Insights and updates
From emerging regulation to deal mechanics, we write about the questions founders and investors actually ask: practical analysis you can put to work.
The Turkish Personal Data Protection Board published 47 decision summaries on 10 August 2026. TRY 11.5 million in fines, four penalties at the statutory maximum and recurring patterns under eight headings, with a twelve-point action plan.
Personal data in AI training sets stays regulated until it is truly anonymized — KVKK and GDPR treat pseudonymized data as personal, “publicly available” is not a free pass, and models can memorise their way back into scope.
AI that assigns shifts, scores productivity or flags “low performers” sits at the intersection of Turkish labour law, KVKK and the EU AI Act — where employment-related AI is high-risk by default and emotion recognition at work is banned outright.
The 29 July communiqué lets precious metals in Mint and Exchange custody trade as digital precious metals on DLT, creating a third lane for tokenized assets beside the crypto and capital markets regimes.
The AI Act is enforced by national market surveillance authorities, the AI Office for GPAI, and data protection authorities in parallel — with fines up to €35M or 7% of global turnover, but capped and proportionate mechanics that SMEs should understand before panicking.
Every provision of Law No. 7589 that touches technology and business: the UYAP e-sale portal, electronic notarial records, the account-mule sentencing calibration, the digital evidence lifecycle, procedure reform and the new statutory interest.
