Unlawfully obtaining personal data, giving it to a third party or disseminating it is punishable under Article 136 of the TCK by imprisonment from two to four years. Telephone numbers, addresses, photographs, health records and digital communication data may constitute personal data in a specific case. However, using or sharing data does not constitute an offense in every case: how the data was obtained, the purpose of its use, legal authority, consent, intent and the evidence are assessed together. This offense, which is not subject to a complaint requirement, must be distinguished from the KVKK application routes, from the offense of violating the privacy of private life and from the separate offenses in the 2025 Cybersecurity Law. [1] [2] [5]
What is the TCK 136 offense and what conduct does it cover?
Article 136 of Turkish Penal Code No. 5237 makes it an offense to unlawfully give to another person, disseminate or obtain data relating to an identified or identifiable natural person. These are three distinct alternative acts. The law does not require all of these acts to be carried out together for the offense to be completed. Accordingly, even if data was initially obtained lawfully, its later disclosure to an unauthorized person may be examined separately; conversely, the allegation that the data was obtained unlawfully does not by itself prove who carried out which act. [1] [6]
The fundamental right to the protection of personal data is safeguarded by Article 20(3) of the Constitution. While Law No. 6698 on the Protection of Personal Data (KVKK) regulates the conditions for processing personal data and the obligations of the data controller, Article 136 of the TCK is based on the criminal liability of the individual. Just as a finding of a KVKK violation does not mean a criminal conviction, the absence of an administrative decision under the KVKK does not by itself eliminate a criminal investigation. [1] [3]
Giving personal data to another person
Transferring data into the sphere of knowledge of an unauthorized natural or legal person may also take place by sending it to a single person. Forwarding a person’s telephone number to someone else, sending employee lists to a different company or handing over a patient document to an unauthorized third party may be assessed under this heading. The recipient later disseminating the information is a separate event; a public post on social media is not required for the offense of giving. It must be examined whether there is any legal authority permitting the data to be sent or any other ground of justification.
Disseminating personal data
Dissemination may take place by bringing data to the knowledge of more than one person or by making it accessible. Adding photographs to a fake social media account, sending a file containing personal data to a large number of recipients, publishing data on the internet or distributing it in closed groups are examined in this context. Whether the account is public or private matters for the boundaries of the act and for the available evidence; however, sharing in a closed group is not automatically lawful.
Obtaining personal data
Obtaining means bringing personal data that is under another person’s control under the perpetrator’s control. Creating an unauthorized copy from a database, taking a copy of a stored document, transferring records containing personal data to external storage or acquiring records on a telephone without authorization may, depending on the specific case, constitute this act. Merely viewing the content of data or learning it through the senses is not the same as gaining the ability to dispose of the data. How this distinction is applied to a specific case is particularly important in light of the decision of the Criminal General Assembly of the Court of Cassation (Yargıtay Ceza Genel Kurulu) dated June 21, 2023. [7]
What information counts as personal data?
Article 3(1)(d) of the KVKK defines personal data as any information relating to an identified or identifiable natural person. Data does not necessarily have to be confidential in nature. While a first and last name alone may belong to more than one person, combined with other information it may make a person identifiable. Even if an everyday photograph, an identity document, a workplace record and a medical report have the same need for protection, from a criminal law perspective the nature of the data and the context of its use are examined separately. [3] [6]
| Data category | Specific examples | Key issue in the review |
|---|---|---|
| Identity and contact | Name, Turkish identity number (T.C. kimlik numarası), address, telephone, email, photograph | Identifiability, purpose of the transfer and authority |
| Health and biometric records | Treatment, prescription, diagnosis, fingerprint, genetic data | Special sensitivity, access authority and confidentiality |
| Financial and professional information | IBAN, salary, bank transactions, employee file, personnel record | Legitimate transaction purpose, recipient and scope of the data |
| Digital communication and location | HTS, call history, user ID, identifiable IP, location | Method of obtaining and lawful access |
| Online images and profiles | Profile photo, post, linked account information | Intention to make public versus the context of later use |
The conditions for processing special categories of data regulated in Article 6 of the KVKK are not identical to all increases of penalty in criminal law. The increase by one half for special data under TCK Article 135(2) concerns the offense of recording personal data; it does not automatically apply to TCK Article 136. For TCK Article 136, statutory special grounds for increase are to be sought separately in Article 136(2) and Article 137. [1]
How are the material and mental elements of the offense assessed?
