KEY LEGAL DEVELOPMENTS
As of August 1, the US started to impose new customs tariffs ranging from 15% to 50% worldwide. While countries such as Canada, Mexico and Brazil faced high tariffs, Turkey was among the countries with the lowest tariffs and maintained its competitive power. In a statement released by the Ministry of Trade, it was stated that while negotiations are ongoing to ensure low rates in strategic sectors such as steel, automotive and copper, positive and constructive signals have been given in bilateral trade relations.
The Central Bank of the Republic of Turkey published the Inflation Report 2025-III. Speaking at the briefing meeting, Governor Karahan stated that the tight monetary policy will be maintained for a long time to ensure the sustainability of disinflation.
On August 20, 2025, the Banking Regulation and Supervision Agency published the "Draft Regulation Amending the Regulation on Equity of Banks", the "Draft Communiqué Amending the Communiqué on Financial Statements to be Publicly Announced by Banks and Explanations and Footnotes Related to These Financial Statements" and the "Draft Regulation Amending the Regulation on Accounting Practices and Financial Statements of Financial Leasing, Factoring, Financing and Savings Financing Companies" and submitted them for public opinion.
The Ministry of Justice has published the Draft Law on Compulsory Enforcement. The draft introduces significant changes to the Enforcement and Bankruptcy Law No. 2004, including the court judgements becoming enforceable with the decision of the court of appeal and the establishment of a maritime compulsory enforcement institution. The draft will be open for public consultation until January 31, 2026.
ADMINISTRATIVE INVESTIGATIONS
The Competition Board concluded the preliminary investigation opened on Hemel Boya Kimya ve Sanayi AŞ, which operates in the field of wood protection, maintenance and paint, with the allegation that it violated Article 4 of the Law No. 4054 on the Protection of Competition by determining the sales prices of re-sellers and/or restricting internet sales. Accordingly, the evidence obtained was found significant and sufficient and it was decided to initiate an investigation on the undertaking in question.
The Competition Board conducted an investigation on Unilever Sanayi ve Ticaret Türk AŞ, İlke Gıda Tüketim Pazarlama Ticaret Sanayi Kollektif Şirketi Mehmet Şahin ve Ortakları, Başak Pazarlama Tem. ve Gıda Ürünleri Tic. Şti. within the scope of a preliminary inquiry conducted on the allegation that Unilever Sanayi ve Ticaret Türk AŞ violated Article 4 of the Law No. 4054 on the Protection of Competition by determining the resale prices of its re-sellers.
The Competition Board concluded the investigation on HERBALIFE. Accordingly, HERBALIFE's commitment application was accepted and it was decided to terminate the investigation conducted against HERBALIFE in terms of internet sales restriction and advertising prohibition practices, and that it did not violate Article 4 of the Law No. 4054 on the Protection of Competition by determining the sales price of its re-sellers.
The Competition Board decided to initiate an investigation to determine whether Mastercard Inc. and Visa Inc. operating in the global card payment systems market and the undertakings controlled by these undertakings violated Articles 4 and/or 6 of the Law No. 4054 on the Protection of Competition by making it difficult for payment service providers providing international payment solutions to use the payment/POS infrastructure provided by banks operating within the scope of the Banking Law No. 5411 to other payment service providers to their merchants abroad.
At its meeting numbered 360 held on August 14, 2025, the Advertising Board of the Ministry of Commerce decided to impose access blocking measures on 30 social media accounts with high number of followers, which were found to advertise illegal betting and gambling and direct consumers to several illegal websites. At the meeting, it was also decided to make the necessary applications before the relevant institutions in order to initiate judicial investigation processes against the social media accounts and the addressees of illegal betting and gambling websites.
The Advertising Board of the Ministry of Commerce shared data on misleading advertisements and unfair commercial practices. Accordingly, a total of 156,856,697 ₺ administrative fine of 156,856,697 ₺ was imposed on 875 of the 970 files evaluated in the first seven months of 2025. In July, a total of 15,733,665 ₺ administrative fines were imposed on 122 out of 134 files related to health products and food supplements, real estate advertisements, tourism promotions, communication and financial services, social media influencers and digital content.
