A&K Journal
A New Threshold in Data Law: From Privacy to Data Governance
Digital data law no longer asks only whether personal data have been processed lawfully. The questions of the new era are broader: where did the data come from, which systems did they feed, with whom were they shared, how were they used by artificial intelligence, and which decisions about the individual did they influence?
The EU Data Act, applicable from 12 September 2025, opened a new period for access to and sharing of data generated by connected devices. Data thus ceased to be merely something to be protected and became an economic asset to be governed lawfully among users, manufacturers and service providers. The second pillar of this shift is the AI Act, a significant part of whose general provisions applies from 2 August 2026 — showing that undertakings will be accountable not only for the data they use but also for the outcomes of the algorithms running on that data.
The web scraping guidance published by the European Data Protection Board in July 2026 also questioned the assumption that anything accessible online may be freely used. In data collection for AI training, legal basis, transparency, purpose limitation, data minimisation and the protection of special categories of data remain decisive: publicly available data are not legally ownerless.
In Türkiye, the Personal Data Protection Authority's study of 5 March 2026 on generative AI use in the workplace highlights the corporate data security risks of uncontrolled use, making AI usage policies, defined prohibitions on what may be entered into such systems, and oversight of the applications used increasingly necessary.
Compliance in digital data law is therefore no longer a matter of a few privacy notices and consent boxes. The real task is to build a data governance system that can trace the entire lifecycle of data, explain algorithmic decisions, and strike a genuine balance between technological innovation and fundamental rights.
Full text. This page presents an English abstract. The complete article is published in Turkish: Read the full Turkish article →