The Principle Decision of the Personal Data Protection Board (“Board”), dated 31 March 2026 and numbered 2026/348 (“Principle Decision”), was published in the Official Gazette dated 31 March 2026 and numbered 33210.
In the Principle Decision, the personal data processing activities carried out through the disclosure of residents’ debt information in common areas of apartment and site complexes were evaluated by the Board within the scope of the Personal Data Protection Law No. 6698 (“DP Law”).
Principle Decision determines that apartment and residential complex managements have engaged in personal data processing by displaying lists containing residents’ personal data such as names, surnames, apartment numbers, debt amounts, payment delays and ownership or tenancy status in common areas including elevators, building entrances and corridors.
1. Legal Basis for Sharing Debt Information
Board further conducted an assessment with reference to the relevant provisions of the Condominium Ownership Law No. 634, within the framework of regulations concerning (i) the obligation to contribute to common expenses, (ii) the manager’s liability akin to that of an agent, (iii) the obligation to render accounts, and (iv) the right and authority of flat owners to supervise the management.
As a result of this assessment, it has been determined that sharing the debt information of apartment residents with other flat owners is necessary, and that such sharing is carried out within the scope of the legal basis of “being expressly provided for by law” set forth in Article 5/2(a) of the DP Law, and “being mandatory for the establishment, exercise, or protection of a right” pursuant to Article 5/2(e) thereof.
2. Lawfulness of the Processing Method
Nevertheless, the Board has assessed that the mere existence of a legal basis for sharing such information does not, in and of itself, constitute lawfulness.
Common areas of collective housing structures such as elevators, building entrances, and corridors are accessible to an indeterminate group of people, including guests, cargo personnel, and other third parties. In this regard, posting lists containing personal data in such areas results in the disclosure of data to people whose identity is not determined. Accordingly, Board considers that such data processing activity constitutes a violation of the data security obligations set forth in Article 12 of the DP Law.
Although the processing activity in question may, in essence, be based on one of the processing conditions stipulated in Article 5 of the DP Law, when the manner in which the activity is carried out is taken into consideration, it is concluded that these conditions are not effectively satisfied. In other words, the existence of a valid legal basis for the processing of personal data is not sufficient on its own; the processing activity must also be conducted in compliance with the data security obligations prescribed under Article 12 of the DP Law.
3. Conclusions and Remedial Measures
Principle Decision sets forth that, in order for notifications regarding debt information to be carried out in compliance with the data security obligations prescribed under Article 12 of the DP Law, communication methods that restrict access solely to the relevant individuals must be preferred, such as closed e-mail systems, restricted messaging groups, or digital platforms dedicated to this purpose, where access by third parties is precluded.
As a result, the Board has concluded that:
- existing practices constituting disclosure must be terminated immediately;
- all relevant announcements, lists, and documents must be removed from common areas without delay; and
- notifications regarding debt information must be carried out through alternative methods compliant with the DP Law, accessible only to the relevant individuals.
It is further noted that administrative sanctions may be imposed on data controllers pursuant to Article 18 of the DP Law in the event of non-compliance with these obligations.
Click here to access the full text of the Principle Decision (only available in Turkish).
