Recent developments
On 15 February 2022, the Turkish Personal Data Protection
Authority ("DPA") published a public
announcement regarding technical and organizational measures to be
taken by data controllers, following the increase in data breaches
due to the publishing of data subjects' username and password
information on publicly available websites. In the announcement,
the DPA lists various technical and organizational measures and
recommends that data controllers take appropriate measures for
their operations. You may access the announcement
here (in Turkish).
What does the announcement say?
From the recent data breach notifications, the DPA have
identified that the credentials (usernames and passwords) data
subjects use to log in to the websites of data controllers
operating in the finance, e-commerce, social media and gaming
sectors are being published on different websites. Accordingly, the
data subjects' credentials are being used to unlawfully