The Ministry of Commerce shared data on administrative sanctions imposed within the scope of inspections in the motor vehicle trade. Accordingly, administrative fines of 103 million ₺ were imposed on 220 persons and organisations without authorisation certificate, 52.4 million ₺ on 131 businesses violating the 6 months-6 thousand km rule, 95.7 million ₺ on 476 persons / organisations violating the advertisement restriction. In addition, the authorisation certificates of 31 dealers were cancelled due to misleading practices.
OFFICIAL GAZETTE
The decision dated February 21, 2025 and numbered 2025/1 of the Grand General Assembly for the Unification of Jurisprudence of the Court of Cassation was published in the Official Gazette dated July 17, 2025 and numbered 32958. In the decision, it is stated that, in case prior consent is obtained, the bank may block the pension directly for the collection of the debt arising from the consumer loan granted by the bank.
The Regulation Amending the Regulation on Application to Mediator and Arbitrator in Collective Labor Agreements entered into force through publication in the Official Gazette dated July 18, 2025 and numbered 32959. The amendment stipulates that experts and rapporteurs will be appointed by the Presidency and that the High Board of Arbitration may extend the 2-month decision-making period by 1 month if the parties declare that they will agree.
The Decision on the Recess of the Grand National Assembly of Turkey was published in the Official Gazette dated July 22, 2025 and numbered 32963. Accordingly, the Turkish Grand National Assembly will recess its legislative activities between July 21 and October 1. However, according to the relevant decisions published in the Official Gazette with the same number, the Industry, Trade, Energy, Natural Resources, Information and Technology Commission, the Commission on Equal Opportunities for Women and Men and the Digital Media Commission will be able to continue their activities during the recess.
The Regulation on the Collection of Various Expenses of the Employers of Foreigners who are Ordered to be Deported for Unauthorised Work was published in the Official Gazette dated July 23, 2025 and numbered 32964. Accordingly, the maximum 3-month expenses incurred by the Directorate of Immigration Authority during the deportation process due to unauthorised work will be collected from the employer or employer's representative in accordance with the Law on the Collection Procedure of Public Receivables. The expenses to be collected consist of accommodation expenses, necessary expenses for their return to their country, and health expenses if the deportation procedures are conducted in removal centres, and necessary expenses for their return to their country if the deportation procedures are conducted outside the removal centres. The Regulation shall enter into force on January 23, 2026.
The Regulation Amending the Regulation on Principles Regarding Borsa İstanbul A.Ş. Exchange Activities entered into force upon publication in the Official Gazette dated July 23, 2025 and numbered 32964. Accordingly, the financial metrics manager will directly manage and calculate the financial metrics and assume all oversight, transparency and audit responsibilities related to them.
The Law Amending the Law on the Protection of the Value of Turkish Currency, Certain Laws and the Decree Law No. 635 was published in the Official Gazette dated July 24, 2025 and numbered 32965. The amendment includes an increase in administrative fines and changes in the periods of suspension of workplace activities.
The Law Amending Certain Health-Related Laws and the Decree Law No. 663 entered into force after being published in the Official Gazette dated July 24, 2025 and numbered 32965. Among the amendments are the obligation for pharmaceutical trade houses and pharmacies to report all movements of medicinal products and foods for special medical purposes in the supply chain to the tracking system and the ability to obtain consent from the patient electronically before the procedures to be performed by doctors.
The Communiqué (Number: 2025/18) Amending the Communiqué (Number: 2023/5) on Supporting the Conversion of Firms' Foreign Currency Originating Abroad into Turkish Lira entered into force after being published in the Official Gazette dated August 1, 2025 and numbered 32973. Accordingly, the 3% conversion support paid to committed companies until July 31, 2025 has been extended until October 31, 2025.
The Regulation on the Amendment to the Regulation on the Lines of Business entered into force through publication in the Official Gazette dated August 2, 2025 and numbered 32974. Accordingly, the list of lines of business has been revised.
