- within International Law topic(s)
The Law requires data controllers to notify the Board and the relevant data subject as soon as possible upon becoming aware of a data breach. In its Decision No. 2019/19 dated 24 January 2019 (“the Decision”), the Board has clarified the rules to be applied and the procedures to be followed in the event of a data breach.
The Board adopts the GDPR approach regarding the timing of breach notifications and has clarified that the phrase ‘as soon as possible’ in the Law should be interpreted as within 72 hours of the data breach being detected.
The Law also requires data controllers to notify data subjects affected by a data breach as soon as possible, regardless of whether the risk involved is low or not, once they have identified the affected data subjects. In the aforementioned Decision, the Board did not specify a fixed timeframe for the notification to be made following the identification of the affected data subjects but stated that notification must be made within the shortest reasonable time. Whilst a ‘reasonable timeframe’ is a matter to be assessed on a case-by-case basis, it would be appropriate to notify the relevant individuals promptly following the notification of the data breach to the Board.
The Board’s decision requires data controllers to draw up a roadmap in advance to ensure they are prepared for data breaches, and to clarify in advance the procedures to be followed through internal reporting mechanisms. Data controllers are obliged to keep records of the measures taken in response to data breaches.
The obligation to report data breaches also applies to data controllers residing abroad. Where data controllers based abroad experience a data breach and that breach affects data subjects residing in Türkiye or goods/services used by data subjects in Türkiye, such data controllers are likewise obliged to follow the data breach notification procedures announced by the Board. A critical point for data controllers based abroad is that, even if the data breach occurs abroad, a notification must be made to the Board if the data subjects affected by the breach are located in Türkiye. It is evident that the scope of application of the Law has been broadened in this respect with regard to data breach notifications.
The Board has made available a ‘Personal Data Breach Notification Form’ which data controllers must complete when making a notification.
A significant change has been introduced to the practice regarding the publication of data breach notifications on the Authority’s website by the end of 2025. Whereas prior to this change, data breach notifications were published without any time limit, the Board’s Decision No. 2025/2451 dated 25 December 2025 stipulates that data breach notifications shall be published for a specific period, that this period is limited to 60 days, and that the notice shall be removed from the Authority’s website if the data controller can demonstrate that the relevant individuals were notified within a shorter period than .
The discontinuation of the indefinite publication requirement offers an approach more in line with the fundamental principles of the Law by reducing the disproportionate reputational impact on data controllers. It is of great importance for data controllers to manage their post-breach processes swiftly and effectively, both for the protection of data subjects and to shorten the duration of public disclosure. Whilst the majority of data breach notifications previously published on the Authority’s website were submitted by private companies, notifications have also been submitted by organisations such as hospitals and universities. Furthermore, the categories of individuals affected by breaches primarily consist of the relevant data controllers’ employees, patients, subscribers, customers, students, clinical trial participants and business partners. In terms of the categories of data affected, the data breach notifications primarily concern identity, education, health, membership of associations, transaction and physical premises security, criminal convictions and security measures, race and ethnic origin, accounting and financial information, as well as genetic and biometric data. These data breach notifications have been submitted both within and outside the country.
To date, the data breach notifications published on the Authority’s website have been submitted by data controllers across a wide range of sectors and types of organisations.
In terms of data breaches, 328 notifications were submitted to the Authority in 2025; of these, 105 were concluded, 51 were published by the Authority, and investigations into 223 were still ongoing as at the end of the year. These figures demonstrate that, from the perspective of data controllers, data breach response plans, internal reporting mechanisms and the processes for notifying the Authority remain of paramount importance.
In terms of the consequences that a data breach may entail, these are processes that must be handled with the utmost care, given the risk of administrative fines being imposed on the data controller and the potential for criminal liability under the Turkish Criminal Code (TCC). As is well known, the Law contains provisions relating to both the imposition of administrative fines and criminal liability. With regard to criminal liability, the Law refers to the relevant provisions of the TCC setting out penalties for the unlawful recording, disclosure or acquisition of personal data.
In addition to criminal sanctions, the Law also contains annexes setting out the details of the administrative fines to be imposed in the event of a breach. Failure to fulfil data security obligations under the Law, data breaches and failure to report a breach to the Authority in a timely manner may result in administrative fines of between 85,437 and 17,092,242 TRY (updated for 2026) for data controllers.
In the cases examined and published by the Board following data breach notifications, the general trend appears to be predominantly towards imposing penalties, in contrast to data protection authorities in Europe, which adopt a more constructive approach to breach notifications. However, the Board considers factors such as the number of individuals affected by the data breach, whether the breach had a negative impact on the data subject, whether the data controller could intervene, whether the data subject to the breach had been deleted, whether the data controller had notified the breach within the prescribed timeframe, and whether reasonable administrative and technical measures had been taken.
The correct and timely handling of data breach processes is of critical importance for data controllers; in addition to the principles and procedures established and implemented by data controllers regarding the processing, erasure, destruction and disposal of personal data, the procedures to be followed in the event of a data breach must also be clearly defined. The creation of a data breach response plan by data controllers as part of their compliance processes, to enable a swift and effective response in the event of a potential data breach, will make a positive contribution to mitigating the risks arising from such a breach.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
