TurkeyPersonal Data Protection Law (KVKK), breach notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers unlawful acquisition of personal data belonging to a person in Turkey must notify the affected data subject and the Board within the shortest time; Board Decision 2019/10 of reads that as notice to the Board without delay and at the latest within 72 hours of learning of the breach, and notice to each affected data subject within the shortest reasonable time after the data subject is identified.
These lines are LexLint's reading of the law's text. Also read by: Kişisel Verileri Koruma Kurulu (Personal Data Protection Board of Türkiye), Decision No. 2019/10 of , published by the Kişisel Verileri Koruma Kurumu (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.kvkk.gov.tr/Icerik/5362/Veri-Ihlali-Bildirimi
- Guidance body
- Kişisel Verileri Koruma Kurulu (Personal Data Protection Board of Türkiye), Decision No. 2019/10 of , published by the Kişisel Verileri Koruma Kurumu
- Open questions
- From what moment is a data controller treated as having learned of a breach (öğrendiği tarihten itibaren, "from the date it learned of it") for the 72-hour period that the Board applies to notice under Article 12(5)?
- Does Article 12(5), which turns on personal data being obtained by others by unlawful means (kanuni olmayan yollarla başkaları tarafından elde edilmesi, "obtained by others by unlawful means"), reach an incident in which data is lost, altered or made unavailable and no third party obtained it?
What it makes you log
Logging duty
Article 12(5) makes the controller tell the data subject and notify the Board, within the shortest time, when processed data is obtained by others by unlawful means, and lets the Board announce the breach. It is a duty to notify and names no record the controller must keep of breaches. The controller's audit duty (Article 12(3)) and the Board's power to demand information (Article 15(3)) are in paragraphs and articles this row does not cite.
- Kind
- None
- As of
What this law does
Art. 12(5) requires a controller to notify the affected data subject and the Board within the shortest time where personal data has been obtained unlawfully by others; the Board may make the breach public. The Act sets no numeric deadline. Board Decision 2019/10 of interprets that phrase as 72 hours, so the controller must notify the Board without delay and at the latest within 72 hours of learning of the breach.
The controller notifies each affected data subject within the shortest reasonable time after identifying them. A controller that cannot notify the Board within 72 hours for a justified reason explains the delay to the Board with its notice.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .