Guide on the Processing of Special Categories of Personal Data Published

The Guide on Processing Special Categories of Personal Data (Guide), prepared by the Personal Data Protection Authority (Authority), was published on February 26, 2025.

The amendments to the Code of Criminal Procedure and Some Other Laws (Law No. 7499), published in the Official Gazette on March 12, 2024, made changes to Article 6 of the Law No. 6698 on the Protection of Personal Data (Law), which regulates the Conditions for Processing Special Categories of Personal Data and these changes came into effect on June 1, 2024. Accordingly, the differences between special categories of personal data were eliminated, and new processing conditions were defined.

The Guide aims to clarify the approach of the Personal Data Protection Board regarding the processing conditions for special categories of personal data, assist data controllers in understanding the legal grounds for processing such data under the legislation, and help ensure that data controllers meet their obligations under the Law appropriately.

The Guide consists of three sections: (i) the first section provides information on special categories of personal data and explains which data are considered special categories, (ii) the second section details the conditions for processing such data, and (iii) the third section outlines what data controllers need to do to comply with the new regulations after the amendments made by Law No. 7499, along with other suggestions. Some of the key points covered in these sections are summarized below:

• Special categories of personal data are defined exhaustively in the Law and cannot be expanded by analogy. Data not listed in the Law cannot be considered special categories of personal data. For example, nationality data is not listed and therefore is not considered a special category of personal data. Political opinions and religious beliefs fall within the scope of special categories of personal data, and information about not believing in any religion or being apolitical is similarly considered. Data about employees' union memberships is also regarded as a special category of personal data, while blood group information on old passports and ID cards is considered health data.
• Compared to the previous regulation, the distinction between health and sexual life data and other special categories of personal data has been removed in the new regulation. The conditions under which special categories of personal data can be processed without explicit consent have been redefined. Under the new regulation, special categories of personal data can be processed when explicitly provided by law, necessary for protecting vital interests or bodily integrity, for public knowledge, or the establishment or protection of a right, as well as for fulfilling employment, occupational health and safety, and social security obligations, or as part of activities aligned with the purposes of associations and non-profit organizations. The Guide elaborates on each condition for processing special categories of personal data, provides guidance on how they should be interpreted, and offers practical examples to illuminate the application.

Lastly, the Guide clearly outlines the steps data controllers need to take to comply with the new conditions for processing special categories of personal data under the Law. These steps include updating the personal data processing inventory, regulating the explicit consent processes, changing the information texts, updating the data retention and destruction policy, and enhancing data security measures.