Consequences Of Data Breach

The Data Protection Law envisages both administrative fines and criminal liability.

With regard to criminal penalties, the Data Protection Law refers to the relevant provisions of the Turkish Criminal Code that detail sanctions for the unlawful recording, or disclosing, or transferring of personal data.

In addition to criminal sanctions, the Data Protection Law also contains provisions detailing administrative fines that are to be applied in the event of a breach. There are four main breaches that have been defined under the Data Protection Law:

(i) The data controller does not satisfy his/her obligation to inform the data subject;

(ii) The data controller does not satisfy the data security requirements;