Information Note - KVKK Principle Decision: Loyalty Cards

Subject: Verification Requirement for the Use of Telephone Numbers in Loyalty Cards

Compliance Deadline: 28 August 2026

1. Matters Changed by the Decision

The Personal Data Protection Board (the "Board") has found the widespread practice in the retail sector of benefiting from loyalty card advantages such as discounts and point accrual by simply stating a mobile phone number to be unlawful. Henceforth, merely declaring a phone number at the checkout will no longer be sufficient. A verification step proving that the transaction genuinely belongs to the owner of that number has become mandatory.

2. Key Grounds of the Board

The Board has emphasized three main points in its principle decision:

Data Accuracy (KVKK Art. 4): Third parties making purchases using another person\'s number causes inaccurate data (purchase history, location, etc.) to be recorded in the profile of the actual cardholder. This constitutes a breach of the data controller\'s obligation to ensure that "data is accurate and up-to-date."

Absence of Legal Basis (KVKK Art. 5): The processing of a data subject\'s data without their knowledge and consent does not rely on any of the processing conditions stipulated under the KVKK.

Non-Transferability of Liability (KVKK Art. 12): The inclusion of the clause "The responsibility for card usage rests with the member" in membership agreements does not relieve the data controller of its obligation to implement technical and administrative measures.

3. Accepted Verification Methods

The Board has accepted the following methods as lawful for verifying the loyalty card holder:

SMS OTP: Entry of a one-time code sent to the customer\'s phone at the checkout.

QR Code: Scanning of a code generated through the mobile application at the checkout.

Physical Card: Presentation of the physical loyalty card at the checkout.

Password (PIN): Entry of a customer-specific password on the POS terminal.

4. Risks and Sanctions

The Board has granted businesses a 6-month period to comply with the principle decision. The compliance period will expire on 28.08.2026. The risks facing companies that fail to take measures by the end of the compliance period are as follows:

Administrative Fines: Taking into account the 2026 revaluation rates, the current fine ranges are as follows:

For failure to fulfill data security obligations, an administrative fine ranging from TRY 256,357 to TRY 17,092,242;

For failure to comply with Board decisions, an administrative fine ranging from TRY 427,263 to TRY 17,092,242 may be imposed.

In determining the amount of the fine, factors such as the nature and scope of the violation, the scale of the business, and whether it constitutes a repeat offence shall be taken into consideration.

Individual Applications: The operational burden and reputational damage that may arise from complaints filed by customers who have had invoices issued in their name without their knowledge.

Tax and Consumer Law Issues: Invoices issued in another person\'s name may create complications in warranty and return processes.

5. Conclusion

The published principle decision has put an end to a widespread sectoral practice that has persisted for years. Given that the additional verification step introduced by the decision is of a nature that will increase the time customers spend at the checkout during payment, businesses have a 6-month period to prepare and strike a balance between maintaining loyalty card utilization rates and implementing the security measures prescribed by the KVKK. As the implementation of the specified measures will compel businesses to engage in additional personal data processing in most scenarios, businesses will also be required to update their disclosure notices. Although the system introduced by the decision will initially create an operational burden, in the long term it will bring CRM customer data of businesses to a cleaner standard.