The Pulse — Edition 06: Regulatory Landscape in Data Protection Law
February 2026 | Başaran Law Firm
A New Era in Data Flows Between the European Union and Brazil
The European Union and Brazil have formally adopted mutual adequacy decisions in the field of personal data protection. This development is based on the determination that both parties ensure equivalent and adequate levels of data protection, enabling the secure and free flow of personal data between them.
With the publication of the decisions, personal data may now flow reciprocally between the European Union and Brazil without the need for additional transfer mechanisms or contractual safeguards. This development is set to create the world's largest "safe and free data flow area," covering approximately 670 million consumers.
On the EU side, the decision was implemented by the European Commission under the General Data Protection Regulation (GDPR) through an implementing act. On the Brazilian side, a parallel measure was adopted by the National Data Protection Authority (ANPD), established under the Brazilian General Data Protection Law (LGPD), recognizing the EU's data protection regime as adequate. The European Commission stated that the decision will strengthen trade relations, support the digital economy, and reduce legal uncertainty for businesses. The arrangement is also viewed as part of the broader framework of historic partnership agreements between the EU and Mercosur and is considered a significant milestone in the harmonization of global data protection standards.
Critical Updates from the ICO on Transfers, Access, and Enforcement
The beginning of 2026 witnessed notable developments in the United Kingdom's data protection regime. The country's data protection authority, the Information Commissioner's Office (ICO), updated its guidance and took important steps regarding its enforcement approach. At the center of these developments is the Data (Use and Access) Act 2025 (DUAA) — a major reform of the UK data protection framework adopted in 2025.
- Update to the Right of Access Guidance: As part of its alignment with the DUAA, the ICO updated its guidance on data subjects' right of access (DSAR). The revision clarifies the scope of "manifestly unfounded" access requests and emphasizes that organizations must adopt a "reasonable and proportionate" approach when responding to such requests.
- Three-Step Test for International Data Transfers: The ICO also significantly simplified and clarified its guidance on international data transfers under the UK GDPR. The updated text introduces a three-step test to help organizations determine whether they are making a "restricted transfer."
- A New Contractual Location-Based Approach: One of the most notable changes in the guidance is the shift from a geographically focused assessment to one based on contractual location. According to the ICO, what matters is not where the data is physically stored, but the country in which the recipient organization is legally established. Under this approach, a restricted transfer may arise even if the data does not physically leave the UK, provided that the contractual counterparty is established in a third country deemed "not adequate."
- Memorandum of Understanding Between the ICO and the UK Government: On 8 January, the ICO and the UK Government signed a Memorandum of Understanding aimed at strengthening cooperation in the field of data security. The agreement seeks to promote the secure development of data use in public services and to ensure that systemic lessons are learned from data breaches.
- Section 138 of the DUAA Enters into Force: Section 138 of the DUAA entered into force on 6 February 2026. The provision criminalizes the creation, or the solicitation of the creation, of an "image alleged to be obscene" without the consent of an adult. The measure is being viewed in the context of growing concerns surrounding AI-assisted content generation.
42 Million Euro Fine from the French Data Protection Authority
The French data protection authority, CNIL, imposed a total fine of €42 million on telecommunications companies Free Mobile and Free as part of its first enforcement actions of 2026. The decision follows a large-scale data breach that occurred in 2024.
The investigation found that the personal data of millions of customers had not been protected with adequate technical and organizational security measures. It was also determined that breach notifications were incomplete and that certain data had been retained longer than necessary. CNIL imposed a €27 million fine on Free Mobile and a €15 million fine on Free, while also ordering the companies to strengthen their security measures. The decision underscores that serious sanctions continue to be enforced under the GDPR in cases involving failures to comply with data security obligations.
Data Deletion Warning Issued to Staples in Canada
On 13 January 2026, the Office of the Privacy Commissioner of Canada (OPC) announced the outcome of its investigation into Staples Canada. The investigation revealed that certain returned electronic devices had been resold without fully erasing customers' personal data. In its statement, the OPC concluded that the practice violated Canada's private sector privacy legislation. The authority emphasized that second-hand laptops and similar devices must be thoroughly wiped in accordance with manufacturers' instructions before resale. The regulator also called for clearer staff guidance and stronger technical controls in data deletion processes. Staples Canada reportedly accepted the recommendations and committed to updating its internal procedures.
Personal Data Deletion Now Just One Click Away in the U.S. with "DROP"
On 1 January 2026, the California Privacy Protection Agency (CPPA) officially launched the Delete Request and Opt-out Platform (DROP), a system developed to address the collection and sale of personal data by data brokers. The new platform allows residents to submit a single request to have their personal data deleted by hundreds of registered data brokers.
DROP was established under the 2023 Delete Act and requires data brokers to receive and process deletion requests through a centralized mechanism. After verifying their identity and residency, users can submit a bulk deletion request via the platform, eliminating the need to contact each company individually. Authorities expect the initiative to help reduce risks associated with spam, targeted advertising, data profiling, and identity theft. The CPPA emphasized that DROP represents the first centralized deletion mechanism of its kind in the United States and may serve as a model for other states.
