Personal Data Breach: The First 72 Hours

What Is a Personal Data Breach?

Under Article 12(5) of the Turkish Personal Data Protection Law No. 6698 (the “KVKK”), a personal data breach occurs when processed personal data is obtained by others through unlawful means. A breach does not always take the form of a large cyber attack: ransomware, a compromised e-mail account, a file sent to the wrong person, a lost laptop or an employee accessing data without authorisation can all lead to a breach.

The breach may have occurred at a data processor, such as your cloud provider or payroll company. Even then, the obligation to notify the Board and the data subjects rests with your company as the data controller. The processor must inform you as soon as it becomes aware of the breach; this obligation, and its time limit, should be written clearly into the contract.

Preparation: Before a Breach Happens

In its decision dated 24.01.2019 and numbered 2019/10, the Personal Data Protection Board asked data controllers to prepare a data breach response plan. The 72-hour period is often lost in the first hours debating who should call whom and who should decide; a plan saves that time.

• Breach team: Decide in advance who in legal, IT, information security, communications and management will be informed, who decides on notification, and which external advisers will be involved.
• Data inventory: A company that does not know which personal data sits in which system cannot establish the scope of a breach within 72 hours.
• Logs: Without access and activity logs, it is often impossible to determine when a breach began and which data was accessed.
• Processor contracts: Specify in your contracts how quickly, and with what information, suppliers must notify you of a breach.
• Insurance and drills: If you have cyber insurance, check the insurer’s notification conditions and deadlines in advance. Test the plan against a scenario at least once a year.

The First Hours: Detection and Containment

1. Record the time. The deadline for notifying the Board runs from the moment you become aware of the breach. Keep a written timeline of when the breach was first noticed and of every subsequent step.
2. Contain the breach. Change the passwords of compromised accounts, cut off unauthorised access and isolate affected systems from the network.
3. Preserve evidence. Before wiping or rebuilding systems, have your technical team or a forensic expert take logs and images. These records are needed both to establish the scope of the breach and to show the measures taken in any Board review.
4. Convene the breach team. Inform your lawyer and, if applicable, your insurer. Keep internal correspondence about the breach within a small team.

Assessment: What Happened and Who Is Affected?

The content of the notification depends on this assessment. The questions to answer are: When did the breach start and when was it detected? Which categories of data were affected? How many people were affected, and are they employees or customers? Are special categories of data, such as health data, involved? What are the possible consequences for the individuals: fraud, identity theft, reputational harm? If people located in the European Union are affected, notification obligations under the GDPR must also be assessed separately.

Notifying the Board

The KVKK requires the data controller to notify the Board “as soon as possible”. The Board interprets this as without delay and at the latest within 72 hours of becoming aware of the breach. Notification is made using the Personal Data Breach Notification Form on the Board’s website.

• If not all details of the breach are clear within 72 hours, notify on the basis of the information available and supplement it later.
• If notification is delayed, the reasons for the delay must also be explained to the Board.
• Unlike the GDPR, the KVKK provides no exemption from notification for low-risk breaches. If there is doubt about whether to notify, the decision should be taken on the basis of legal advice before the 72 hours expire.
• The Board may publish breach notifications on its website. Prepare communications with the public and the press with this possibility in mind.

Notifying Data Subjects

Once the affected individuals have been identified, they must be informed within the shortest reasonable time. If their contact details are known, notify them directly; otherwise use appropriate means such as the company’s website.

The notification should be written in clear and plain language and should cover when and how the breach occurred, which data was affected, the possible consequences for the individuals, the measures taken by the company, what individuals can do to protect themselves and whom they can contact. A text full of legal jargon or one that downplays responsibility increases the risk of complaints and litigation.

The Cybersecurity Law and Other Notifications

A personal data breach is also a cyber incident. The Cybersecurity Law No. 7545, which entered into force in 2025, requires the persons and organisations within its scope to report cyber incidents they detect to the Cybersecurity Directorate without delay, and makes failure to report subject to an administrative fine of TRY 1 million to TRY 10 million for 2025. See our Cybersecurity Compliance Programme for how we support companies with these obligations.

Certain sectors, such as banking and electronic communications, have additional sector-specific notification obligations. Your contracts with customers may also contain short notification commitments. List these obligations in the first hours.

After the Breach

• Identify the root cause of the breach and take technical and organisational measures to prevent it from happening again.
• Record the breach, its effects and the measures taken in a breach register; this record will be a reference in a Board review and in future breaches.
• Respond to the Board’s requests for information and documents on time and consistently. Breaches of data security obligations are subject to administrative fines that are increased every year; the measures taken before and after the breach are decisive in the Board’s assessment.
• Be prepared for applications from data subjects and do not miss the thirty-day response deadline.