The Offence of Unlawfully Recording and Acquiring Personal Data (Articles 135–136 TPC): Penalties and Court of Cassation Decisions
Last updated: 17.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: Unlawfully recording personal data belonging to another person, such as a telephone number, address, Turkish national identity number or card details, is punishable under Article 135 TPC by 1–3 years' imprisonment. Giving such data to another person, disseminating it or acquiring it is punishable under Article 136 TPC by 2–4 years' imprisonment. If the offence is committed by a public official through abuse of his or her authority, the penalty is increased by one half. These offences are not offences prosecuted upon complaint and do not fall within the scope of victim–offender mediation (uzlaştırma). Recording or sharing an image of a person relating to his or her private life without consent, even in a place open to the public, falls as a rule under Article 134 TPC.
What Is Personal Data?
For the purposes of criminal law, the concept of personal data is very broad. The Personal Data Protection Law (KVKK, Law No. 6698) defines personal data as “any information relating to an identified or identifiable natural person” (Article 3(1)(d) KVKK). Article 17 of the same Law provides that Articles 135 to 140 TPC shall apply to offences relating to personal data. The Court of Cassation also interprets the concept broadly, relying on the legislative reasoning of the article:
The subject matter of the offence is personal data. The Laws in force as of the date of the offence contain no definition of what is to be understood by the personal data constituting the subject matter of the offence, and the legislative reasoning of Article 135 TPC states: “Any information relating to a natural person must be accepted as personal data. In the definition of the offence in question, no distinction has been drawn between personal data being recorded in a computer environment or on paper.”
— Criminal General Assembly of the Court of Cassation, E. 2018/611, K. 2022/784, 08.12.2022
The personal data most frequently encountered in practice are as follows: a mobile telephone number used together with a name and surname, Turkish national identity number, home or work address, credit card and bank details, vehicle licence plate, health records, photographs, e-mail address and social media account details. In respect of special categories of data such as health status, religion, political opinion, race and sexual life, Article 135(2) TPC increases the penalty.
Text of Articles 135–138 TPC
Turkish Penal Code (TPC, Law No. 5237) – Offences relating to personal data
Article 135 – Recording of personal data (1) Any person who unlawfully records personal data shall be sentenced to imprisonment for a term of one to three years.
(2) Where the personal data relates to persons' political, philosophical or religious opinions or racial origins, or unlawfully to their moral tendencies, sexual lives, health status or trade union affiliations, the penalty to be imposed under the first paragraph shall be increased by one half.
Article 136 – Unlawfully giving or acquiring data (1) Any person who unlawfully gives personal data to another person, disseminates it or acquires it shall be punished with imprisonment for a term of two to four years.
(2) (Added: 17.10.2019 – Law No. 7188, Art. 17) Where the subject matter of the offence consists of statements and images recorded pursuant to the fifth and sixth paragraphs of Article 236 of the Code of Criminal Procedure, the penalty to be imposed shall be doubled.
Article 137 – Aggravated circumstances (1) Where the offences defined in the above articles are committed: a) by a public official and through abuse of the authority conferred by his or her duty, b) by taking advantage of the facility afforded by a particular profession or trade, the penalty to be imposed shall be increased by one half.
Article 138 – Failure to destroy data (1) Persons who are under a duty to destroy data within the system and who fail to perform their duty, notwithstanding the expiry of the periods laid down by law, shall be sentenced to imprisonment for a term of one to two years.
(2) (Added: 21.02.2014 – Law No. 6526, Art. 5) Where the subject matter of the offence consists of data which must be removed or destroyed in accordance with the provisions of the Code of Criminal Procedure, the penalty to be imposed shall be doubled.
Article 139 – Complaint (1) With the exception of the recording of personal data, unlawfully giving or acquiring data and failure to destroy data, the investigation and prosecution of the offences set out in this Chapter shall be subject to complaint.
The offences under Articles 135 and 136 TPC may be committed by anyone. The increase under Article 137 TPC applies where a public official abuses his or her authority or where the facility afforded by a profession is exploited. The perpetrator under Article 138 TPC is the person under a duty to destroy the data once the period has expired; Article 17(2) KVKK also makes those who fail to erase or anonymise data subject to this article.