Interactive Advertising Bureau Europe Wins Appeal Against APD Decision
On 7 January 2026, the Belgian Market Court annulled the corrective action plan approved by the Belgian Data Protection Authority (APD) concerning the Transparency and Consent Framework (TCF) under the GDPR. In January 2023, the APD had approved an action plan submitted by IAB Europe to bring the TCF into compliance with the GDPR and had initiated a six-month implementation period.
IAB Europe challenged the decision, arguing that the scope was overly broad and that it acted only as a joint controller with respect to the "TC String," the signal encoding users' consent preferences. The court upheld the appeal and annulled the APD's approval decision. The court also emphasized that the APD acted procedurally incorrectly by adopting its decision without giving IAB Europe the opportunity to present its views. The ruling requires the APD to reassess the action plan and to prepare a narrower framework aligned with IAB Europe's actual role as controller. The ruling is regarded as an important precedent regarding the legal boundaries of consent management frameworks and GDPR compliance within the European digital advertising ecosystem.
Clear Warning from the Turkish DPA to Mobile Applications
The Turkish Data Protection Authority (KVKK) issued a public announcement concerning push notifications sent through mobile applications, stressing that obtaining notification consent for multiple purposes under a single approval is unlawful.
The Authority concluded that operational notifications forming a natural part of the service — such as order status updates — must be clearly distinguished from campaign or marketing notifications, and that each category must be subject to separate and independent consent. Forcing users to accept marketing notifications in order to benefit from a core service undermines the "freely given" element of explicit consent and violates the principle of granular consent. Accordingly, data controllers are expected to redesign mobile application architectures to allow users to manage different types of notifications separately and to restructure their consent mechanisms in line with this requirement.
KVKK: Data Breach Announcements to Be Removed After 60 Days
The Turkish Data Protection Authority (KVKK) has introduced a new practice regarding the notification and publication of personal data breaches. Under the Law and the Board's established decisions, data controllers are required to notify the Authority as soon as possible and no later than 72 hours after becoming aware of a personal data breach.
With the new approach introduced by Board Decision No. 2025/2451 dated 25.12.2025, breach announcements published on the Authority's website will be removed after 60 days. The measure aims to balance transparency with the principles of proportionality and data minimization, while preventing long-term reputational harm once the public disclosure objective has been fulfilled. Furthermore, if the data controller documents that notification has been made to the relevant persons before this period expires, it has been decided that the breach announcement may be removed from the Authority's website earlier.
Warning from the Turkish DPA on WhatsApp Use in Public Institutions
The Turkish Data Protection Authority (KVKK) issued a public statement following complaints that public sector employees were being required to use foreign-based messaging applications such as WhatsApp for administrative communications. In its announcement, the Authority recalled that, pursuant to a Presidential Circular, the sharing of classified, sensitive, or personal data–containing information and documents through non-domestic or unauthorized communication platforms is not considered appropriate.
The KVKK emphasized that correspondence, instructions, and document sharing conducted via WhatsApp may constitute personal data processing activities. If such processing does not rely on one of the legal grounds set out under the Personal Data Protection Law, responsible public officials may face administrative sanctions under applicable disciplinary provisions. The Authority also reiterated that mobile phone numbers of public employees qualify as personal data and stressed that public institutions must exercise the highest level of diligence in ensuring data security and compliance with data protection legislation.
Update to E-Government System: Termination Codes Removed from Social Security Records
Following a system update to the e-Government portal, access to termination reasons (exit codes) within Social Security Institution (SGK) service records has been restricted from third parties. This change is considered to be aligned with the decision of the Danıştay dated 14 October 2024, which emphasized that recording termination reasons based solely on the employer's unilateral declaration — without having undergone judicial review — may create concerns in terms of the protection of personal data and the right to work.
It had been recognized that codes such as "violation of moral and good faith principles" constitute personal data capable of affecting an individual's professional reputation and working life. However, although this information is no longer visible in the standard service record, it remains accessible in practice through the termination notification document if specifically requested.
Proposal for Turnover-Based Fines for AI-Generated Content
A bill submitted to the Grand National Assembly of Türkiye on 8 January 2026 introduces new sanctions concerning AI-generated content. The proposal seeks to amend Law No. 6698 on the Protection of Personal Data by providing that, where audio, visual, or textual content generated through artificial intelligence is shared without the explicit consent of the data subject, digital platforms enabling the dissemination of such content may be subject to administrative fines.
Under the proposal, fines could amount to up to 5 percent of the platform's global annual turnover for the preceding year. The aim is to replace the existing fixed fine regime with a heavier, turnover-based sanctioning mechanism. The explanatory memorandum to the proposal emphasizes that deepfake content in particular poses increasing risks to personality rights and the security of personal data. The draft legislation is expected to proceed to the General Assembly agenda following deliberations in the relevant parliamentary committees.
*This newsletter is prepared solely for informational purposes and does not constitute any legal advice for a specific case or client.