Turkish Ministry of Education’s 10-Point Directive for Personal Data Protection in Schools

On July 9, 2026, the Turkish Ministry of National Education (MEB) issued a comprehensive circular containing 10 fundamental articles to all provincial education directorates. This directive, formulated for full compliance with the Personal Data Protection Law (KVKK), sets new restrictions on the digital activities of schools and educational institutions [1]. According to this notification, the security of students, parents, and educational personnel is prioritized, and any breach of privacy will face legal action.

Ban on Publishing Sensitive Information Online One of the most important articles of this directive is the absolute prohibition of publishing class lists, student numbers, and national ID numbers (T.C. Kimlik) on official school websites and social media accounts [2]. The Ministry emphasized that information regarding exam grades, attendance status, disciplinary records, and medical data of students must not be uploaded to public platforms under any circumstances. This measure is taken to prevent the misuse of the digital identities of children and adolescents [3].

Cleanup of Old Content and Social Media Monitoring The new directive does not only cover future school activities; administrators are also required to review all content published in previous years. According to this article, any lists, photos, or videos containing personal data that were previously published on school sites or virtual groups must be immediately deleted or removed from public access [1][4]. This "digital cleanup" process is conducted to reduce the footprint of sensitive information on the internet.

New Rules for Sharing Photos and Videos From now on, sharing images and videos of students during educational and training activities will be subject to very strict regulations. Before any recording, the purpose of publication, the intended platform, the file retention period, and the individuals who will have access must be precisely specified [3]. Additionally, priority is given to methods that do not directly reveal the student's identity. The Ministry warned that publishing images without explicit written consent is considered a violation [2].

Cybersecurity and Legal Consequences In the final section of this directive, reference is made to the security of the Ministry's information systems. Sharing passwords, using unauthorized software, bots, or automated tools to extract data from educational systems is declared prohibited [1]. Furthermore, all teachers and administrators are required to complete "Personal Data Protection" training courses on the ÖBA platform [3]. The Ministry of National Education stated that if any negligence is observed in implementing these 10 articles, administrative and judicial processes will be initiated against the relevant officials [4].