Victim, perpetrator and subject matter of the offense
The victim of the offense is the natural person whose personal data is the object of the unlawful act. The perpetrator may be any person capable of carrying out the act described in the law. A public official’s access to data by virtue of their duties or a healthcare worker’s professional access authority is important for the elements of the offense; the existence of these statuses is not by itself a ground for conviction. Imposing criminal liability on the legal personality of companies and applying security measures under TCK Article 140 in appropriate circumstances are also distinct matters.
Unlawfulness is not merely the absence of consent
Unlawfulness is an express element in TCK Article 136. The absence of another person’s consent is important but is not the only criterion. A legal duty, a mandatory notification to the competent authority, the exercise of a right that may be assessed in the specific case under TCK Article 24 or Article 26, or the conditions for lawful sharing of the data must be discussed. Conversely, data obtained in the course of work cannot be used by taking it outside the purpose of the duty or by disclosing it to large audiences when this is not necessary.
The freedom to seek one’s rights and the freedom of defense do not confer unlimited authority to publish data. Submitting a relevant, necessary and lawfully obtained document to a court and publishing the same document on social media are different legal events. Especially for health data, information concerning children and documents affecting the privacy of third parties, a review of purpose and proportionality must be carried out. [14]
General intent, mistake as to unlawfulness and proof
This offense is committed with intent; not every data transfer resulting merely from a system error, an inadvertent choice of address or a security vulnerability requires a conviction under TCK Article 136. What the perpetrator knew and how they assessed the nature of the data and the unlawfulness of the act are examined together with the conduct before and after, messages, access logs, evidence and the defense. An unavoidable mistake as to unlawfulness under TCK Article 30(4) is distinguished from an abstract plea of ignorance raised merely to escape punishment. [7]
Completion of the offense, attempt, complicity and successive offense
Once the unauthorized transfer, dissemination or obtaining of the data is completed, the occurrence of material damage is not additionally required. If execution of the act has begun but the result could not be completed, an assessment may be needed in terms of attempt under TCK Article 35; if several persons contributed, in terms of complicity; and if acts were committed on different dates pursuant to the same decision to commit an offense, in terms of TCK Article 43. However, the occurrence of different alternative acts, the existence of more than one victim or the same file being opened by different persons does not by itself create an automatic formula for increasing the penalty. Unity of the act, intent and the statutory conditions must be determined separately for each transaction and each victim.
Is sharing a publicly available photo from the internet an offense?
Re-sharing every public photograph is not an offense; however, the fact that data was previously public is not in itself unlimited permission for reuse either. Decisive in the review are who initiated the sharing, how public the photograph was on the source page, the accompanying name and address information, whether a fake account was created, whether the sharing was used to harm another person or to create a misleading association, and awareness of unlawfulness. [8] [9] [10]
In its decision dated April 21, 2026, E. 2023/4940, K. 2026/4133, the 12th Criminal Chamber of the Court of Cassation (Yargıtay 12. Ceza Dairesi) reversed the acquittal given because a photograph that the person had previously shared from their own account was published from a different account without consent. The decision did not treat the fact that the photograph had been seen before as a reason definitively excluding the commission of the offense. [8]
By contrast, in the same Chamber’s decision dated May 12, 2025, E. 2022/8087, K. 2025/4289, the acquittal of a defendant who had shared news items and photographs about a public figure that had been made public, without changing their context, and whose awareness of unlawfulness could not be proven, was upheld. This does not mean that all fan pages or photographs of public officials are unconditionally free to use; the outcome depends on the circumstances of the specific sharing. [9]
Indeed, in the decision dated May 12, 2025, E. 2023/2695, K. 2025/4315, the conviction given for sharing, without consent, a photograph taken from a public account was also upheld. These three decisions must be read together; drawing a universal conclusion from a single conviction alone or a single acquittal alone is not legally sound. [10]
Use of names and photographs in fake social media accounts
Moving another person’s name, photograph, telephone or address information to a fake account may be assessed under TCK Article 136, taking into account the circle of recipients of the sharing, the impersonation of identity and the context created through words and images. If the conditions of the offenses of insult, threat, blackmail, fraud or cybercrime are met, these must also be examined separately; which concurrence rule the penalties relating to the same act will be subject to is determined in each specific case. [6] [8]
Intimate images and everyday photographs are not the same
There is a distinction in legal characterization between an intimate image of a person inside their home, an audio or video recording showing the sphere of private life, and a portrait taken in everyday clothing in a public place. Recording or disclosing intimate images without consent may give rise to the offense of violating the privacy of private life under TCK Article 134. An everyday photograph, on the other hand, may be personal data for the purposes of TCK Article 136. When characterizing the act, one should look not merely at the sharing platform but at the private-life nature of the image and the type of unlawful act. [1] [15]
Obtaining telephone, WhatsApp and HTS data and private correspondence
Giving a telephone number to others for an improper purpose, opening a fake account in a person’s name, obtaining call records without consent, recording message contents without permission and forwarding private correspondence to other groups are distinct material facts. The boundary between TCK Article 132 (confidentiality of communication), Article 134 (private life), Article 135 (unlawful recording) and Article 136 (giving, disseminating, obtaining) is drawn by taking into account the nature of the data and the subject of the act.
