Personal Data Breaches in Türkiye: The 72-Hour Notification Duty and Measures to Take

Cyber attacks, ransomware, emails sent to the wrong recipient, lost devices or unauthorised employee access are data breach scenarios that any business, whatever its size, may face. The Turkish Personal Data Protection Law No. 6698 (KVKK) imposes a clear notification duty on data controllers in such cases.

Legal basis

Under Article 12 of the KVKK, data controllers must take all necessary technical and organisational measures to ensure an appropriate level of security in order to prevent unlawful processing of and unlawful access to personal data and to ensure its safekeeping. Where personal data is processed by another natural or legal person on the controller's behalf, the controller is jointly liable with that person for taking these measures.

Under paragraph 5 of the same article, if processed personal data is obtained by others through unlawful means, the data controller must notify the data subject and the Board as soon as possible.

"As soon as possible" = 72 hours

By its decision of 24 January 2019 (No. 2019/10), the Personal Data Protection Board interpreted "as soon as possible" as 72 hours. Accordingly:

• The data controller must notify the Board without delay and at the latest within 72 hours of becoming aware of the breach.
• Once the affected persons are identified, they must also be notified within the shortest reasonable time, directly if their contact details are available, or otherwise by appropriate means such as publication on the controller's website.
• If notification cannot be made within 72 hours for a justified reason, the reasons for the delay must be explained with the notification.
• The Board's "Personal Data Breach Notification Form" must be used; if all information cannot be provided at once, it should be provided in stages.
• Information on breaches, their effects and the measures taken must be recorded and kept available for the Board's review.
• If a breach occurs at a data processor, the processor must notify the controller without delay.
• Data controllers should prepare a data breach response plan and review it periodically.

An example from Board decisions

In the case underlying the Board's decision of 17 September 2020 (No. 2020/715), email and password data previously leaked online were tried on a website's login screen using a bot, and unauthorised access was gained to 832 user accounts. Although the controller notified the breach within 72 hours, the Board found that measures such as limiting failed login attempts from the same IP address had not been taken before the breach and imposed an administrative fine for failure to take data security measures. The decision shows that timely notification alone is not enough; pre-breach security measures are also scrutinised.

Sanctions

Administrative fines may be imposed under Article 18 of the KVKK on controllers that fail to meet data security obligations; the amounts are updated annually by the revaluation rate. Unlawfully obtaining or disseminating personal data may also constitute offences under Articles 135 and 136 of the Turkish Criminal Code. Compensation claims by affected persons are also reserved.

Key steps to prepare for a breach

• Keep an up-to-date data inventory showing which data is processed where and by whom.
• Limit access rights by role and keep access and activity logs.
• Implement technical measures such as multi-factor authentication, encryption, up-to-date software and regular backups.
• Include breach notification and security obligations in contracts with processors (cloud, software, accounting providers, etc.).
• Prepare a written data breach response plan, deciding in advance who decides, who notifies and how communication is handled.
• Regularly train employees on phishing attacks and secure data handling.

Conclusion

The first 72 hours after a data breach are critical. However, Board practice shows that not only notification but also the technical and organisational measures taken before the breach are assessed. Preparing before a breach occurs therefore reduces both the risk of sanctions and the harm.

This article is for general information purposes only and does not constitute legal advice.