Turkey's KVKK Article 12: data security and breach notification
Article 12 of the KVKK requires controllers to secure personal data and to notify affected people and the Board as soon as possible when data is unlawfully obtained.
Duties
Prevent unlawful processing and access, take technical and administrative measures, ensure processors comply.
Notification
If data is obtained unlawfully, notify the people concerned and the Board as soon as possible; the Board applies a 72-hour limit.
Reputation
Breach notices can be published on the Board's website; prepare a statement and customer plan.
General information, not legal advice. In real cases we work alongside lawyers who specialise in digital rights.
Frequently asked questions
Must small leaks be reported?
If personal data reached others unlawfully, size alone does not decide.