What Are the Penalties for Personal Data Offences?
| Offence | Penalty |
|---|---|
| Unlawful recording of personal data (Article 135(1) TPC) | 1 – 3 years' imprisonment |
| Recording of special categories of data (Article 135(2) TPC) | 1 year 6 months – 4 years 6 months' imprisonment |
| Giving data to another person, disseminating or acquiring it (Article 136(1) TPC) | 2 – 4 years' imprisonment |
| Statements and images recorded pursuant to Article 236(5)–(6) CCP (Article 136(2) TPC) | 4 – 8 years' imprisonment |
| Commission by a public official or by taking advantage of a profession (Article 137 TPC) | Penalty increased by one half (3 – 6 years under Article 136) |
| Failure to destroy data whose retention period has expired (Article 138(1) TPC) | 1 – 2 years' imprisonment |
| Failure to destroy data that must be destroyed under the CCP (Article 138(2) TPC) | 2 – 4 years' imprisonment |
The Three Alternative Acts in Article 136 TPC
Article 136 TPC is an offence with alternative acts. The commission of any one of the three acts is sufficient:
- Giving to another person: the transmission of the data to a natural or legal person by hand, by e-mail or by message. The fact that the data was obtained lawfully does not prevent its unlawful giving from constituting an offence.
- Disseminating: making the data available to a large number of people on social media, on a website, in WhatsApp or Telegram groups or through bulk messages.
- Acquiring: the passing of data under another person's control into the control of the perpetrator by unlawful means; entering another person's telephone or account without authorisation and taking the data may be assessed within this scope. By contrast, the mere viewing of data by a person with access authorisation does not, as a rule, amount to acquisition.
The Criminal General Assembly of the Court of Cassation did not regard as an offence the conduct of a civil servant who, out of curiosity, ran an identity query using the password issued by his institution:
"…when it is assessed together that the defendant merely read this information out of curiosity and did not share it with others, and furthermore did not pursue any unlawful aim (…), it must be accepted that the incident under examination is conduct incompatible with the requirements of duty, necessitating a disciplinary investigation, and that it does not constitute an offence."
Criminal General Assembly of the Court of Cassation, E. 2021/384, K. 2023/367, 21.06.2023 (majority opinion)
The view that the query constituted an offence remained confined to the dissenting opinion in that decision. The 12th Criminal Chamber of the Court of Cassation, in a final decision resolving the conflict, turned this line into a principle:
"…acquisition is effected by bringing personal data that is under the control of another person under one's own control by unlawful means. (…) It has been assessed that the act of the defendant, consisting merely of viewing data under his own control, cannot be accepted as acquisition (…) and is in the nature of an act that does not constitute an offence within the meaning of the TPC."
Court of Cassation, 12th Criminal Chamber, E. 2023/219, K. 2024/1951, 25.04.2024 (to the same effect regarding a POLNET query: E. 2025/6769, K. 2026/3078, 30.03.2026)
Important note: For public officials who access systems such as MERNİS, UYAP, POL-NET or e-Nabız, the distinction is critical. According to the current practice of the Court of Cassation, the mere querying and viewing of data out of curiosity by a public official who has access authorisation is, as a rule, not regarded as “acquisition” but gives rise to disciplinary liability. Where the data is recorded, copied, given to another person or disseminated, however, Articles 135/136 TPC and the increase under Article 137(1)(a) TPC come into play.
Article 136 or Article 134 TPC? The Distinction in Sharing Photographs and Images
In complaints of the “they shared my photo without permission” kind, identifying the correct offence directly affects the outcome. According to the settled practice of the Court of Cassation, images and sounds relating to a person's private life are the subject matter not of the personal data offences but of the offence of violation of the privacy of private life (Article 134 TPC). Being in a place open to the public does not mean that a person consents to being photographed secretly or without his or her consent; the Court of Cassation frequently assesses such images under Article 134 TPC as well. By contrast, the dissemination, together with a telephone number and name, of a photograph that the person shared himself or herself or had taken with his or her consent and that has no private-life character constitutes the offence under Article 136 TPC.
Under Article 134(1) TPC, the penalty for violation of the privacy of private life is 1–3 years and is doubled if the offence is committed by recording images or sounds; for disclosure (Article 134(2)) the penalty is 2–5 years. This offence is prosecuted upon complaint, falls as a rule within the scope of victim–offender mediation, and withdrawal of the complaint discontinues the case.
Update note (17.10.2026): The rows "photograph taken in a public place" and "a public official looking at and reading the system" in the image above should be read together with the current case law of the Court of Cassation set out in this article: the dissemination of a photograph taken without consent falls as a rule under Article 134 TPC, while mere reading out of curiosity is treated as a disciplinary matter. The current distinction is shown in the table below.
