15 of the LPDP, decide to suspend the transfer of data abroad where irreparable or impossible-to-remedy harm may arise and there is a clear unlawfulness. For these reasons, it was concluded that the restriction imposed by the rule on the right to request the protection of personal data is proportionate. Accordingly, the Constitutional Court found that the rule does not contravene Articles 13 and 20 of the Constitution and dismissed the annulment request.
3. With Respect to the Wording “…from TRY 50,000 to TRY 1,000,000…” Contained in Subparagraph (d) Added to Paragraph (1) of Article 18 of the LPDP by Article 35 of Law No. 7499
In its assessment, the Constitutional Court stated that, in both criminal and administrative offences, an act that is contrary to behavioural norms and constitutes wrongdoing entails the infringement of a legal interest protected by the legislature, and that both criminal and administrative sanctions involve coercion; accordingly, the constitutional principle of legality in crimes and punishments set out in the relevant provision of the Constitution also applies to administrative offences and sanctions.
It was concluded that there is no doubt that the rule, which provides for the imposition of an administrative monetary fine on those who fail to fulfil the notification obligation set out in paragraph (5) of Article 9 of the LPDP, is a statutory provision in the formal sense and is accessible; and that, considering also that the paragraph containing the challenged rule clearly specifies the act constituting the misdemeanour as well as the lower and upper limits of the sanction to be applied in response to that act, the rule is clear, comprehensible, foreseeable and sufficiently delimited and thus satisfies the requirement of legality. In addition, it was stated that, by providing for a sanction for persons acting in breach of the notification obligation, the rule aims to enable effective supervision of whether the procedures and principles relating to the processing of personal data are complied with and to prevent violations in this regard, and therefore it is clear that the rule pursues a legitimate aim in constitutional terms.
The Constitutional Court stated that the rule sets the lower and upper limits, in a stepped structure, at TRY 50,000 and TRY 1,000,000 so as to enable the determination of a fair and proportionate fine depending on the manner in which the misdemeanour was committed and its gravity; that the fine is made subject to the revaluation rate, thereby allowing it to be updated from year to year; that the rule does not envisage a sanction exceeding the offender’s culpability; and that the reasonable balance required between the aim pursued and the means employed is observed. On this basis, the Constitutional Court held that the rule-enacted within the legislature’s margin of discretion for the purpose of public interest and understood not to be contrary to the principle of proportionality-does not conflict with the principles of the rule of law and the legality of crimes and punishments. For this reason, it was determined that the rule is not contrary to Articles 2 and 38 of the Constitution, and the annulment request was dismissed.
4. With Respect to the Request for Stay of Execution
Following the determination that the relevant rules do not contravene the applicable provisions of the Constitution and the dismissal of the annulment requests, the requests for stay of execution submitted in respect of each rule were also dismissed.
IV. CONCLUSION
With respect to the provisions whose annulment was requested, the Constitutional Court adopted a holistic approach to the matter. In this context, the challenged rules were assessed comprehensively by taking into account considerations such as the fundamental principles, the rights of data subjects, administrative application mechanisms, and other avenues for legal redress. This holistic approach played a role in the dismissal of the annulment requests. At this point, the Constitutional Court regarded the protection of personal data as equally legitimate as the processing of personal data, and-by observing a delicate balance between rights-emphasised all safeguards, primarily the fundamental principles.
As regards cross-border transfers, the Constitutional Court viewed the requirement to obtain the board’s permission, in cases giving rise to a serious risk of harm, as an additional safeguard, and regarded the board’s review and suspension powers as balancing elements. As regards administrative monetary fines, it considered the clear statutory determination of the lower and upper limits of the act and the sanction sufficient from the perspective of legality, and concluded that a reasonable balance was struck between deterrence and foreseeability. Ultimately, by adopting an approach that balances the protection of personal data with the necessity of processing in certain fields, the Constitutional Court dismissed the annulment requests and held that the rules are not contrary to the Constitution.
B. KEY TAKEAWAYS
(1)By its Decision dated 10 July 2025, the Constitutional Court held that the amendments introduced by Article 33 of Law No. 7499 to Article 6/3 subparagraphs (e) and (g) of the LPDP, by Article 34 to Article 9/9 of the LPDP, and by Article 35 to subparagraph (d) added to Article 18/1 of the LPDP-setting the range at “TRY 50,000–TRY 1,000,000”-are not contrary to the Constitution, and accordingly dismissed the requests for annulment and stay of execution.
(2)In its proportionality assessment regarding Article 6/3 (e) and (g) of the LPDP, the Constitutional Court stated that-also taking into account the legislature’s margin of discretion-the regulations may be considered suitable and necessary to achieve the legitimate aim; and that, when the safeguards under the LPDP (transparency, access, accuracy and currency, data security, limitation by retention period, and judicial remedy guarantees) are considered collectively, the interference cannot be regarded as disproportionate.
(3)The Constitutional Court accepted that the restrictions introduced are based on legitimate aims such as protecting public health and ensuring public order.
(4)In the Constitutional Court’s approach, “systemic safeguards” play a determinative role in assessing the proportionality of the interference; fundamental principles, data subject rights, oversight/complaint mechanisms, and access to judicial remedies are viewed as elements that counterbalance the weight of the restriction.
(5)The Constitutional Court found it constitutional to require the board’s permission for the transfer of personal data abroad in cases where the interests of Türkiye or the data subject would suffer serious harm.
(6)The Constitutional Court noted that the procedural framework and the competent authority for this permission mechanism are set out in the statute and therefore rejected the allegation of uncertainty.
(7)The Constitutional Court stated that the right to request the protection of personal data is not absolute, and accepted that it may be restricted, where there are legitimate aims connected with the public interest, on the basis of a statutory ground and with sufficient safeguard.
(8)The Constitutional Court concluded that the rule is proportionate and foreseeable because the lower and upper limits of the fine are explicitly set out in the statute and may be updated through revaluation.
(9)The Constitutional Court stated that, due to the stepped lower–upper limit structure of the administrative monetary fine and its indexation to the revaluation rate, the sanction may be determined in a fair manner according to the gravity of the act; that no sanction exceeding the offender’s culpability is envisaged; and that the aim–means balance is reasonable, concluding that the rule does not conflict with the principles of the rule of law and legality.
(10)As the Constitutional Court dismissed the annulment requests, it also dismissed the requests for stay of execution sought in respect of Articles 33, 34 and 35 of Law No. 7499.
