New Rules On The Publication Periods Of Data Breach Notifications

Introduction

Pursuant to Article 12 of the Personal Data Protection Law No. 6698 ("PDPL"), in cases where personal data are unlawfully obtained by third parties, data controllers are required to notify both the data subjects concerned and the Personal Data Protection Board ("Board") as soon as possible. This notification obligation aims to prevent or minimize, at the earliest possible stage, the negative consequences that personal data breaches may cause for data subjects.

Data Breach Notification Obligation and Changes Regarding Publication Periods

The scope of the notification obligation set out in the fifth paragraph of Article 12 of the PDPL was clarified by the Board's decision dated 24.01.2019 and numbered 2019/10 on the procedures and principles of personal data breach notifications. With decision No. 2019/10, the phrase "as soon as possible" in the PDPL was interpreted as the obligation of the data controller to notify the Board without delay and at