Furthermore, although there is no doubt that an image or sound relating to private life constitutes “personal data”, since the fixing of an image or sound relating to a person's private life, without his or her knowledge, onto a particular electronic, digital or magnetic medium by means of a device capable of taking pictures or recording is regulated in the second sentence of Article 134(1) TPC, and its disclosure without his or her consent, that is to say, its dissemination, revelation, exposure, announcement, communication to the public or the rendering of it public, in short, its being brought to the knowledge of a person or persons not authorised to learn its content, is regulated in Article 134(2) TPC within the scope of the offence of violation of the privacy of private life, an image or sound relating to a person's private life cannot, in the legal sense, be regarded as personal data within the scope of Article 135(1) TPC and Article 136(1) of the same Law.
— Court of Cassation, 12th Criminal Chamber, E. 2019/973, K. 2020/218, 08.01.2020
The Chamber also regarded a photograph taken without consent at the exit of a hospital and shared on Instagram as falling under Article 134(2) TPC, and held that the case should be discontinued because the complaint had been withdrawn:
"…that even when one is in an area open to the public, the principle of not attracting attention, of not being recognised and of remaining unknown within the crowd applies…"
Court of Cassation, 12th Criminal Chamber, E. 2023/2826, K. 2024/7417, 11.12.2024
By contrast, the publication on Facebook, together with her telephone number, of an everyday photograph for which the victim had posed was held to constitute the offence under Article 136(1) TPC (Court of Cassation, 12th Criminal Chamber, E. 2020/7428, K. 2021/3090, 24.03.2021).
For related conduct such as opening a fake social media account in another person's name and account takeover, you may also refer to our pages Takeover of a Social Media Account and The Offence of Unauthorised Access to an Information System (Article 243 TPC).
Complaint, Mediation, Statute of Limitations and Competent Court
| Issue | Position |
|---|---|
| Complaint | Under Article 139 TPC, the offences in Articles 135, 136 and 138 are not offences prosecuted upon complaint; the prosecutor's office investigates ex officio. Withdrawal of the complaint does not discontinue the prosecution. |
| Victim–offender mediation | Since they are not listed in Article 253 CCP, these offences do not fall within the scope of victim–offender mediation (uzlaştırma). |
| Statute of limitations for prosecution | 8 years in the basic forms (Article 66(1)(e) TPC). 15 years in aggravated forms where the upper limit of the penalty exceeds 5 years (e.g. Article 136 together with Article 137 TPC) (Article 66(1)(d) TPC). |
| Competent court | Criminal court of first instance. Cases on the Anatolian side of Istanbul are heard at the Anatolian Courthouse (Anadolu Adliyesi) in Kartal. |
| Legal persons | If the offence has been committed for the benefit of a company, security measures specific to legal persons are ordered (Article 140 TPC). |
| HAGB / suspension | If Article 136 TPC is applied from the lower limit and the reduction under Article 62 TPC is made, the penalty falls to 1 year 8 months; where the conditions are met, deferral of the announcement of the verdict (HAGB) or suspension of the sentence may be considered. Redress of the damage may also be made in instalments during the probation period (Article 231(9) CCP). |
What Is the Difference Between a Personal Data Offence and a KVKK Violation?
Articles 135–138 TPC govern criminal liability, while the KVKK governs administrative liability; the two may be applied together in the same incident. For breaches of the obligations relating to the duty to inform, data security, decisions of the Board and registration with the registry, the Personal Data Protection Board imposes an administrative fine on the data controller (Article 18 KVKK); in public institutions, disciplinary provisions apply (Article 18(4)). This sanction does not replace the criminal investigation.
What Should You Do If Your Personal Data Has Been Shared or You Are Accused?
If you are the victim, record a screenshot of the post together with the date, time, account name and link address. Report it to the platform; if the post relates to your private life, request access blocking from the Cybersecurity Directorate (Siber Güvenlik Başkanlığı) under Article 9/A of Law No. 5651 on the Regulation of Internet Publications; in other cases, apply to the civil court for an interim injunction and removal. Then file a criminal complaint with the Chief Public Prosecutor's Office. If the data was leaked from a company or institution, also consider applying to the data controller and to the Personal Data Protection Board.
If you are the suspect, it must first be examined whether the shared information really constitutes “personal data”, whether there is a ground of justification such as consent or statutory authority, and whether it has been technically proven that the account from which the post was made belongs to you. For defence points concerning account and IP identification, you may refer to our article Are IP Address and CGNAT Records Evidence?
