Article 12 of Personal Data Protection Law no. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK) imposes on the data controller (veri sorumlusu) a duty of notification where personal data has been obtained unlawfully. Decision no. 2019/10 of the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) dated 24.01.2019 gave that duty concrete shape and established that notification to the Board must be made within 72 hours at the latest. This article addresses how the 72-hour period runs, how notification to the data subject (ilgili kişi) is made and what the consequences of delay are.
Data breach notification may cover not only large-scale cyber attacks but also an e-mail sent to the wrong person, a lost portable storage device or a customer record accessed without authorisation. For that reason organisations need to assess every candidate for notification by the same procedure, irrespective of the scale of the incident.
Key Takeaways
- Under KVKK art. 12/5 a data breach must be notified to the Board without delay and within 72 hours at the latest from the moment it is learned of.
- The 72-hour period begins to run not from the moment the breach occurred but from the moment the data controller learned of it.
- There is no concrete limit expressed in hours in the Law for notification to the data subject; notification must be made as soon as is reasonably possible.
- Notification is made electronically through the Personal Data Breach Notification Form at kvkk.gov.tr.
- The upper limit of the administrative fine (idari para cezası) for breach of the data security obligation is 17.092.242 TL for 2026.
What Is the Data Security Obligation under KVKK Article 12?
KVKK article 12 places the data controller under a duty to prevent the unlawful processing of personal data, to prevent unlawful access to that data and to keep the data at an appropriate level of security. This obligation requires administrative and technical measures to be taken together.
In article 12/1 the legislator set out three separate obligations: to prevent the unlawful processing of personal data, to prevent unlawful access, and to ensure the safekeeping of the data. When assessing compliance with these obligations, the Board takes into account the risks specific to the sector and the volume of data.
Article 12/3 provides that the data controller is obliged to have the necessary audits carried out within its own organisation. These obligations do not fall away where some or all of the processed data is transferred to another data controller either; provisions relating to data security are expected to be included in transfer agreements.
Technical measures include access authorisation, network firewalls, encryption and the keeping of logs. Administrative measures may be listed as awareness training for employees, keeping the data processing inventory up to date, and including data security clauses in agreements made with suppliers. In the course of an examination the Board investigates whether these two groups of measures are present together.
Who Bears the Duty of Notification as Between the Data Controller and the Data Processor?
The duty of notification belongs as a rule to the data controller; however, where the breach has occurred within the data processor (veri işleyen), the data processor must report the situation to the data controller immediately. Notification to the Board and to the data subject is still made by the data controller.
In agreements made with data processors such as a cloud service provider, a call centre or a payroll company, the number of hours within which a breach is to be reported to the data controller should be separately agreed. If that period is not kept short, it becomes difficult in practice for the data controller to meet its own 72-hour deadline.
When Does a Personal Data Breach Arise?
A personal data breach arises where the personal data being processed is obtained unlawfully by others, whether intentionally or accidentally. Unauthorised access, a data leak, an e-mail error or the loss of physical documents may be assessed within this scope.
Types of Breach
In practice breaches are examined under three headings: a confidentiality breach is the viewing of data by unauthorised persons, an integrity breach is the alteration of data without authorisation, and an availability breach is the temporary or permanent loss of access to the data or to its backup. A single incident may involve more than one of these types at the same time.
An example of a confidentiality breach is a bulk e-mail sent to the wrong person, an example of an integrity breach is the unauthorised alteration of a database record, and an example of an availability breach is the failure of a server that has not been backed up. In all three situations the data controller is obliged to determine the scope of the incident.
A ransomware attack, for instance, may give rise to both an availability breach and a confidentiality breach; while the data is being encrypted it may at the same time have been copied by the attacker. For that reason the scope of the breach must be examined in detail by the technical team during the incident response process.
The 72-Hour Rule: How Does the Period for Notification to the Board Run?
The data controller is obliged to notify the Personal Data Protection Board without delay and within 72 hours at the latest from the date on which it learned of the breach. This period arose from Board Decision no. 2019/10 dated 24.01.2019, which gave concrete shape to the expression “as soon as possible” in the KVKK.