In its decision dated December 6, 2021, E. 2021/4655, K. 2021/8550, the 12th Criminal Chamber of the Court of Cassation stated that the conviction concerning the obtaining, without consent, of six months of HTS records belonging to a spouse in the divorce process was not erroneous in terms of the legal characterization of the offense. Being a person’s spouse does not confer automatic access to their communication and access records. [13]
Saving and sending a WhatsApp profile photo or an image on a social media account, on the other hand, must be examined separately in terms of source, visibility setting, purpose, recipient and unlawfulness. If it is claimed that the sending was made inadvertently, the manner in which the act took place is assessed by means of technical records and other evidence. A person’s photograph having been shared only with a certain circle and its having been used publicly are not the same fact.
Access authority of public officials, hospitals and employees
Queries made by a public official in the system
The issuing of a login password to the institution’s information system does not show that all queries were made in the course of duty. Nevertheless, whether the official merely saw the data in the system, or saved, copied or transferred it to others, must be examined separately. In the decision of the Criminal General Assembly of the Court of Cassation dated June 21, 2023, E. 2021/384, K. 2023/367, in a specific case consisting solely of a query made out of curiosity by a public official who had been granted access authority by the institution, the outcome in favor of acquittal was adopted as a result of the assessments regarding the data not having been transferred elsewhere and awareness of unlawfulness. It was stated that internal disciplinary liability may remain separate. [7]
By contrast, in the decision of the 12th Criminal Chamber of the Court of Cassation dated October 21, 2020, E. 2019/3586, K. 2020/5426, the conviction for a query made by a police officer outside their authority was upheld. The decisions concern different files and factual circumstances. The existence of the recent Criminal General Assembly decision should not be interpreted as a categorical principle placing every access record outside criminal law; query authority, the fact of saving/transferring, the person’s awareness of unlawfulness and proof must each be discussed separately. [7] [16]
Healthcare workers and special categories of data
A patient’s medication list, report, diagnosis or birth information carries special sensitivity. Working at a hospital does not create authority to open records out of curiosity or to transfer a person’s medical information to an unauthorized person. Nevertheless, for a criminal accusation, who accessed the data, the scope of the access authority, the file from which the record was taken, the recipient of the transfer and any legal duty or defense purpose must be established with concrete evidence. The fact that health data is a special category of data does not by itself lead to an automatic increase of the penalty under TCK Article 136.
The decision of the Criminal General Assembly of the Court of Cassation dated June 10, 2014, E. 2012/1514, K. 2014/312, in a case where a person’s birth certificate was obtained from a healthcare institution and submitted as an attachment to an administrative complaint, showed that a claim that the purpose was to seek one’s rights does not by itself end the review of lawfulness. [14]
Company employees, bank records and customer lists
Human resources records, customers’ contact details, the employer’s access logs and bank data may be assessed both under personal data legislation and, depending on the nature of the act, under the rules on trade/customer secrets. A data controller’s weak security policy and an unauthorized transfer deliberately carried out by an employee are not the same legal liability. For this reason, the authorization matrix, job description, access policy, employee training, retention and access records are important.
Personal data in wedding photographs, professional shoots and commercial promotion
Having a photographer take wedding or engagement photographs does not mean that consent has been given to the unlimited commercial use of these images in the artist’s online portfolio, advertising or other client work. Whether the photograph makes the person identifiable, the scope of the shooting and delivery contract, any authorization separately given for promotional purposes, whether the data has been made public, and unlawfulness/intent under TCK Article 136 are examined separately. Under the KVKK, the legal basis for processing and claims arising from personality rights are also subject to their own conditions. The existence of a contractual dispute does not by itself prove that a criminal offense was committed.
