Amendments to the Regulation on Private Health Insurance Regarding Personal Data

Under the Regulation Amending the Regulation on Private Health Insurance (Amending Regulation), published in the Official Gazette dated 20 October 2025 and numbered 33053, extensive amendments have been introduced to the Regulation on Private Health Insurance (Regulation). Within this framework, the processing, retention, and disclosure of policyholders’ health information and insurance records have been specifically regulated and aligned with the provisions of the Law No. 6698 on the Protection of Personal Data (“LPPD”).

The principal amendments are summarized below:

• It has been rendered mandatory to retain the insurance records and health information of individuals under both individual and group insurance policies on a personal basis.
• The insurance and health data maintained by the Insurance Information and Monitoring Center (Center) shall be retained for a period of 10 years following the termination of the insured person’s coverage. Upon expiry of such period, said data shall be erased, destroyed, or anonymized in accordance with the provisions of the LPPD.
• An obligation of full compliance has been imposed with respect to all personal data processing activities, ensuring adherence to the LPPD and the relevant secondary legislation.
• The processing of data relating to the health condition and medical history of the insured person shall be carried out exclusively through the Centre, solely by authorized persons, and only for the purposes of risk assessment, calculation of indemnities, and determination of renewal guarantee conditions.
• Under Article 31/A of the Insurance Law No. 5684, all natural and legal persons who gain access to confidential information are under a statutory duty of confidentiality, which shall continue to apply even after the termination of their duties or titles.

The Amending Regulation shall enter into force on 01.01.2026.