The compliance period prescribed for data controllers in relation to loyalty card practices has been extended until 28 February 2027 pursuant to the Decision of the Personal Data Protection Board (the “Board”) dated 22 July 2026 and numbered 2026/1491 (the “Decision”), published in the Official Gazette dated 13 August 2026 and numbered 33339.
The Decision concerns the 6-month compliance period granted to data controllers under the Board’s Principle Decision dated 11 February 2026 and numbered 2026/266 on the “Use of the Mobile Phone Number or Loyalty Card Number of a Loyalty Card Member by a Third Party During a Purchase” (the “Principle Decision”).
The Principle Decision required data controllers to establish appropriate mechanisms to verify that, where the mobile phone number or loyalty card number of a loyalty card member is used by a third party during a purchase, the transaction is carried out with the knowledge and approval of the relevant data subject.
The Compliance Period Has Been Extended Until 28 February 2027
The 6-month compliance period, which commenced upon the publication of the Principle Decision in the Official Gazette dated 28 February 2026, was initially scheduled to expire on 28 August 2026.
Taking into account requests received from the sector, the Board determined that an extension of the compliance period was necessary and extended the period granted to data controllers to comply with the Principle Decision until 28 February 2027.
Accordingly, the Decision does not alter the scope of the obligations introduced by the Principle Decision; it merely extends the period granted for compliance with such obligations by a further 6 months.
The Obligation to Establish Verification Mechanisms Remains in Effect
Under the Principle Decision, merely providing the cashier with the relevant data subject’s mobile phone number or loyalty card number is not considered sufficient for purchases made using a loyalty card.
Data controllers are required to establish appropriate technical and administrative mechanisms to verify that the use of a loyalty card during a purchase takes place with the knowledge and approval of the relevant data subject.
In this context, verification methods such as a one-time verification code sent via SMS, the use of a barcode/QR code through a mobile application or website, or other verification methods appropriate to the type of transaction and the level of risk may be considered.
The Board also acknowledges that alternative verification methods may be offered by taking into account the characteristics of different user groups, including age, level of education, economic circumstances and technological literacy.
Key Considerations for Companies
The Decision is particularly relevant for retail companies and other data controllers operating loyalty card, membership, points, discount or promotional schemes.
In this context, companies should:
● analyse their existing loyalty card processes and the possibility of loyalty cards being used by third parties;
● review processes that allow transactions to be carried out merely by providing a mobile phone number or loyalty card number;
● determine appropriate mechanisms for verifying the relevant data subject’s knowledge and approval;
● assess their point-of-sale systems, mobile applications, websites and loyalty programme infrastructure in terms of the technical changes required;
● update operational procedures and employee training; and
● complete the necessary compliance measures by 28 February 2027 at the latest.
The extension of the compliance period does not mean that the obligations established under the Principle Decision have been postponed or abolished. Accordingly, the additional period should be used to bring the relevant technical infrastructure and operational processes into compliance with the Principle Decision.
Assessment and Conclusion
The Board’s new Decision does not introduce any substantive changes to the existing obligations aimed at ensuring the security of personal data in loyalty card practices; rather, it grants data controllers additional time to comply with such obligations.
Particularly in loyalty programmes with high transaction volumes, the integration of verification mechanisms into existing point-of-sale and digital infrastructure may require technical and operational preparations. It is therefore important that the period until 28 February 2027 be treated as an active compliance period.
Accordingly, data controllers operating loyalty card practices should promptly review their existing processes, determine the verification methods to be implemented, and complete the necessary technical, administrative and operational compliance measures before the new deadline.