When Is the Period Treated as Beginning?
The 72-hour period begins to run not from the moment at which the breach actually occurred but from the moment at which the data controller concretely learned of it. The moment of learning may arise through an internal audit finding, an IT alert, a report from outside, or an alarm from a cyber security monitoring system.
This distinction matters in practice, because even if an attack began months earlier, the notification period starts only on the date on which the organisation became aware of the situation. Even so, whether the data controller could have become aware earlier with reasonable diligence may be separately assessed in the Board’s examination.
Is Late Notification Possible?
Where there is a justified ground, notification may exceed 72 hours; in that case, however, the reasons for the delay must also be explained to the Board together with the notification made. Delay without a ground may be assessed as a separate breach.
In practice delay generally occurs because the scope of the incident has not become clear, because of an investigation being conducted in parallel with criminal proceedings, or because the technical team’s process of verifying the incident has been prolonged. When assessing the ground for delay, the Board may also examine the data controller’s internal correspondence at the time of the incident and its response records. For that reason documenting each step matters for the credibility of a defence based on delay.
The Duty of Notification to the Data Subject
Separately from the notification made to the Board, notification must also be made to the data subjects affected by the breach. The Law does not lay down a period expressed in hours for this notification; the essential point is that notification be made as soon as is reasonably possible.
Where the data subject’s contact address can be reached, notification is made directly. Where the address cannot be reached, the route of making a public announcement by appropriate methods, such as publication on the data controller’s own website, may be taken. The notification must clearly state the nature of the breach, its possible consequences and the measures taken.
The purpose of notification to the data subject is to enable that person to take the measures necessary to protect their own data. For example, if there has been a password leak the person may be advised to change their password, and if there has been a leak of card details to inform the bank concerned. Writing the notification in comprehensible language rather than technical jargon makes it easier for it to achieve its purpose.
The Data Breach Notification Form and the Content of the Notification
Notification to the Board is made electronically by completing the Personal Data Breach Notification Form accessed through kvkk.gov.tr. The form covers the date of the breach, the date on which it was learned of, the number of persons and records affected, the possible consequences of the breach and the measures taken or to be taken.
Where the form is not completed in full, the Board may request additional information. For that reason, having the legal and IT units prepare the notification form together as part of the incident response plan makes it easier for the process to be completed within 72 hours.
Even where the information in the form is complete, the nature of the incident may change over time. In that case the data controller may convey to the Board, by way of a supplementary notification, the new information it has obtained after the initial notification. The Board assesses whether the initial notification was made within the period separately from supplementary notifications made afterwards.
What Happens If No Notification Is Made?
Failure to fulfil the obligations relating to data security is made subject to the sanction of an administrative fine under KVKK art. 18. These amounts are updated each year in line with the revaluation rate and announced by the Board.
| Type of Obligation | 2026 Lower Limit | 2026 Upper Limit |
|---|---|---|
| Breach of the duty to inform (aydınlatma yükümlülüğü) | 85.437 TL | 1.709.200 TL |
| Breach of the obligations relating to data security | 256.357 TL | 17.092.242 TL |
| Failure to comply with Board decisions | 427.263 TL | 17.092.242 TL |
The amounts are the 2026 figures as updated in line with the revaluation rate under the general communiqué of the Tax Procedure Law; the Board’s announcements should be taken as the basis for the exact amount.
Alongside an administrative fine, the Board may also decide that the data processing activity be halted. In the case of repeated breaches the fine approaches the upper limit; for that reason conducting the notification process in accordance with proper procedure carries particular importance.
Measures to Be Taken Against Data Breaches
In a breach examination the Board assesses the measures taken before and after the incident rather than the incident itself. Encryption, access authorisation, the keeping of logs and regular penetration testing may be counted among preventive measures.
Putting the incident response plan into writing in advance offers practical benefit in ensuring that the 72-hour period is not missed at the moment of a breach. The plan should determine in advance who will complete the notification form, which units will be informed and what the method of reaching the data subjects will be.
The frequency with which personal data is backed up, and keeping backups in a separate environment, reduce the impact of availability breaches. It is also recommended that data security obligations be expressly regulated in agreements made with third-party service providers.
