Decision Type: Principle Decision

Decision Date: 11/02/2026

Official Gazette Publication Date: 28/02/2026

Number: 2026/266

Information Note on the Principle Decision of the Personal Data Protection Board Regarding Loyalty Cards

Summary of the Decision

The Board has evaluated notices and complaints regarding loyalty card programs and in-store loyalty processes, widely used in sectors such as food, cosmetics, technology, DIY stores, and apparel, where third parties can conduct transactions without the data subject’s knowledge or consent by simply “stating the data subject’s mobile phone number or loyalty card number at the checkout.”

The Board has determined that allowing transactions via loyalty cards (which are considered within the scope of KVKK) at the checkout using only a mobile phone number, without implementing any verification/authentication, poses a risk of unlawful personal data processing. Furthermore, processing the invoice and/or customer transaction information related to such purchases under the data subject’s name constitutes a breach of data protection standards.

The Board concluded that transactions carried out by a third party at the checkout by declaring a phone or card number cannot be based on the legal grounds for processing set forth in Article 5 of the KVKK. Consequently, such workflows are classified as “unlawful personal data processing activities.” Additionally, recording a third party’s purchase to the data subject’s account and issuing documents like invoices in the data subject’s name directly violates the principle of being “accurate and, where necessary, kept up to date” under Article 4 of the Law.

Crucially, the Board emphasized in Decision No. 2026/266 that clauses in membership agreements imposing responsibility on the data subject “not to allow third parties to use the card” do not absolve the data controller of its data security obligations under Article 12 of the Law.

Board Decisions and Established Standards

Within the framework of this principle decision, the Board has established that the practice of allowing loyalty card transactions solely through the verbal declaration of a mobile phone or card number must be terminated. This approach aims to ensure that any use of a loyalty card, including low-risk transactions like “earning points/discounts/promotions”, is verified to be within the data subject’s knowledge and consent.

To ensure KVKK compliance for loyalty cards, the Board has mandated that data controllers implement necessary technical and administrative measures pursuant to Article 12. Examples of concrete verification methods provided include:

• Entry of a loyalty card password/PIN.
• Presentation or scanning of a physical loyalty card.
• Scanning a barcode or QR code via a mobile app or website.
• Verification of a One-Time Password (OTP) sent to the data subject’s phone at the checkout.
• Opt-in preference mechanisms via online accounts where data subjects can explicitly choose which transaction types are permitted using “only a phone number.”

Rather than mandating a single type of verification, the Board allows for alternative verification mechanisms that consider different data subject groups and risk-based layers depending on the transaction type. For instance, higher-risk transactions like “spending points” may require stronger authentication, while “earning points” may involve risk-based, preference-driven designs.

Data controllers are granted a 6-month transition period from the date of publication in the Official Gazette to comply with this principle decision. Given the publication date of 28/02/2026, the compliance deadline is 28/08/2026. Failure to comply will result in administrative sanctions under Article 18 of the KVKK.

Potential Impacts of the Decision

This principle decision aims to prevent the unauthorized processing of shopping behavior data into a data subject’s profile. This will reduce the risk of identity/account misuse and safeguard the accuracy of invoices and transaction records, providing practical protection for processes such as returns, warranties, consumer disputes, and data access/rectification requests.

For Data Controllers: Retail POS workflows must be redesigned. Common “state phone number – earn points” flows must now integrate a verification layer (OTP, QR, Card, PIN, or Opt-in). Additionally, administrative measures such as cashier training, logging/audit trails, authorization matrices, and breach prevention controls must be updated.

This decision clarifies that shifting responsibility to the data subject via contractual terms is insufficient. The focus of compliance projects must shift from “contractual language” to transaction security architecture and authentication design.

Conclusion and Sanctions

The KVKK has clearly established that loyalty card practices without verification lead to unlawful data processing and has set the implementation of technical and administrative measures as the industry standard. Failure to comply will trigger administrative sanctions under Article 18. Furthermore, if such practices lead to a personal data breach, data controllers will face significant legal and reputational risks.

Should you require more detailed information, please do not hesitate to contact us.