The Turkish Personal Data Protection Authority
("The Authority") issued an important
decision regarding procedure and principles to be followed
regarding 'data breach notifications' on its website on 15
February 2019.
The Law on Protection of Personal Data numbered 6698
("DP Law") provides that in case of a
data breach, the Authority and the affected data subjects shall be
notified of the relevant breach as soon as possible. Considering
that the term "as soon as possible" is vague and created
confusion among data controllers with regards to the timing of the
notification, the Authority decided to make the notification period
clearer and more limited.
According to the decision, the Authority decided; with a
reference to the notification term included under the General Data
Protection Regulation ("GDPR"), that in
case of a data breach, the data controllers shall notify the
Authority within 72 hours of becoming aware of the
breach. The data controllers will also
