The Data Protection Authority Publishes its Public Announcement Regarding the Use of Foreign-Origin Messaging Applications Such as WhatsApp in Public Institutions

The Personal Data Protection Authority (Authority) published a public announcement on 29.01.2026, following complaints that public employees were being forced to use foreign-origin messaging applications such as WhatsApp in administrative tasks and that official documents were being shared through these platforms.

Key points from the announcement are summarized below:

• Pursuant to Presidential Circular No. 2019/12, titled “Information and Communication Security Measures,” confidential data must not be shared via mobile applications, except for domestic applications developed by institutions authorized for coded or encrypted communication.
• It is considered inappropriate for public institutions to share official documents and records via messaging applications that do not have data centers located within Türkiye.
• Personal data sharing through applications such as WhatsApp may be deemed a data processing activity that does not meet the conditions specified under Articles 5 and 6 of the Personal Data Protection Law No. 6698 (KVKK), and such cases may be subject to investigation by the Personal Data Protection Board ex officio or upon complaint.
• If unlawful data processing activities are identified, administrative sanctions may be imposed on the responsible public personnel under the relevant disciplinary provisions.
• The use of public personnel’s mobile phone numbers also constitutes personal data processing, and such processing must comply with Article 5 of the Law.