If a person later requests the removal of a photograph that they initially had published with consent, the scope of the prior consent, its withdrawal or the legal status of subsequent use, and the specific act of disclosure must be determined. Not every failure to remove is automatically a TCK Article 136 offense; the platform and the data controller may have different obligations. [3]
Submitting personal data to a case file, petition or administrative complaint
Submitting a document to a court does not mean that the data has been disseminated without limit. Submitting personal data that was obtained lawfully and is necessary for resolving the dispute to a judicial or administrative authority may be discussed as the exercise of a right. First, however, the method by which the document was obtained, from whom it was received, its necessity for proving the material fact, whether the information of third parties unrelated to the incident was removed and the parties’ rights of defense are assessed.
In the Criminal General Assembly of the Court of Cassation decision K. 2014/312, how the birth certificate was obtained from the healthcare institution and its use in an administrative complaint were discussed in detail. For this reason, neither the approach “if it was submitted to the court, it is not an offense” nor the approach “every submission of a document containing personal information is an offense” is correct. For attorneys, physicians and other professionals under a duty of professional secrecy, the scope of their authority to act is also important. [14]
Copying bank card and payment information
Copying card information via an ATM, obtaining the personal data on a card or preparations for the unlawful use of a card may bring more than one criminal provision into play. TCK Article 136 and the offense of misuse of bank or credit cards under TCK Article 245 are not the same offense. Installing a device, actually obtaining card data and making payments with that data are separate stages. The completed act, attempt, use and any claim of damage must be distinguished by means of technical findings. The conclusion that the offense was committed cannot be reached solely on the basis that the ATM device was found.
2025 Cybersecurity Law: Re-sharing leaked data
Article 16(4) of Cybersecurity Law No. 7545 provides for imprisonment from three to five years for the acts of making accessible, sharing or offering for sale, for a fee or free of charge and without the permission of the persons or institutions concerned, personal data that has previously appeared in cyberspace as a result of a data leak, or institutional data within the scope of critical public services. Here, the connection of the data to the leak, its prior presence in the cyber environment and the occurrence of the alternative acts set out in the special law are examined. [5]
This special provision is not a general rule that replaces TCK Article 136 in all cases. Sharing an ordinary telephone number is different from selling a previously leaked data set for a fee. Where the same act apparently falls within the scope of more than one provision, the relationship between the norms and the concurrence rules must be assessed separately. The defense that “the data had already leaked” does not by itself lead to a finding of no offense with respect to the acts under Article 16(4) of Law No. 7545.
TCK 136 penalty, aggravated forms and rates of increase
| Provision | Relevant act | Statutory sanction / effect |
|---|---|---|
| TCK Art. 136(1) | Unlawfully giving, disseminating or obtaining personal data | 2–4 years’ imprisonment |
| TCK Art. 136(2) | Certain statements or images recorded under CMK Art. 236(5)–(6) being the subject of the offense | The penalty to be imposed under the first paragraph is doubled |
| TCK Art. 137(1)(a) | Commission by a public official through abuse of official authority | The penalty for the relevant offense is increased by one half |
| TCK Art. 137(1)(b) | Taking advantage of the facility afforded by a profession or trade | The penalty for the relevant offense is increased by one half |
| TCK Art. 138 | Failure to destroy data that must be destroyed at the end of the statutory period | Separate offense; must not be confused with Art. 136 |
| Law No. 7545, Art. 16(4) | Making accessible, sharing or selling leaked personal/critical public service data without permission | 3–5 years’ imprisonment; separate provision |
The existence of grounds for increase cannot be presumed from isolated labels such as being an authorized public official, having a profession or the data being health data. The link between the act and the abuse of official authority or the facility afforded by the profession must be proven in the specific case. The norm in force on the date of the offense and subsequent amendments are assessed separately under TCK Article 7. [1] [5]
Judicial fines, suspension and HAGB are not automatic
Under TCK Article 136(1), the basic sanction is imprisonment directly; no alternative principal judicial fine is provided for. For conversion into an alternative sanction under TCK Article 50, the nature of the sentence imposed, the short-term imprisonment threshold and the special conditions are examined. Suspension under TCK Article 51 and the deferment of the pronouncement of judgment (HAGB) under CMK Article 231 are not automatic outcomes either. [1] [2]
Law No. 7589 dated July 16, 2026 reorganized the HAGB provisions of CMK Article 231. Under the current Article 231(5)–(6), the sentence imposed being two years or less of imprisonment or a judicial fine, the absence of a prior conviction for an intentional offense, the belief that no further offense will be committed and the statutory conditions on compensation for the damage are important. The fact that the lower limit of the basic penalty under TCK Article 136 is two years does not mean that HAGB applies automatically to all defendants. The effect of reductions and increases on the final sentence must be examined together with the conditions, the date of the offense and the transitional provisions. [2]
