The Pulse — Edition 02: Regulatory Landscape in Data Protection Law

December 2025 | Başaran Law Firm

Less Bureaucracy, Stronger Structure: The EU’s Digital Omnibus

On 19 November 2025, the European Commission publishes the Digital Omnibus proposal, aiming to simplify the EU’s digital legislative framework while maintaining high standards of data protection. The proposal streamlines key instruments such as the GDPR, ePrivacy Directive, NIS2 and the Data Act, with the goal of reducing compliance costs without lowering the level of protection for personal data.

One of the most notable changes concerns the long-criticised dual regime between the GDPR and the ePrivacy Directive: rules on accessing personal data from terminal equipment are moved entirely under the GDPR, eliminating duplicate consent requirements. User preferences are to be expressed through automated, machine-readable browser or application settings, which service providers must respect, thereby reducing both “consent fatigue” and compliance burdens.

Targeted amendments to the GDPR further clarify the notion of personal data by emphasising reasonable identifiability, give controllers more flexibility in dealing with abusive access requests, limit data breach notifications to high-risk incidents while extending the deadline to 96 hours, and allow strictly controlled residual processing of special category data arising during AI training.

In parallel, personal data breach and cybersecurity incident notifications under various EU acts are consolidated into a single EU-level reporting platform operated by ENISA, based on a “report once, share many” model that is expected to generate substantial administrative savings while preserving the EU’s high level of personal data protection.

The EU Launches a New Era for Data and Artificial Intelligence

On 19 November 2025, the European Commission released the Data Union Strategy –Unlocking Data for AI, setting out its roadmap to strengthen Europe’s data economy and boost the development of trustworthy artificial intelligence.

The Strategy focuses on three main priorities: scaling up access to high-quality data for AI, simplifying the EU data regulatory framework, and reinforcing the EU’s global position in international data flows.

The Commission plans to expand and interconnect European data spaces across key sectors such as health, energy, manufacturing, mobility and finance, enabling companies and researchers to access larger volumes of reliable data for innovation and AI training.

In parallel, the Strategy is closely aligned with the Digital Omnibus initiative and aims to reduce legal fragmentation and compliance costs through streamlined rules, standard contractual clauses and improved cloud governance.

A strong emphasis is also placed on digital sovereignty. While promoting fair and secure cross-border data flows with trusted partners, the Strategy seeks to shield EU data from undue access and misuse by third countries. Through targeted investments in data infrastructure and cloud technologies, the Commission aims to position the EU as a leading global hub for data-driven and AI- based innovation, while preserving high standards of data protection and cybersecurity.

Major GDPR Fine Imposed for Unsecured Cross-Border Data Transfers and Excessive Employee Data Processing

On 14 November 2025, the Croatian Personal Data Protection Agency imposed an administrative fine of EUR 4.5 million on a telecommunications operator for violations of the General Data Protection Regulation. The decision is based on

(i) the transfer of personal data to a group company in Serbia without a valid transfer mechanism,

(ii) the lack of transparent disclosure to data subjects regarding this transfer,

(iii) the unlawful and excessive processing of employees’ identity card copies and criminal record certificates,

(iv) the failure to carry out prior security due diligence on a telemarketing service provider acting as a processor.

The Authority found that, after 27 December 2022, the controller continued to transfer data to the Serbian processor without renewing the standard contractual clauses, failed to conduct any Transfer Risk Assessment (TRA), and granted the processor unrestricted access to the SAP CRM database containing personal data of approximately 847,000 users.

The absence of clear information in the privacy notices regarding third-country transfers, the collection of excessive employee data despite the Data Protection Officer’s warnings, and the lack of basic security controls over the processor were regarded as aggravating factors in determining the fine.

EDPS Strengthens Data Protection Approach for Artificial Intelligence

On 11 November 2025, the European Data Protection Supervisor (EDPS) published its Guidance on the Risk Management of Artificial Intelligence Systems, addressing the growing data protection risks linked to the use of AI by EU institutions. The Guidance sets out a structured risk management approach covering the design, procurement, deployment and monitoring of AI systems that process personal data.

