28.07.2026 06:30
With the KVKK decision published in the Official Gazette, restrictions have been imposed on the public sharing of personal data in exam results, lottery draws, and appointment announcements of public institutions. From now on, results will only be accessible to relevant individuals through e-Government and similar secure systems.
With the decision of the Personal Data Protection Board (KVKK), published in the Official Gazette and entering into force, new regulations regarding public institutions' announcements containing personal data have been implemented.
Within the scope of the new regulation, the publication of personal data such as names, surnames, Turkish ID numbers, KPSS scores, addresses, and mobile phone numbers in exam results, lottery draws, recruitment announcements, and appointment notifications in a manner accessible to everyone has been restricted.
RESULTS WILL BE SHARED VIA SECURE SYSTEMS
According to the decision, results related to exams, draws, and recruitment processes conducted by public institutions will no longer be announced in publicly accessible lists.
Instead, results will be shared through secure systems accessible only to the relevant individual or authorized inspection personnel. In this context, public institutions will be required to use secure platforms such as e-Government, two-factor authentication (2FA), or systems requiring a Turkish ID number and password for login.
PAST SHARINGS WILL ALSO BE REVIEWED
The KVKK also requested public institutions to review past shares containing personal data on their existing websites.
Content without a legal basis or whose publication period has expired will be removed, deleted, or anonymized. For documents that must be published, only necessary information will be included, and unnecessary personal data will be concealed through masking methods.
BULLETIN BOARDS AND EMAILS ALSO COVERED BY THE REGULATION
The new rules apply not only to websites but also to internal and inter-institutional email correspondence, bulletin boards, physical announcement areas, and closed electronic networks.
In these channels, necessary technical and administrative measures will be mandatory to protect personal data from unauthorized access.
PENALTIES WILL BE APPLIED FOR NON-COMPLIANCE
The KVKK emphasized that the protection of personal data and ensuring data security is the responsibility of public institutions acting as data controllers.
The decision stated that administrative actions and sanctions will be applied against public institutions and organizations that fail to fulfill their obligations or commit data security violations under Article 18 of the Personal Data Protection Law No. 6698.