Statute of limitations, complaint and victim–offender mediation
Under TCK Article 139, the TCK Article 136 offense is not subject to a complaint requirement. As a rule, the investigation may be conducted ex officio by the public prosecutor’s office; the victim’s withdrawal of the complaint does not by itself terminate the public prosecution. Moreover, TCK Article 136 is not among the offenses within the general scope of victim–offender mediation (uzlaştırma) under the CMK; the parties’ mere wish to reconcile does not end the criminal proceedings. [1] [2]
With regard to the statute of limitations for prosecution, under TCK Article 66(1)(e), the ordinary period for the basic form of TCK Article 136(1) is, as a rule, eight years. However, the effect of TCK Article 66(3) with regard to an aggravated form requiring a heavier penalty, the grounds interrupting and suspending the period (TCK Article 67), the date on which the offense was committed, the perpetrator’s age and temporal application are examined separately. For this reason, it cannot be said definitively in every personal data case that “it expires within eight years”. The six-month period specific to the right of complaint must not be confused with the statute of limitations for prosecution of Article 136, which is not subject to a complaint requirement. [1]
Court with subject-matter jurisdiction and territorial jurisdiction
For the basic TCK Article 136 offense, as a rule the criminal court of first instance (asliye ceza mahkemesi) has subject-matter jurisdiction. However, where the same incident involves different offenses, special provisions affecting a heavier sanction or connected proceedings, subject-matter and territorial jurisdiction are determined separately under the relevant provisions of the CMK. For acts committed over the internet, not only the city where the victim is located but also the procedural rules concerning the place where the act was committed, the transfer of the data and the judicial district are examined. [2]
What should a person whose personal data has been shared do?
In a suspected violation, the most important aim is to create a provable record of the incident and to separate the legal remedies without contributing to further dissemination of the data. Re-sharing screenshots received from others on social media may increase the impact of the violation and may also lead to a new transfer of third parties’ data.
- Identify the record: Which data, which URL/account, on which date and at what time, and to whom was it made accessible? Before the content disappears, lawful screenshots, the full link, the post ID and any message/file headers may be saved.
- Preserve the original records: The sender/recipient information of the message, the original file, device or system logs, an integrity record showing the relevant screen together with its surroundings and, if necessary, a request for preservation of evidence are prepared. Copied content must be distinguished from the original data.
- Prepare the criminal report: In an application to the Office of the Chief Public Prosecutor (Cumhuriyet Başsavcılığı), the type of data, the allegation of unlawfulness, the concrete facts linked to the suspect, the available evidence and the investigative steps requested may be presented in an orderly manner. Requests for platform information and for the preservation of digital records should be made specific.
- Consider removal of the publication: Platform notification mechanisms, applications to the content provider, protection of personality rights and judicial protection options in the specific circumstances are handled separately. Which route will be pursued depends on the nature of the publication.
- Separate the KVKK route: If the incident is linked to a processing operation by a data controller within the scope of the KVKK, an application to the data controller within the framework of data subject rights and, where the conditions are met, a complaint to the Board may be considered. Not every allegation of an offense between individuals is turned directly by the Board into a criminal investigation.
- Document the damage and any repetition: Application correspondence, content removal notices, access traces and records of specific pecuniary/non-pecuniary damage should be preserved.
The KVKK application route differs from a criminal complaint
Under Articles 13–14 of the KVKK, the data subject, as a rule, first applies to the data controller; the data controller responds within 30 days at the latest. For a complaint to the Board, periods of 30 and 60 days apply, calculated according to the response period, when the response was given and the date of application. Decision No. 2019/9 of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) dated January 24, 2019 explains this calculation separately. Bringing a data controller’s violation before the Board is not a mandatory precondition for a criminal report that may be filed with the prosecutor’s office under TCK Article 136. [3] [4]
Claims for compensation and claims based on personality rights
The fact that no personal data offense has been committed may not mean that there was no unlawful interference under private law. Claims for the protection of personality rights under TMK Articles 24–25, the liability provisions of the TBK, non-pecuniary damages depending on the conditions and compensation for specific damage are assessed separately. An acquittal or a decision of non-prosecution in criminal proceedings and private law liability do not share the same conditions of proof and method of assessment.
