Personal Data Breach Notification in Turkey: The 72-Hour Rule, Security Duties and Sanctions

When a company's customer database is leaked, accounts on a crypto exchange are taken over, or an employee emails ID copies to the wrong person, the legal question is not only "what happened" but how fast and to whom it must be reported. The Personal Data Protection Law no. 6698 (KVKK) imposes on the data controller both a duty to take preventive measures and a duty to notify after a breach.

This guide covers the data-security obligations, to whom, when and with what content a breach is reported, the administrative, criminal and civil liability that can follow, and the data subject's routes of complaint. It also offers a practical checklist for crypto-asset service providers, e-commerce companies and SMEs.

1. What Is a Personal Data Breach?

A personal data breach is the unlawful acquisition, disclosure, alteration, loss or unavailability of personal data being processed. Examples:

• A ransomware attack or database leak,
• Takeover of crypto-exchange accounts and of identity-verification (KYC) documents,
• An employee sending or copying a customer list to a competitor,
• Documents containing ID, health or financial data emailed to the wrong recipient,
• Unauthorised persons gaining access to a file server or cloud storage.

The nature of the data (identity, contact, financial, special-category) and the number of people affected determine the seriousness of the breach and the steps to be taken.

2. Data Security Obligations (KVKK Art. 12)

Under Art. 12/1, the data controller must take all necessary technical and administrative measures to provide an appropriate level of security in order to prevent unlawful processing of and unlawful access to personal data and to ensure its safekeeping. Related provisions:

• Joint liability with the processor (Art. 12/2): where personal data is processed on the controller's behalf by another person (for example a cloud service, payment infrastructure or marketing agency), the controller is jointly responsible with them for taking the measures.
• Duty to audit (Art. 12/3): the controller must carry out, or have carried out, the audits necessary to ensure compliance within its organisation.
• Confidentiality (Art. 12/4): controllers and processors may not disclose personal data they learn contrary to the Law or use it for purposes other than processing; this duty continues after they leave their role.

3. Breach Notification: To Whom, When and How (KVKK Art. 12/5)

Under Art. 12/5, where processed personal data is obtained by others by unlawful means, the controller notifies the data subject and the Board as soon as possible. The Board may, if necessary, announce the breach on its website or by another method it finds appropriate.

The Law says only "as soon as possible"; the specific period has been set by a principle decision of the Personal Data Protection Board. Under that decision the controller must notify the Board within 72 hours of learning of the breach, and if notification cannot be made within 72 hours the reasons for the delay must accompany the notice. Data subjects must be notified as soon as possible once the breach is reasonably established, directly (email, telephone, post) or, if direct contact is impossible, by an appropriate method such as a notice on the website. The current notification form and procedure are published on the Authority's website and should be checked before filing.

A notification usually covers: when and how the breach was discovered, the categories and approximate number of people affected, the categories of data involved, likely consequences, the measures taken and planned, and a contact person.

4. After a Breach: A Checklist

• First hour: tell management and the information security lead; stop unauthorised access, reset passwords of the affected accounts, and preserve evidence (logs, screenshots) by copying it.
• First 24 hours: establish the scope of the data and the number of people affected; inform processors; start the notification process.
• Within 72 hours: complete the Board notification form; if details are missing, say they will be supplemented later.
• Notifying data subjects: explain in plain language the likely risks and what they can do (change passwords, monitor account activity).
• Breach log: whether or not you notify, keep an internal record of the cause, impact and measures taken.
• Root-cause fixes: restrict access rights, apply multi-factor authentication, separate backups, train staff and update the processor obligations in contracts.

5. Sanctions: Administrative, Criminal and Civil Liability

A controller that does not meet its security obligations may be given an administrative fine by the Board (KVKK Art. 18). The fine amounts are revalued each year, so current figures should be checked in the Authority's announcements. The Board may also order the breach to be remedied and, where necessary, suspend processing.

• Criminal liability: unlawfully recording, giving, spreading or obtaining personal data is an offence under Turkish Penal Code Arts. 135-136; unlawful access to an information system (Art. 243) and blocking a system or corrupting data (Art. 244) are separate offences.
• Compensation: a person whose data has been compromised can claim redress for the harm suffered; material damage and non-material compensation for breach of personality rights can arise from an identity or financial data leak (Code of Obligations Arts. 49 and 58).
• Commercial and contractual liability: security undertakings in customer contracts and sector regulations (for example those governing payment and crypto-asset services) may give rise to further sanctions.

6. The Data Subject's Routes of Complaint

A person whose data has been breached first makes a written application to the data controller, which must answer within thirty days at the latest. If the answer is inadequate, not given in time or negative, the data subject may complain to the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the application (KVKK Art. 13). Board decisions can be challenged before the administrative court. In addition, a compensation action can be brought in the civil courts, and acts that amount to offences can be reported to the public prosecutor.

7. Must You Appoint a "Data Protection Officer"?

The EU General Data Protection Regulation (GDPR) requires some organisations to appoint a data protection officer (DPO). Turkish law is different: in a decision of 15.04.2025 the 10th Chamber of the Council of State noted that Law no. 6698 contains no separate "data protection officer" status apart from the data controller and the data processor, that controllers and processors are under no obligation to employ such an officer or to obtain services from one, and that the Board was not given the task of creating the status; it therefore annulled the Board's Communiqué and Certification Programme on data protection officers (see the precedent box below). The decision carries a dissenting opinion and is open to appeal, so developments should be followed.

The decision is a reminder that the data-security duty rests by law on the data controller, and that appointing a compliance officer or buying services from a certified individual does not remove it.

8. Special Notes for Crypto-Asset and Technology Companies

• KYC documents are sensitive: when ID, selfie and address documents leak, the risk of identity theft and fraud is high; encryption and access logging for them should be treated as essential measures.
• Bind processors by contract: contracts with cloud, payment and verification providers should include security, breach notification and audit rights.
• Watch cross-border transfers: transfers abroad are subject to the separate regime in KVKK Art. 9; using foreign servers requires that regime to be assessed separately.
• Treat account-takeover attacks as breaches: mass takeover of user accounts is not just a security incident but a data breach that can trigger the notification duty.

Frequently Asked Questions

For legal advice on personal data breaches, KVKK compliance, crypto-asset and IT law disputes, see our Crypto & IT Law page, or request an appointment through our Contact page.