Data Breach: Evaluation Of The Recent Precedents Of The Turkish Data Protection Board

Over the last four months, the Turkish Data Protection Board ("Board") concluded many data breach investigations and has recently published several decisions on its own website. In light of these recent decisions, it is seen that the Board made its evaluations and imposed certain administrative fines mainly based on two topics: (i) whether the necessary technical and administrative measures have been taken to ensure data security, and (ii) whether the obligation to notify the Data Protection Authority ("DPA") and the data subjects affected by the data breach "as soon as possible" has been fulfilled. Below is a snapshot of the criteria taken into consideration by the Board in its assessments of data breach, in light of the decisions taken over the past four months.