What defenses should a person under a TCK 136 investigation examine?
Building the defense solely on “the data was already on the internet” or “the victim withdrew the complaint” is insufficient in most cases. The core questions that must be answered with the evidence in the file are as follows:
• Data element: Does the imputed information make a natural person identified or identifiable; which part of the information constitutes the subject of the offense?
• Act: Was the data actually obtained, only viewed or transferred to another person; were a specific date, account and recipient established?
• Attribution: How reliable are the platform records, device examination, account management and access authority that link the sharing to the perpetrator?
• Lawfulness: Are there concrete facts and documents that can be put forward regarding explicit and specific consent, legal authority, the limits of a contractual duty or the exercise of a right?
• Intent and mistake: Are a wrong recipient, automatic system sharing, a default access setting, viewing in the course of service or other explanations supported by objective records?
• Obtaining of evidence: By what method were the digital data obtained and preserved; is there any measure that required judicial authorization under CMK Article 134; are the records suitable to serve as the basis for a judgment?
• Distinguishing the offenses: With which of the acts under TCK Articles 132, 134, 135, 136, 243, 245, 239 or Law No. 7545 does the accusation actually coincide? Are the statutory conditions for a successive offense or an aggravated form present?
A conviction requires proof of the material and mental elements in the file by evidence that leaves no room for doubt. Conversely, explaining an irregular access record merely by saying “I had professional authority” may not be sufficient either. Expert examination, the institution’s access records, the original sharing conditions and the victim’s intention to make the data public must be assessed together.
Comparison of TCK 136 with other related offenses
| Provision | Core subject | Distinguishing review |
|---|---|---|
| TCK Art. 132 | Violation of the confidentiality of communication | Content of correspondence or communication and privacy of communication |
| TCK Art. 134 | Violation of the privacy of private life | Intimate image/sound and disclosure of the sphere of private life |
| TCK Art. 135 | Unlawful recording of personal data | The act of recording; the special increase under Art. 135(2) |
| TCK Art. 136 | Obtaining, giving or disseminating | Three alternative acts and unlawfulness |
| TCK Art. 138 | Failure to destroy data whose period has expired | Duty to destroy and the period |
| TCK Arts. 243–244 | Entering an information system, disrupting the system/data | Unauthorized system access or interference with data/system integrity |
| TCK Art. 239 | Disclosure of trade secrets, banking secrets or customer secrets | Nature of the secret, status of the person concerned, transfer and special elements |
| Law No. 7545, Art. 16(4) | Putting leaked personal/institutional data back into circulation | Connection to the leak and special statutory acts |
This table is not a selection algorithm. Where more than one offense type arises in the same incident, an assessment of the statutory elements and of apparent concurrence, notional concurrence or real concurrence is carried out. The fact that one offense is more serious than another does not justify entering a judgment for that offense without investigating the evidence.
Recent Court of Cassation decisions and specific outcomes in practice
The decisions below are summarized on the basis of the act at issue in the case, the outcome reached by the court and the legal distinction. Because some of the decisions reached different outcomes in different incidents, no single decision amounts to a general permission or a general prohibition for all types of sharing. Full citations and links to the decision texts are in the Sources and legal bases section.
