KVKK's 2026 Principle Decision: Risks of Using Loyalty Cards with a Phone Number

⏱️ Reading time: 12 min · 📁 Category: KVKK & Digital Compliance

KVKK's 2026 Principle Decision: Risks of Using Loyalty Cards with a Phone Number

The KVKK Board’s decision, published in the Official Gazette on 28 February 2026,
Principle Decision No. 2026/266, marked a significant turning point for
loyalty card systems widely used in Turkey.

Under the decision, third-party use during shopping of a loyalty card holder’s telephone number
or card number,
may, without sufficient verification, constitute a KVKK violation
.

1️⃣ What Is the Subject of Decision? 🔑 Net result:
Simply stating a telephone or loyalty card number for a transaction
is not considered secure verification on its own.

Loyalty card programmes are widely used in retail to build customer loyalty,
manage campaigns and increase sales.

However, many stores consider it sufficient to give the cashier
only a telephone number.
This model is considered risky in terms of KVKK.

2️⃣ Scenarios Seen in Complaints to the Board

• Shopping with someone else's phone number
• Use of loyalty card points by third parties
• Receiving a discount without the relevant person's knowledge
• Billing on behalf of the loyalty card holder
• Writing customer transaction records to the wrong person

These situations cause inaccurate personal data processing and
data security breaches.

📌 Typical violation sequence:
Someone obtains a phone number → gives it at checkout → a transaction proceeds without verification →
Discounts or points are used -> KVKK violation occurs 3️⃣ Legal Assessment in terms of KVKK

The Board's decision specifically emphasized three fundamental articles of the KVKK.

KVKK m.4 - General Principles

Personal data must be accurate and current.
The processing of loyalty card transactions to the wrong person is against this principle.

KVKK m.5 - Data Processing Conditions

Purchases made without the data subject’s knowledge and agreement
cannot rely on the conditions for lawful data processing.

KVKK m.12 - Data Security

Data controllers must prevent unlawful processing of personal data
by taking the necessary technical and organisational measures.

📌 Critical detection:
Stating “the card is personal” in the loyalty card agreement
does not remove responsibility for the data controller. 4️⃣ Risks of Trading with Phone Number

Phone number alone is not a secure authentication method.
It can therefore be used by third parties.

• Phone numbers are easy to learn
• Numbers can be shared
• No authentication
• Consent cannot be verified
• Wrong customer records occur

📌 KVKK comment:
Knowing the number does not authorize processing on that person's behalf. 5️⃣ Methods of Validation to KVKK

Under the decision, data controllers must establish
strong verification mechanisms.

• SMS verification code
• Mobile application verification
• QR code readout
• Barcode verification
• Loyalty card password

The proposed method as of 2026:

• Phone number + SMS verification
• Mobile application verification
• Card password

6️⃣ Risk Based Verification Approach

The Board stated that verification mechanisms can be applied
according to transaction risk.

• Earning loyalty points → low risk
• Discount use -> medium risk
• Spending loyalty points → high risk
• Issuing an invoice → high risk

📌 Practical approach:
Not every transaction requires the same verification.
Strong verification must be made in risky transactions. 7️⃣ Compliance Requirements for Companies

Data controllers must review
their loyalty card systems.

• Analyse checkout procedures
• Verification mechanisms must be established
• Loyalty card software must be updated
• KVKK texts must be revised
• Staff training must be conducted

The initial six-month compliance period under Decision 2026/266 was extended to 28 February 2027 by the Board’s Decision 2026/1491 of 22 July 2026.

8️⃣ KVKK Board's Loyalty Card Approach (2026)

The Board considers loyalty card programmes
to be personal data processing systems.

Therefore, loyalty card systems are not just marketing tools,
but must also be treated as data security infrastructure.

9️⃣ KVKK Compliance Checklist

• ✔ Verification mechanism
• ✔ SMS verification system
• ✔ Loyalty card security analysis
• ✔ KVKK process update
• ✔ Staff training
• ✔ Data security measures

🧠 Expert Result

Loyalty card systems are among the high-risk
data processing activities under KVKK.

Older systems that rely on a telephone number to conduct transactions
have become incompatible with the 2026 KVKK approach.

Properly structured loyalty programs both reduce the risk of punishment
and increase customer trust.

Request a KVKK compliance analysis for loyalty cards