Information Security and Data Breach Management

Data security is the most fundamental obligation the KVKK places on data controllers, and when a breach occurs, the first question asked of the company is whether it took the necessary measures. We prepare your information security policies, determine the technical and administrative measures to be taken and coordinate penetration tests and vulnerability assessments. When a data breach occurs, we manage the process with you from the first hours to notification to the Board.

What is a personal data breach?

A personal data breach occurs when processed personal data is obtained by others by unlawful means. A cyber attack, ransomware, an e-mail sent to the wrong person, a lost laptop or an unauthorised employee accessing data can all lead to a breach.

Under Article 12 of the KVKK, the data controller must notify the data subject and the Board of the breach as soon as possible. The Board has interpreted this period as 72 hours from the moment the breach is discovered. Notification is made using the Board’s Data Breach Notification Form; if there is a delay, the reasons must also be given.

What are technical and administrative measures?

Technical measures relate to information systems: authorisation and access management, encryption, logging, back-ups, and network and application security. Administrative measures are organisational: policies, procedures, employee training, confidentiality undertakings and agreements with data processors. The Board’s Personal Data Security Guide sets out these measures in detail.

Scope

Preparing information security policies, determining technical and administrative measures, and coordinating penetration tests and vulnerability assessments
Preparing action plans for personal data security breaches and running data breach notification processes
Representing the company in Board investigations following a breach

How We Work

Assessing existing technical and administrative measures against the Board’s guide
Prioritising missing measures and preparing an action plan with the IT team
Drafting the information security policy, the access authorisation matrix and the breach response procedure
Setting out the steps, responsibilities and chain of communication to follow in a breach; running a drill
When a breach occurs, carrying out the impact analysis, notifying the Board and data subjects, and handling the correspondence that follows

Team

Ali Gül Founding Partner

Buse Yüceer Associate

Burcu Kulotu Associate

Frequently Asked Questions

Do we have to notify the Board of every data breach?

Unlike the GDPR in Europe, the KVKK does not provide a notification exemption for low-risk breaches. If personal data has been obtained by others by unlawful means, notification is required. If there is doubt about whether to notify, legal advice should be obtained before the 72-hour period expires.

When does the 72-hour period start?

The period starts when the data controller becomes aware of the breach. If not all details are yet known, the notification is made with the information available and completed later.

How should we notify data subjects of the breach?

Data subjects are notified within the shortest reasonable time after the affected persons have been identified. If their contact address is known, they are notified directly; if not, through appropriate means such as the data controller's website. The notification should explain in clear, plain language when and how the breach occurred, the data affected, the possible consequences and the measures taken.

Do you carry out the penetration test yourselves?

No. Penetration tests and vulnerability assessments are performed by specialised technical firms. We coordinate setting the scope of the test in line with legal obligations, the agreement with the testing firm and the assessment of the findings from a KVKK perspective.

Would you like to discuss this service? Schedule a meeting with us — the first meeting is free of charge.

Schedule a meeting