Extension of Compliance Period for Third Party Use of Loyalty Cards

The Personal Data Protection Authority (“Authority”) has published the Personal Data Protection Board (“Board”) Decision titled “Extension of the Compliance Period Set Forth for Data Controllers under the Principle Decision on the Use of the Mobile Phone Number or Loyalty Card Number of a Loyalty Card Member by a Third Party During a Purchase” (“Decision”) on 13 August 2026. The Decision extends the compliance period regarding the measures to be taken by data controllers where the mobile phone number or loyalty card number of a loyalty card member is used by a third party during a purchase.

The Decision recalls that, under the Principle Decision dated 11 February 2026 and numbered 2026/266, data controllers were granted a 6-month compliance period to take the necessary technical and administrative measures and establish verification mechanisms to ensure that purchases made through loyalty cards comply with the Personal Data Protection Law No. 6698 ("Law") and that such transactions are carried out with the knowledge and consent of the relevant data subject.

As the aforementioned compliance period was due to expire on 28 August 2026, and in light of the need to extend the period following requests from the sector, the Board has decided, by the Decision, to extend the 6-month compliance period granted to data controllers until 28 February 2027.

Accordingly, data controllers have been granted an additional 6-month period to establish mechanisms ensuring the verification of the relevant data subject’s knowledge and consent and to take the necessary technical and administrative measures where the mobile phone number or loyalty card number of a loyalty card member is used by a third party during a purchase.

You may access the Decision here.