Main Obligations Of The Data Controllers Under The Law On The Protection Of Personal Data

Obligation

Explanation

Documentation

Is Documentation

Required or

Recommended?

Risk¹

1

Obligation to Ensure

Personal                    Data

Security

Data controllers should take all necessary technical and administrative measures to ensure the data security. There are specific measures announced by the Turkish Data Protection Authority ("DPA") with regards to the special categories of personal data.²

Any incident resulting in the acquisition of processed personal data by third parties through unlawful means is considered as a data breach. Data controllers should notify the DPA within 72 hours after becoming aware of a breach and notify the data subjects whose data have been affected within a reasonable time.³