Personal Data Protection Monthly Newsletter: September - October

I. TÜRKIYE

Data Breach Notifications

• As of October 12, 2023, five data breach notifications were published on the website of the Personal Data Protection Authority ("Authority"). It has been stated that the reason for the violations is the unlawful unauthorized access to the information systems within the body of data controllers by a third party or persons.

Other Important Developments

• In October 13, Authority has published Guide on Considerations in the Processing of Genetic Data ("Guide"). In addition to the practical explanations/directions regarding biometric data processing in the Guide, the Authority has assessed that it is not sufficient to make only a general explanation in terms of informing the data subjects whose genetic data is processed; the data subject should be clearly informed about the genetic data processing activity and its consequences, and that the processing of genetic data may provide access to the data of not only the data