The Constitutional Court decision dated March 27, 2025 and numbered 2025/91 was published in the Official Gazette dated August 5, 2025 and numbered 32977. Accordingly, the provision of a document by the psychiatrist to the applicant's mother regarding the psychological disorders of the applicant in order to take a restriction decision without obtaining the consent of the patient was deemed a violation of the right to request the protection of personal data.
The Regulation Amending the Regulation on Small and Medium-Sized Enterprises entered into force after being published in the Official Gazette dated August 7, 2025 and numbered 32979. ₺₺Accordingly, the upper limit of net sales revenue or financial balance sheet for the definition of medium-sized enterprise was increased from 500 million ₺ to 1 billion ₺.
The Regulation on Direct Sales entered into force after being published in the Official Gazette dated August 8, 2025 and numbered 32980. Among the regulations in the Regulation are the 30-day right of withdrawal and the obligation for a certificate of authorisation.
The Regulation Amending the Highway Traffic Regulation was published in the Official Gazette dated August 19, 2025 and numbered 32991. Accordingly, commercial and public transport vehicles such as taxis, minibuses and buses are required to have a video recording device with camera system, vehicle tracking system and emergency button.
DATA BREACH NOTIFICATIONS
The explanations in 4 (four) personal data breach notifications made to the Personal Data Protection Board are as follows:
- In summary, in the data breach notification submitted to the Board by the Turkish Medical Association, which has the title of data controller, it was reported that on 08.08.2025 a cyberattack was carried out on the data controller’s system by unidentified sources, that the manner in which the cyberattack occurred is unknown, that files stored in the data controller’s system were accessed and deleted as a result of the cyberattack, that the affected groups of data subjects include employees, users, and members registered with medical chambers, that the categories of personal data affected by the breach include identity, contact, location, legal proceedings, and transaction security data, and that since the member database could not be accessed the exact number of affected data subjects is not yet known but the number of potentially affected individuals is estimated to be 107,000.
- In summary, in the data breach notification submitted to the Board by Biletal İç ve Dış Ticaret AŞ, which has the title of data controller, it was reported that certain personal data belonging to the data controller were offered for sale on illegal online platforms by cyberattackers, that the breach was detected on 11.08.2025 as a result of the investigations carried out by the data controller’s IT teams following a letter from the Information and Communication Technologies Authority, that the categories of personal data affected by the breach include identity, contact, and customer transaction data, that the group of data subjects affected by the breach consists of customers, and that the estimated number of affected data subjects is 7,800.
- In summary, in the data breach notification submitted to the Board by Yatırım Finansman Menkul Değerler A.Ş., which has the title of data controller, it was reported that the breach occurred on 20.07.2025 and was detected on the same date, that a ransomware attack was carried out on the data controller’s servers and client computers by an international and expert attack group, that the number of affected data subjects, the group of affected data subjects, and the categories of personal data have not yet been determined, that technical examinations on this matter are still ongoing, and that the affected individuals can obtain support regarding this attack through all branches of the data controller and via the Investor Support Line at 0 850 723 59 59.
- In summary, in the data breach notification submitted to the Board by Bold LLC, which has the title of data controller, it was reported that on 12 July 2025 it was detected that a new feature allowing users of the data controller’s online job search service in Puerto Rico to preview their resumes in real time was exposed to unauthorized access, that internal investigations revealed the incident occurred on 10 March 2023 when the server environment was made viewable to cache anonymized data for faster performance, that due to this vulnerability unauthorized access occurred only once, that the affected anonymized data included names, contact information, and resume data, that the nature and scope of personal data in each resume vary significantly depending on the information users choose to add, with some resumes containing only basic identifiers such as name and surname while others may include additional personal information such as contact details, employment history, educational history, and in some cases photographs or other voluntarily disclosed information, that the necessary investigations are ongoing, that the groups of data subjects affected by the breach are users and subscribers/members, and that the number of affected data subjects is 3,168.
Av. Dr. Fatih Burak Uzun
Discussion