Türkiye's Personal Data Protection Board sets a 72-hour breach deadline

A data controller in Türkiye that learns personal data it holds has been obtained unlawfully must tell the Personal Data Protection Board within 72 hours, under a board decision published by the Personal Data Protection Authority (KVKK).

The duty comes from Article 12 of Law No. 6698 on the Protection of Personal Data. Paragraph 1 requires a data controller to take all technical and administrative measures needed to prevent unlawful processing of and access to personal data and to keep it safe. Paragraph 5 says that if processed data is obtained by others by unlawful means, the controller shall notify the person concerned and the board "as soon as possible", and that the board may announce the breach on its website or by another method it sees fit.

The board turned "as soon as possible" into a deadline in decision 2019/10 of 24 January 2019. It reads the phrase as 72 hours: the controller must notify the board without delay and at the latest within 72 hours of learning of the breach. Once it has identified the people affected, it must tell them within the shortest reasonable time, directly if it can reach them and otherwise by a suitable method such as its own website.

The decision adds working rules. A controller that misses the 72 hours for a justified reason must explain the delay in its notice. Notices use the board's Personal Data Breach Notification Form, and where all the information is not available at once it may be provided in stages without delay. The controller must record each breach, its effects and the measures taken and keep the record ready for the board. A data processor that suffers a breach must tell the controller without delay. A controller based abroad must notify on the same terms when a breach affects people in Türkiye who use its products or services there. Every controller should prepare a breach response plan, saying who reports to whom and who is responsible for notices, and review it at intervals.

The board's power to announce breaches is visible on the authority’s breach notice page, which lists public announcements under the heading "Kamuoyu Duyurusu (Veri İhlali Bildirimi)", each naming the data controller. Recent entries name companies in e-commerce, port operation, health products and food, alongside municipalities, universities and foundations.

Failing to meet the data security obligations of Article 12 is a misdemeanour under Article 18 of the law, which sets a range of administrative fines. The board has been active on other fronts this month: it limited employer monitoring of work email in a principle decision. For a compliance team, the practical test of the 2019 decision is the clock: 72 hours from the date the controller learns of the breach, with the staged-information rule meant for details that are not yet known. Other Turkish regulators are tightening their own rules, as with the new sustainability reporting licence exam.