Steps for the victim
- Secure the evidence: a screenshot showing the URL, date and time, and account name.
- Request access blocking: in a violation of private life, apply to the Cybersecurity Directorate under Article 9/A of Law No. 5651; submit the request to the criminal judgeship of peace for decision within 24 hours.
- File a criminal complaint: the offences in Articles 135, 136 and 138 are not prosecuted upon complaint; for Article 134 TPC there is a six-month complaint period (Article 73(1) TPC).
- Make a KVKK application: first to the data controller (30 days), then to the Board within 30/60 days.
The suspect should attend the statement with defence counsel (Article 147 CCP), have the legal characterisation of the offence and the account–device link scrutinised, and plan the redress of damage (Article 231(6)(c) CCP) with a view to HAGB.
Documents to prepare
- ✓Date- and time-stamped screenshots and the URL
- ✓Link to the sharing account, witnesses
- ✓Copies of the platform report, the access blocking application and the application to the data controller
- ✓For the suspect: a document showing the job description and system access authorisation
What Are the Common Mistakes and Exceptions?
- Treating every unauthorised photo as Article 136 TPC: a private-life image falls under Article 134 TPC; if the complaint period is missed or the complaint is withdrawn, the case cannot proceed. Under Articles 135, 136 and 138, withdrawal does not discontinue the case.
- Extending authorised viewing to every kind of access: an authorised user who copies or shares the data, and a person who goes through another person's telephone without permission, cannot benefit from this case law; depending on the facts, Article 134, 135, 136 or 243 TPC comes into play.
- Using the old access blocking route: Article 9 of Law No. 5651 has ceased to exist since 10.10.2024 following its annulment by the Constitutional Court; Article 9/A is used for private life, and the civil court route for other violations.
TPC 135–136 Cases with an Istanbul Personal Data Protection Lawyer
In these cases, the outcome is often determined by the nature of the information, the perpetrator's access authorisation and the technical link between the post and an account or device belonging to the suspect. Av. Coşkun Genç Law Office provides legal support in Istanbul in personal data investigations, in criminal complaints, access blocking and KVKK applications, and at the statement and prosecution stages, as the attorney for the victim or as defence counsel for the suspect. In work carried out as an Istanbul personal data protection lawyer, the legal characterisation of the offence, the time limits and the administrative and criminal routes are planned together.
Those wishing to obtain support from an Istanbul KVKK lawyer may request a preliminary assessment through our contact page, providing the link to the post, screenshots and, if any, the summons to give a statement. You may also refer to our cybercrimes page and our article The Right to Be Forgotten and Its Penalty.
Sources
- Turkish Penal Code (TPC, Law No. 5237), Articles 134–140 – mevzuat.gov.tr · on this website
- Personal Data Protection Law (KVKK, Law No. 6698), Articles 3, 13, 14, 17, 18 – mevzuat.gov.tr
- Law No. 5651 on the Regulation of Internet Publications, Article 2(1)(v) and Article 9/A (Article 9: annulled by the Constitutional Court, E. 2020/76, K. 2023/172) – mevzuat.gov.tr
- Code of Criminal Procedure (CCP, Law No. 5271), Articles 147, 231, 253 – mevzuat.gov.tr
- Kişisel Verileri Koruma Kurumu [Personal Data Protection Authority] – kvkk.gov.tr
- Criminal General Assembly of the Court of Cassation, E. 2021/384, K. 2023/367, 21.06.2023
- Criminal General Assembly of the Court of Cassation, E. 2018/611, K. 2022/784, 08.12.2022
- Court of Cassation, 12th Criminal Chamber, E. 2023/219, K. 2024/1951, 25.04.2024
- Court of Cassation, 12th Criminal Chamber, E. 2025/6769, K. 2026/3078, 30.03.2026
- Court of Cassation, 12th Criminal Chamber, E. 2019/973, K. 2020/218, 08.01.2020
- Court of Cassation, 12th Criminal Chamber, E. 2023/2826, K. 2024/7417, 11.12.2024
- Court of Cassation, 12th Criminal Chamber, E. 2020/7428, K. 2021/3090, 24.03.2021
- Court of Cassation, 12th Criminal Chamber, E. 2018/8258, K. 2019/6513, 22.05.2019
Important: This article is for general information purposes only and does not constitute legal advice. Please seek the assistance of a lawyer for your specific case.