Data Protection Board ("DPB") has recently announced its decision no. 2019/10 and dated
24/01/2019 on the management of data security breaches and
notifications to the DPB and data subjects. The DPB also announced its decision no. 2019/9 and dated
24/01/2019 on the calculation of the time periods for applications
to data controllers and complaints to the DPB in order to
"harmonize the difference in the interpretation of the
periods."
While indicating that it wishes to ensure a standardization on
the issue, the DPB first reminded the provisions of Turkish
Personal Data Protection Law ("PDPL") on data security
and then set out the principles and procedures regarding the
management of data security breaches and their notification to the
DPB and data subjects.
