An announcement (the “Announcement”) regarding the personal data breach notification procedures, has published with the 2019/10 numbered decision of Personal Data Protection Institution on 24.01.2019. The “Personal Data Breach Notification Form” is also shared within this Announcement, you may reach the sample form here.

The Announcement mentions about the obligations of the Data Controller stated in the Art. 12 of the Personal Data Protection Law ("KVKK") and Data Controllers should inform the institution as soon as possible in case of any data breach. The institution has expressed that this notification process aims to prevent negative conclusions or to minimize risks that arise from these breaches on data subjects and others.

Under this scope, the Institution has taken below mentioned decisions to create a ground parallel with European General Data Protection Regulation (GDPR) which constitutes basis for the KVKK:

Within the scope of the Personal Data Protection Law numbered 6698 which has been announced in the 29677 Numbered Official Gazette dated April 7, 2016, it is highly crucial for the natural persons and legal entities to meet all the legal compliancy requirements in dealing with the personal data that they obtain, use, store, process to avoid the administrative penalty fines and possible incompliancy sanctions.

In the beginning of April 2016, the question of how sensitive personal data shall be protected arose when the personal information of over 50 million Turkish citizens was released on internet. Coincidently, around the same date the Turkish state released new legislation on how to protect personal information. The legislation entitled the Protection Of Personal Data was published on April 7, 2016 in the Legal Turkish Newspaper and is based on the European Union Commission and EU Parliament’s 95/46/EC numbered, October 24, 1995 dated Directive on the protection of the free movement of personal information and its process.