Loyalty Card Verification Requirements: Compliance Period Extended to 28 February 2027

Introduction

The Personal Data Protection Board (“Board”) has extended until 28 February 2027 the previously determined compliance period concerning the use, during purchases, by third parties of the mobile phone number or loyalty card number belonging to loyalty card holders. The Board’s decision dated 22 July 2026 and numbered 2026/1491 on the matter was published in the Official Gazette dated 13 August 2026 and numbered 33339.

Background

In its Resolution dated 11 February 2026 and numbered 2026/266, the Board addressed a significant personal data protection issue commonly encountered in loyalty card programmes. (You may access Resolution No. 2026/266, which is only in Turkish, here.)

The examinations conducted revealed that purchases could be made through the loyalty card holder’s account, and discounts or promotions could be utilised, where another person provided the loyalty card holder’s mobile phone number or loyalty card number at the checkout, without any verification being carried out.

It was also noted that invoices and similar documents issued as a result of purchases made using a loyalty card were frequently issued in the name of the loyalty card holder, and that customer transaction data, such as the product or service purchased and the date of purchase, were recorded by associating such data with the relevant data subject’s membership account or customer profile.

In this context, the Board pointed out that where a loyalty card holder’s mobile phone number or loyalty card number is used by a third party without the holder’s knowledge and consent, purchase information that does not in fact belong to the relevant data subject may be recorded in that person’s records or membership account, or an invoice relating to a purchase not made by that person may be issued in their name.

The Board assessed that such transactions carried out without the knowledge and approval of the relevant data subject:

• may not be based on a lawful ground for processing personal data within the scope of article 5 of Personal Data Protection Law No. 6698 (“Law”);
• the recording in a person’s customer profile of purchase information that does not actually relate to that person may constitute a breach of the principle of being “accurate and, where necessary, kept up to date” under article 4 of the Law; and
• imposing a contractual obligation on members not to allow third parties to use their loyalty cards does not eliminate the data controller’s obligation to ensure data security arising from article 12 of the Law.

In light of these assessments, the Board decided that practices enabling third parties to carry out transactions on behalf of loyalty card holders without any verification must be discontinued and that data controllers must implement appropriate technical and administrative measures to verify that transactions carried out using a loyalty card are conducted with the knowledge and consent of the relevant data subject.

What Is Expected from Data Controllers?

Pursuant to Resolution No. 2026/266, data controllers are required to establish mechanisms capable of verifying that the use of a loyalty card during a purchase takes place with the knowledge and approval of the card holder.

The Board also states that verification methods do not have to be uniform. Alternative verification methods may be offered, taking into account differences among data subjects in terms of factors such as age, level of education, economic circumstances and technological literacy. Likewise, different methods may be preferred depending on the level of risk associated with different transactions, such as membership verification, earning points, redeeming points, or benefiting from discounts or promotions.

In this context, data controllers may, depending on the characteristics of their own systems and operations, consider methods such as a one-time verification code sent via SMS, a barcode/QR code generated through a mobile application or website, or other similar secure verification methods. In the Board’s decision, such methods are addressed as examples of verification practices that may be used in connection with loyalty card membership.

Compliance Period Extended Until 28 February 2027

Resolution No. 2026/266 was published in the Official Gazette on 28 February 2026, and data controllers were granted a six-month compliance period from the date of publication to establish the necessary verification mechanisms.

However, industry representatives requested additional time from the Board in order to ensure that the obligations could be fulfilled effectively and sustainably and that the verification methods could be implemented securely from technical, administrative and operational perspectives.

Having assessed these requests, the Board, by its decision dated 22 July 2026 and numbered 2026/1491, extended the compliance period until 28 February 2027.

What Does This Mean for Companies?

The extension provides companies, particularly those operating in sectors where loyalty programmes are widely used, such as retail, food, cosmetics, technology, home improvement and apparel, with additional time to restructure their systems.

However, the extension does not mean that the obligations imposed on companies have been removed or that their substance has changed. Data controllers must implement, no later than 28 February 2027, appropriate verification mechanisms aimed at preventing loyalty cards from being used by unauthorised third parties.

Steps Companies Should Take

It is important for data controllers operating loyalty card or similar customer membership programmes to treat the compliance period not merely as a period for technical development, but as an end-to-end Law compliance project.

In this context, companies are particularly advised to undertake work in the following areas:

1. Analyse existing loyalty programme processes: Determine whether third parties are able to carry out transactions by using a telephone number, card number, customer number or similar information.
2. Design a verification mechanism: Identify technical solutions appropriate to the risk level of the relevant use case that will prevent transactions from being carried out without the knowledge and approval of the relevant data subject.
3. Assess alternative access methods: Take into consideration customer groups with differing needs and abilities in relation to the use of technology.
4. Review POS, CRM and loyalty platforms: Establish controls to ensure that purchase information, points transactions, the use of discounts/promotions and invoice records are associated with the correct customer.
5. Update administrative processes: Bring procedures and training for store and checkout personnel into line with the new verification model.
6. Assess suppliers and service providers: Review agreements with third parties providing services in connection with loyalty programmes, CRM systems, mobile applications, SMS services or verification infrastructure, as well as the applicable data security measures.
7. Update Law documentation: Bring the personal data processing inventory, privacy notices, retention processes, risk assessments, and records relating to technical and administrative measures into line with the new process.

Risk of Sanctions

In Resolution No. 2026/266, the Board expressly stated that action may be taken pursuant to article 18 of the Law against data controllers that are found to continue unlawful practices without taking the necessary measures or that fail to comply with the obligations set out in the relevant decision.

Accordingly, 28 February 2027 should be regarded not merely as a deadline for completing technical system developments, but as a critical compliance deadline for bringing loyalty programmes into compliance with personal data protection legislation.

Conclusion

Although the Board’s decision no. 2026/1491 grants data controllers a significant additional compliance period, the fundamental approach to loyalty card practices remains unchanged. Systems that allow third parties to make purchases merely by providing the loyalty card holder’s mobile phone number or card number, without verifying the knowledge and approval of the card holder, must be restructured with appropriate verification mechanisms by 28 February 2027. In particular, companies operating high-volume loyalty programmes would be well advised to begin planning their compliance efforts now, covering not only technical developments but also processes, contracts, documentation and employee training.

You may access decision no. 2026/1491, which is only in Turkish, here.