Instant messaging and data security in public institutions

In its public announcement dated 29 January 2026, the Personal Data Protection Authority stated that it had received notices and complaints indicating that public employees were being obliged to use the WhatsApp application and to join various groups in carrying out administrative affairs and transactions, that orders and instructions were given through the application, and that official documents were shared through it. In the same announcement, the Authority also noted that such foreign-origin applications do not have data centres located within the country.

For the institution, the risk can be grouped under three headings. First, the institution cannot determine in which country, and under whose supervision, the shared content is stored. Second, because correspondence remains on the personnel's personal device and personal account, the institution's access to this information may be lost in the event of a change of post or departure. Third, instructions given and documents shared through this channel fall outside the institution's official record-keeping order.

Presidential Circular No. 2019/12 on Information and Communication Security Measures was published in the Official Gazette dated 6 July 2019, numbered 30823. Several of the 21 measures in the Circular directly concern communication within and between institutions.

• Article four: Except for domestic mobile applications developed by institutions authorised for coded or encrypted communication under legislation, confidentiality-classified data shall not be shared and communication shall not be carried out through mobile applications.
• Article five: Confidentiality-classified data shall not be shared and communication shall not be carried out through social media.
• Article six: The use of domestic applications shall be preferred for social media and communication applications.
• Article nineteen: Corporate communication shall not be carried out from non-corporate, personal e-mail addresses, and corporate e-mail addresses shall not be used for personal purposes.

In its announcement dated 29 January 2026, the Personal Data Protection Authority, relying on articles four and six, specifically emphasised that official documents containing confidentiality-classified data, or data that may be of critical importance, should not be shared through foreign-origin communication applications. The approach taken in article nineteen on personal e-mail accounts likewise makes clear, for messaging as well, that corporate communication must be carried out through channels under the institution's control.

The Guide grades the measures for implementing the Circular into basic, intermediate and advanced levels. Asset groups with a criticality level of 1 are subject to basic-level measures; those with level 2, in addition, to intermediate-level measures; and those with level 3, in addition to both, to advanced-level measures. Instant messaging security is regulated in the Guide under main heading 4.2.

The Guide also addresses data localisation under headings other than messaging. Measure 3.2.7.2 requires that corporate critical data not be stored in cloud storage services other than institutions' own private systems or domestically based service providers under institutional control. Measure 4.3.1.1 requires it to be guaranteed that critical data is stored domestically and not hosted abroad. Files shared through a messaging application are also among the data that may fall within the scope of these measures.

The Personal Data Protection Authority has stated that public institutions sharing information or documents containing the personal data of natural persons through foreign-origin applications may be regarded as a personal data processing activity. Activities that do not meet the processing conditions set out in Articles 5 and 6 of the Law may be examined upon complaint or ex officio. The fourth paragraph of Article 18 of the Law provides that, for breaches committed within public institutions, disciplinary proceedings shall be carried out against the relevant officials upon notification by the Board, in accordance with disciplinary provisions. The Authority has also noted that personnel's mobile phone numbers are themselves personal data, and that operations carried out using these numbers must comply with Article 5.

The use of an application whose servers are located abroad also raises the question of transfer abroad. Article 9 of Law No. 6698 was amended by Law No. 7499 on 2 March 2024, and the amendment entered into force on 1 June 2024. Under the new arrangement, transfer is possible where one of the processing conditions exists together with an adequacy decision, or, in the absence of an adequacy decision, where one of the appropriate safeguards is provided, such as a standard contract, binding corporate rules, or an undertaking used with the Board's permission. If none of these exist, the cases of occasional transfer apply; however, among these cases, the three clauses based on explicit consent and on contract do not apply to public institutions' activities subject to public law. For this reason, a public institution cannot treat the terms of use individually accepted by its personnel as a valid basis for transfer for its own business.

The Regulation on the Procedures and Principles to Be Applied in Official Correspondence requires public institutions to conduct their official correspondence electronically, using documents bearing secure electronic signatures, and to keep these documents in electronic form. The preparation, sending and storage of documents classified as For Official Use Only is likewise carried out electronically, while transactions involving documents classified Confidential and above are carried out in physical form in accordance with the relevant legislation. An image of a document shared in a messaging group is not part of this order and does not take the place of official correspondence.

The Regulation on State Archive Services, for its part, defines a document as a written, visual, audio or electronic record containing information, whatever its form of production or physical medium. The same Regulation leaves it to institutions' own responsibility to take security measures against cyberattacks and other threats for documents in electronic form, and to prepare a disaster recovery plan. Correspondence that is decisive in carrying out a task remaining on personal devices makes it harder for the institution to fulfil this responsibility.

Taken together, the legislation above suggests that it would be appropriate for the institution to establish a written messaging policy and to link it to the asset inventory and criticality studies in the Guide. At a minimum, it is recommended that the policy regulate the following matters:

• The name of the application to be used for corporate communication, the location of its servers, and which unit manages it.
• The channels through which confidentiality-classified information and documents may under no circumstances be shared.
• For what purpose, and within what limits, personal data relating to citizen applications or to personnel may be shared in the messaging environment.
• How correspondence in the nature of instructions, and documents shared, are to be linked to the relevant case record, and for how long they are to be retained.
• How the account is to be closed, and how the institution is to access the correspondence, in the event that personnel leave their post or lose their device.
• The KVKK assessment regarding the use of personal mobile phone numbers in corporate groups.

The need for rapid communication is legitimate and will not disappear. Meeting this need in an environment that is under the institution's control, subject to record-keeping order and hosted domestically is the direction indicated jointly by the Circular, the Guide and the KVKK.