Privacy Blog

THE TURKISH DATA PROTECTION AUTHORITY ANNOUNCES THE DECISION ON THE MINIMUM ELEMENTS THAT MUST BE INCLUDED IN THE NOTIFICATION OF DATA BREACH

15 October 2019

The Turkish Personal Data Protection Board (the “Board”) has released the decision on their web site today about the minimum elements of the data breach notification, which is supposed to be sent to the data subjects by the data controller due to their obligation.

The Board first referred to the obligation of the data controller to inform the Board, and the data subject as soon as possible, if the personal data processed by the data controller is obtained by others unlawfully. (Law on the Protection of Personal Data Art. 12) After that, the Board also referred to its decision dated 24/01/2019. On this decision, the Board determines that “After identification of the persons who are affected by the data breach, the related person's contact address must be reached directly, if it is not possible to reach the contact address of the data subject, the notification can be made by other appropriate methods, such as the publication of the data breach announcement on data controller’s website.”

The Board decided that it is necessary to determine the minimum elements of this notification considering its significance on ensuring the negative consequences that may arise due to the breach would be prevented or minimized.

Subsequently, The Board decided data breach notification must be clear, simple and include following elements;

  • When the breach occurred,
  • Which personal data categories are affected by the breach, (by distinguishing between personal data / sensitive personal data)
  • Possible consequences of the data breach,
  • Measures which are taken or proposed take to reduce the negative effects of a data breach,
  • The name and contact details of the contact person of the data controller to provide information about the data breach or the full address of the data controller's web page, contact details, etc.

You can find the text of the decision (in Turkish) here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr