Consideration Points Regarding a Data Breach Has Been Determined With The Decision No 2019/271s
In the Paragraph 5 of the Article 12 of Turkish Personal Data Protection Law (KVKK) No.6698, in the event that the personal data processed is obtained by others by illegal means due to a data breach, the data controller shall inform the data subject and the Board as soon as possible.
In case it is found necessary, the Board may announce the details of the breach on its website and/or in any other way that is considered appropriate.
In the Board decision dated 24.01.2019 and numbered 2019/10, it was decided that in case of data breach by the data controller, the affected persons should be specified and subsequently informed by appropriate methods within the shortest possible time.
In the same decision, the criteria for the shortest period was determined as 72 hours; it was decided to notify the person concerned within 72 hours following the identification of the affected persons.
Since the purpose of reporting the data breach to the affected persons within the scope of the related provision and the Board's decision is to ensure that measures are taken to prevent or minimize the negative consequences that may arise from such persons , the Board has announced the minimum elements that should be included in the notification for this purpose with the decision no. 2019/271.
Accordingly; the data breach notification to be made by the data officer to the person concerned in clear and simple language and at least include following elements:
- When the data breach has occurred,
- Which personal data is affected by the breach in terms of personal data categories (by distinguishing between personal data / sensitive personal data),
- Possible consequences of personal data breach,
- Measures taken or proposed to be taken to reduce the negative effects of data breach,
- Ways of contact such as the name and contact details of the contact persons who will provide information about the data breach or the full address of the data officer's web page, call center etc.
The details of the Decision in Turkish can be accessed via here.