This content has been translated from the original text.
This article addresses the Constitutional Court's constitutional assessment, in its decision of 16 April 2026 (Docket No. E.2026/34, Decision No. K.2026/81), of the investigation of the offences of unlawfully disclosing, disseminating or obtaining personal data without the need for a complaint. In its decision, the Court emphasised that these offences concern not only individual interests but also public order and society's trust in the protection of personal data, and concluded that the ex officio investigation procedure is in conformity with the Constitution. The article also evaluates the effects of the decision on criminal law practice, the legal consequences it may have for data controllers and companies, and the obligations arising in terms of KVKK compliance processes, and examines from a practical perspective the new approach to be followed in criminal investigations concerning personal data breaches.
The Constitutional Court has ruled that the provision under which a complaint by the victim is not required for the investigation of the offences of unlawfully disclosing, disseminating or obtaining personal data is in conformity with the Constitution. The decision, published in the Official Gazette of 14 July 2026, produces important consequences that will directly affect criminal law practice in the field of personal data protection.
In the application filed by the Osmaniye 13th Criminal Court of First Instance, it was alleged that Article 139 of the Turkish Penal Code (TPC) was contrary to the Constitution. The main ground of the application was the claim that, although offences violating the confidentiality of private life are in certain cases subject to a complaint, the ex officio investigation of the offences of unlawfully disclosing, disseminating or obtaining personal data constitutes a violation of the principle of equality. The Constitutional Court, however, unanimously rejected this claim by its decision of 16 April 2026 (Docket No. E.2026/34, Decision No. K.2026/81). Thus, it has become final that the existing provision is in conformity with the Constitution.
The decision emphasised that the unlawful processing of personal data not only violates the individual rights of the victim but also affects society's trust in the protection of personal data and public order. According to the Court, the protection of personal data is today not merely an individual interest; it is a legal value of a public nature in terms of digital security, trust in information systems and the protection of fundamental rights. For this reason, not leaving the investigation of these offences to the will of the victim was regarded as a requirement of the public interest. The decision also shows that the discretionary power of the legislature as to the procedure by which offences are to be investigated has been exercised in conformity with the Constitution.
With the Constitutional Court's decision, where there is a report, a finding or other evidence that personal data have been unlawfully obtained, disseminated or shared with third parties, public prosecutors' offices will be able to initiate an investigation ex officio without waiting for a complaint from the victim. This will make it possible for criminal investigations to begin more quickly, in particular in incidents such as data leaks, cyber-attacks, data breaches originating from employees, cases of unauthorised access and the unlawful sharing of personal data. Accordingly, the victim's not lodging a complaint will not prevent the criminal investigation from being conducted.
The decision also has significant consequences for all data controllers operating within the scope of Personal Data Protection Law No. 6698 (KVKK). From now on, when a data breach occurs, not only administrative fines or liability for compensation under the KVKK but also the risk of a criminal investigation may arise, even without an application by the victim. For this reason, it is more important than ever for companies to keep their KVKK compliance programmes up to date, to review their technical and administrative security measures regularly, to provide employees with periodic training on data security, to establish data breach response plans, and to detect data breaches quickly and fulfil their legal obligations.
This decision of the Constitutional Court shows that the criminal law approach to the protection of personal data is increasingly shaped by a stronger public order perspective. With the development of the digital economy, the protection of personal data has ceased to be merely a matter concerning the private life of individuals; it has become one of the fundamental elements of companies' corporate governance, information security and legal compliance processes. For this reason, it is not sufficient for data controllers merely to fulfil their obligations under the KVKK; they must also establish a comprehensive compliance policy that takes into account the criminal law dimension of possible data breaches. Effective internal audit mechanisms, regular risk analyses and up-to-date data security practices are of critical importance in reducing the risks of both legal and criminal liability.
In conclusion, the Constitutional Court's decision has once again made clear that the offences of unlawfully disclosing, disseminating or obtaining personal data must be regarded as offences that no longer depend on the victim's complaint and that concern the public interest. For companies that process data in particular, this decision makes it mandatory to address KVKK compliance, information security, cyber risk management and criminal liability together. In the digital age, the full performance of the obligations relating to the protection of personal data is of great importance in order to avoid not only administrative sanctions but also criminal investigations that may be conducted ex officio.