The EDPS highlights that risks such as bias in training data, automated discrimination, inaccurate outputs, excessive data collection and weakening of data subjects’ rights must be assessed at an early stage and continuously monitored throughout the lifecycle of AI systems. Particular emphasis is placed on the principles of fairness, accuracy, data minimisation, security and accountability.

The Guidance also underlines that interpretability and explainability are essential requirements for lawful AI use. According to the EDPS, reliance on “black-box” systems undermines transparency and makes it difficult for individuals to exercise their rights effectively. The document therefore signals a shift toward a more technology-aware and proactive data protection compliance model, in parallel with the forthcoming AI Act.

Guidelines on Generative Artificial Intelligence and the Protection of Personal Data Have Been Published

On 24 November 2025, the Turkish Personal Data Protection Authority published the Guidelines on Generative Artificial Intelligence and the Protection of Personal Data (in 15 Questions). The Guidelines are noteworthy for setting out the fundamental technical framework of generative AI by explaining its operating principles, content generation processes, model architecture and lifecycle. They also address the main areas of use of these technologies, as well as key risks such as hallucinations, bias, data security vulnerabilities, deepfakes and intellectual property infringements.

In addition, the Guidelines assess the obligations under Law No. 6698 within the context of generative AI, including the distinction between data controller and data processor, the conditions for processing personal data, core data protection principles, transparency and cross-border data transfers. They further provide guidance on how data subjects’ rights should be exercised and how security measures should be implemented.

The document also includes practical recommendations for individuals in their daily use of generative AI, as well as specific guidance for parents with regard to child users. In an ecosystem where artificial intelligence technologies are developing at a rapid pace, the publication of such a framework for the protection of privacy constitutes an important step toward strengthening public trust and promoting the responsible use of AI.

Digital Economy Partnership Agreement Submitted for the Approval of the TBMM

The Organization of Turkic States (TDT) has taken a significant step that will strengthen digital trade and data security on a common ground.

The Digital Economy Partnership Agreement, signed in Bishkek on November 6, 2024, among TDT member countries, has entered the ratification process in Türkiye, and the relevant legislative proposal has been submitted to the Grand National Assembly of Türkiye (TBMM). While aiming to increase cooperation in the digital economy, the Agreement dedicates a specific article to the protection of personal data.

Article 19 of the Agreement imposes an obligation on the State Parties to establish a national legal framework regarding personal data protection or to maintain existing regulations. Furthermore, it envisages the determination of clear rules for cross-border data transfer, the public availability of information regarding the rights of individuals and the obligations of enterprises, and the enhancement of transparency in data protection practices.

This regulation bears importance as it facilitates secure data flow among TDT countries, establishes common standards in digital trade, and strengthens transparency regarding the protection of personal data. The Agreement is considered a strategic step towards the establishment of a common digital market in the Turkic world.

KVKK Approved Data Transfer Abroad Within the Scope of the Agreement Between the Presidency of Migration Management and UNHCR

The Personal Data Protection Authority shared an important decision regarding the transfer of personal data abroad with the public via an announcement published on November 10, 2025.

In the announcement, it was stated that an agreement not in the nature of an international treaty, signed between the Presidency of Migration Management of the Ministry of Interior and the United Nations High Commissioner for Refugees (UNHCR), was evaluated as the basis for data transfer.

The Board examined the agreement in question within the scope of Article 11 of the Regulation on Procedures and Principles Regarding the Transfer of Personal Data Abroad and concluded that the agreement contains the necessary safeguards and protection mechanisms for the transfer of personal data abroad. As a result of this evaluation, permission was officially granted on October 21, 2025, for the transfer of personal data abroad within the framework of the aforementioned agreement.

This decision draws attention as it constitutes a concrete example regarding the scope of application of the provision regulating the permission for personal data transfer through "agreements not in the nature of an international treaty," regulated under Article 9, paragraph 4, subparagraph (a) of the Law.

*This newsletter is prepared solely for informational purposes and does not constitute any legal advice for a specific case or client.