Later sharing of a publicly available image: 2026 and 2025 decisions
12th Criminal Chamber of the Court of Cassation, April 21, 2026, E. 2023/4940, K. 2026/4133: In a case where a photograph that the person had previously published on their own account was shared from another account without consent, the acquittal given on the ground of a news purpose was reversed. 12th Criminal Chamber of the Court of Cassation, May 12, 2025, E. 2023/2695, K. 2025/4315: The conviction for sharing without consent was upheld. By contrast, in the decision of the same Chamber, E. 2022/8087, K. 2025/4289, the acquittal was upheld on the grounds of the context of use of the shared data that had been made public and of awareness of unlawfulness. [8] [9] [10]
Photograph revealing a visible identity: 2025 decision
12th Criminal Chamber of the Court of Cassation, December 16, 2025, E. 2023/3806, K. 2025/8877: The conviction was upheld where the photograph of a person whose face had been concealed in an earlier internet news report was found on a different platform and published without concealment together with the person’s first and last name. This decision shows the importance not only of the existence of the photograph but also of the subsequent removal of the intention to conceal in the earlier publication. [11]
Use of a public profile picture on another profile: 2024 decision
12th Criminal Chamber of the Court of Cassation, May 20, 2024, E. 2020/1110, K. 2024/2493: The conviction given for the use, without consent, on another account of a profile photo that the person had previously shared on their own social media account was upheld. The existence of the initial sharing did not make it unnecessary to discuss the elements of the offense. [12]
Mere access to a public institution’s database: 2023 Criminal General Assembly decision
Criminal General Assembly of the Court of Cassation, June 21, 2023, E. 2021/384, K. 2023/367: It was discussed whether a query made with an official user password, in a case without any allegation that the data was copied and transferred, required a conviction under TCK Article 136; the acquittal outcome in the specific case was adopted. The fact that the 12th Criminal Chamber’s decision dated October 21, 2020, E. 2019/3586, K. 2020/5426 on the same subject reached a different outcome shows that access authority and the scope of the act should not be generalized independently of the file. [7] [16]
Use of a health document in an administrative complaint: 2014 Criminal General Assembly decision
Criminal General Assembly of the Court of Cassation, June 10, 2014, E. 2012/1514, K. 2014/312: In a case where a birth certificate was obtained without the consent of the person concerned and attached to an administrative complaint, it was emphasized that relying on the right to apply does not automatically legitimize unlawful access. Because the decision contains outdated penalty amounts, it should be taken into account for the discussion of lawfulness, not for the current basic penalty range. [14]
HTS records in the divorce process: 2021 decision
12th Criminal Chamber of the Court of Cassation, December 6, 2021, E. 2021/4655, K. 2021/8550: The legal characterization of the offense was found correct with respect to the act of unlawfully obtaining the spouse’s call records, but the judgment was reversed because the lower basic penalty limit in force on the date of the offense had not been taken into account. A family tie does not by itself create the authority to obtain a third person’s communication records. [13]
Related articles: Respect for Private Life and Protection of Personal Data: Violations and Application Routes; Current Remedies for Internet Content Removal and Access Blocking; Digital Evidence in Criminal Proceedings: WhatsApp Messages, Screenshots and Their Use as a Basis for a Judgment; Deferment of the Pronouncement of Judgment: Conditions of Application, Legal Remedies and Legal Consequences.
Conclusion
Under TCK Article 136, the decisive question is not only “was personal data shared?”; it is who obtained the data or made it available to another, with what authority, how and for what purpose. Although the protection of personal data is a fundamental right, not every KVKK violation directly amounts to a criminal conviction. Conversely, the prior presence of data on the internet does not render its subsequent publication lawful in all circumstances either.
For the victim, the lawful preservation of evidence, the correct legal characterization of the offense and the separation of the criminal, KVKK and compensation routes, and for the suspect or defendant, access authority, intent, lawfulness and the suitability of the technical evidence to serve as the basis for a judgment, are the core issues of the case. The 2026 case law of the Court of Cassation and the leaked data provision in Law No. 7545 must also be taken into account in the current assessment.
Frequently Asked Questions
How many years is the penalty for the TCK 136 offense?
Under TCK Article 136(1), the basic penalty is imprisonment from two to four years. If the conditions of TCK Article 136(2) or Article 137 are met, the relevant increase is applied separately. The existence of other offenses and the individualization of the penalty are assessed according to the specific file.
Is giving a person’s telephone number to someone else an offense?
A telephone number may be personal data. Whether giving it to another person constitutes the offense under TCK Article 136 depends on the specific circumstances, above all the unlawfulness of the act of giving and the perpetrator’s intent. Not every legitimate business communication is considered an offense.
Is sharing a public Instagram photo an offense?
It is neither automatically an offense nor automatically permitted. The context in which the photograph was republished, consent and grounds of justification, its use together with identity information, and intent are decisive. The 2025–2026 decisions include examples of both conviction and acquittal. [8] [9] [10]
Is the offense of obtaining personal data subject to a complaint requirement?
No. TCK Article 139 has excluded Article 136 from the offenses subject to a complaint requirement. Withdrawal of the complaint does not by itself end the criminal file.
Does victim–offender mediation or mediation end the criminal case?
TCK Article 136 is not within the scope of general victim–offender mediation. A settlement or compensation agreement under private law does not by itself eliminate the statutory conditions of the criminal proceedings.
Is submitting a WhatsApp screenshot to the court an offense?
