Türkiye updates personal health data rules to align with law and access controls

On 3 December 2025, Türkiye published the Regulation Amending the Regulation on Personal Health Data in the Official Gazette (No. 33096), which introduces key updates on the processing, access, and disclosure of health data.

Health data is classified as a special category of personal data under Article 6(1) of the Personal Data Protection Law No. 6698 (DPL). Under Article 6(3) of the DPL, processing such data is generally prohibited with specific exceptions including explicit consent, statutory authorisation, protection of life or physical integrity when consent cannot be obtained, data voluntarily made public by the individual, and the establishment, exercise, or defence of legal rights.

The Amendment Regulation ensures that all health-data activities comply with these specific conditions.

Key updates

The most important changes found in the Amendment Regulation include the following:

• Alignment with Article 6(3) processing conditions: All health-data processing, e-Nabız access, and disclosure obligations are now explicitly tied to the lawful conditions under Article 6(3), replacing previous broader permissions. Health data may only be processed or disclosed where a statutory exception exists.
• Health data access and e-Nabız privacy: Access is now explicitly tied to lawful processing conditions under Article 6(3) and limited to what is strictly necessary for health-care delivery, with standardised access periods for treating physicians and institutions, specific rules for emergency care, and updated privacy controls clarifying when patient-controlled restrictions apply or may be overridden. Additional safeguards apply to highly sensitive health data.
• Ministry unit access: Access by Ministry of Health personnel to anonymised central health data is explicitly limited to Article 6(3) processing conditions, replacing the previous broader authorisation for planning, management, or regulatory purposes.
• Other operational updates including:
  • Parental access to children’s health data during and after divorce, with non-custodial parents able to request limited, anonymised data.
  • Removal of special authorisation requirements for attorneys.
  • Extended post-mortem data retention from 20 to 30 years.
  • Caregiver access for individuals with disability reports.

Conclusion

The Amendment Regulation reinforces compliance with Article 6(3) processing conditions for health data, ensuring that processing and disclosure activities are lawful. Operational clarifications enhance transparency, individual control, and trust in Türkiye’s digital-health infrastructure, providing a clear framework for health-care providers operating in Türkiye.

For more information on the Amendment Regulation and its potential implications for health-care providers in Türkiye, contact the experts who wrote this article: alican.babalioglu@ybk-av.com, melis.celik@ybk-av.com, and ezgi.bahar@ybk-av.com.