The Turkish Personal Data Protection Authority (KVKK) has extended the deadline for businesses to implement verification systems regarding the use of loyalty cards. The new compliance deadline is set for February 28, 2027,
The regulation applies to loyalty programs used in businesses such as stores and markets. It aims to prevent third parties from using loyalty cards or phone numbers without the knowledge and consent of the cardholder.
Under the requirements, businesses must establish technical and administrative control mechanisms. These mechanisms are intended to verify that any transaction using a customer's phone or card number is performed with the actual owner's knowledge and consent.
Decision details
The KVKK Board reached the decision to extend the deadline unanimously. The authority stated the extension was granted after evaluating requests from the sector and determining that businesses required more time to complete necessary regulations.
During this new period, security mechanisms, such as sending an SMS verification code to the line owner, might be implemented.
Timeline of regulations
The original principle decision regarding the use of loyalty card phone or card numbers by third parties was issued on February 11, 2026, under decision number 2026/266.
The original compliance period was 6 months, beginning on February 28, 2026. This original deadline was expected to end on August 28, 2026.
The number of the KVKK Board's decision regarding the extension.
The decision regarding the extension was dated July 22, 2026, and was published in the Official Gazette on August 13, 2026.