It is not considered an offense in every case. How the image was obtained, whose messages it contains, its relevance to the dispute, whether it is necessary and proportionate, and the right to submit evidence are examined. Submitting it to the case file and publishing it on social media are not the same act.
Is a public official’s query of data out of curiosity always a TCK 136 offense?
No. In the decision K. 2023/367 of the Criminal General Assembly of the Court of Cassation, it was accepted that the offense had not been committed in a specific case involving only querying and viewing in an authorized system. This does not eliminate disciplinary or data protection liability for access outside one’s duties; cases involving copying and transfer are different. [7]
Is material damage required for the dissemination of personal data?
TCK Article 136 is based on the unlawful completion of the alternative acts; the occurrence of specific material damage is not an additional mandatory element. However, in claims for compensation or allegations of other offenses, damage, causation and other conditions are examined separately.
Should one go directly to the KVKK in the event of a personal data breach?
Under the KVKK, the data subject’s request is in most cases first directed to the data controller; a complaint to the Board has its own specific periods of 30/60 days. A criminal report to the prosecutor’s office for TCK Article 136 is different from this application route. [3] [4]
Is reselling leaked customer data only a TCK 136 offense?
No. Article 16(4) of Cybersecurity Law No. 7545 makes making accessible, sharing or offering for sale without permission certain data previously leaked in cyberspace subject to a separate criminal provision. Its relationship with TCK Article 136 and other offenses is determined according to the specific act. [5]
Is the statute of limitations eight years in every case?
No. For the basic form of TCK Article 136(1), the ordinary statute of limitations for prosecution is, as a rule, eight years; aggravated forms, grounds for interruption or suspension, and the temporal application of the law may change the result.
Sources and legal bases
- Turkish Penal Code No. 5237 (5237 sayılı Türk Ceza Kanunu), in particular Art. 7, 24–26, 30, 35, 43, 50–51, 66–67, 132–140, 239, 243–245. Ministry of Justice UYAP Legislation (Adalet Bakanlığı UYAP Mevzuat).
- Code of Criminal Procedure No. 5271 (5271 sayılı Ceza Muhakemesi Kanunu), in particular Art. 134, 160–173, 223, 231, 236 and the provisions on legal remedies; amendment by Law No. 7589 dated July 16, 2026. Ministry of Justice UYAP Legislation.
- Law No. 6698 on the Protection of Personal Data (6698 sayılı Kişisel Verilerin Korunması Kanunu) Art. 3, 5–6, 11, 13–14, 17 and Board decision No. 2019/9 dated January 24, 2019. Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
- Personal Data Protection Authority, The Personal Data Protection Law in 100 Questions (100 Soruda Kişisel Verilerin Korunması Kanunu), sections on applications and complaints. Official guide.
- Cybersecurity Law No. 7545 (7545 sayılı Siber Güvenlik Kanunu), in particular Art. 16(4); leaked data and the scope of the special offense. Text of the law as adopted by the Grand National Assembly of Türkiye (TBMM).
- Criminal General Assembly of the Court of Cassation, June 17, 2014, E. 2012/1510, K. 2014/331, personal data and the elements of the offense. Text of the decision.
- Criminal General Assembly of the Court of Cassation, June 21, 2023, E. 2021/384, K. 2023/367, query in an authorized system, obtaining and the assessment of unlawfulness. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, April 21, 2026, E. 2023/4940, K. 2026/4133, re-sharing without consent of a previously published photograph. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, May 12, 2025, E. 2022/8087, K. 2025/4289, context of public data and awareness of unlawfulness. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, May 12, 2025, E. 2023/2695, K. 2025/4315, sharing of a public photograph. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, December 16, 2025, E. 2023/3806, K. 2025/8877, republication revealing identity openly. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, May 20, 2024, E. 2020/1110, K. 2024/2493, social media profile photo. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, December 6, 2021, E. 2021/4655, K. 2021/8550, obtaining HTS data without permission. Text of the decision.
- Criminal General Assembly of the Court of Cassation, June 10, 2014, E. 2012/1514, K. 2014/312, obtaining a health document without consent and the claim of seeking one’s rights. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, June 4, 2024, E. 2020/1332, K. 2024/2933, profile image and distinguishing the legal characterization of the offense. Text of the decision.
- 12th Criminal Chamber of the Court of Cassation, October 21, 2020, E. 2019/3586, K. 2020/5426, records query by a public official. Text of the decision.