Common Mistakes in the Notification Process
The most frequently seen mistake in practice is postponing the notification process until the whole of the incident has become clear. In fact notification can be made with the information known up to that moment, and the missing parts can be completed afterwards. The longer the waiting period, the greater the risk that the 72-hour limit will be exceeded.
Another mistake is taking up notification to the data subject only after notification has been made to the Board. In fact the two notification processes are independent of one another, and notification to the data subject may, where the circumstances are suitable, be carried out at the same time as notification to the Board. Finally, completing the notification form solely by the legal unit without the technical team may lead to the scope of the incident being reflected incompletely.
A further common mistake is taking a breach seriously only in incidents thought to affect large data records. A breach affecting a limited number of persons must also be handled with the same care if it involves those persons’ special categories of personal data (özel nitelikli kişisel veri). In its assessment the Board takes into account the nature of the data as much as the number of persons affected.
The guides published by the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu) contain examples of technical and administrative measures specific to particular sectors. Following these guides contributes to demonstrating good faith and diligence in any examination that may arise. For detailed information, reference may be made to the data breach notification page of the Personal Data Protection Authority.
Information technology law and KVKK compliance processes require a separate assessment according to each organisation’s data processing activity. To obtain information about KCD Hukuk’s work in the field of Information Technology Law and KVKK, the practice area page may be reviewed.
A personal data breach may sometimes be intertwined with the infringement of intellectual property rights; for disputes that may be encountered in trade mark registration applications, you may look at our article on opposition to a trade mark application.
How Does the Duty of Notification Work in Different Sectors?
The legal framework of the duty of notification is the same for all sectors; however, the nature of the breach and the category of data it affects differ from sector to sector. Because the volume and sensitivity of the data processed are higher in the finance, healthcare and e-commerce fields, the incident response process needs to be designed accordingly.
In the finance sector, since a breach involving card details or account movements may lead to financial loss for the data subject, concrete recommendations as to precautions are expected to be included in the content of the notification. In the healthcare sector, because health data constituting special categories of personal data is involved, the additional obligations falling under KVKK art. 6 must also be assessed together with it. In the e-commerce sector, where customer account details or order history is leaked, it is recommended that additional measures directed at account security be stated in the notification.
In public institutions, breach notification may also be carried out together with internal audit and disciplinary processes. Even in those situations the 72-hour period for notification to the Board does not change; the length of internal processes is not accepted as a ground for postponing the notification period.
Additional Points for Organisations Making International Data Transfers
For organisations that host personal data on servers abroad or use a service provider abroad, the breach notification process requires additional coordination. Breach information coming from a data processor abroad needs to be assessed as soon as possible, taking the differences of language and time zone into account.
The agreements of such organisations must expressly state within how many hours of the data processor becoming aware of the breach it will inform the data controller. Otherwise the data controller makes its own 72-hour period largely dependent on the data processor’s speed of notification; and that may become the subject of a separate assessment of want of care before the Board.
Whether the transfer abroad rests on the appropriate safeguard mechanisms under KVKK art. 9 is also a separate subject of examination. A single breach may require the obligations relating both to data security and to the transfer regime to be reviewed at the same time. In such mixed incidents, coordinated work by the legal and IT units contributes to the notification content being prepared in full.
You may reach the Personal Data Protection Board’s current announcements and guides on the procedure for notification through the KVKK’s official website. Failure to comply with the duty of notification may lead to an administrative fine; for general information on the route of bringing an action against administrative fines, you may review our article on bringing an action against tax and administrative fines.
In files where the data breach has emerged together with an attack on information systems or an attempt at fraud, our article addressing the distinction between fraud and qualified fraud may be useful. Where the breach is taken to the criminal sphere, our article on the rights of a suspect at the stages of statement and interrogation may be consulted for the suspect’s rights at the statement and interrogation stage. Where a need for legal advice arises while organisations are conducting their KVKK compliance processes, our article explaining the obligation to retain a lawyer in joint stock companies may also serve as a guide. The current text of Personal Data Protection Law no. 6698 may be reached through mevzuat.gov.tr.
What Will the Other Side Do?
In KVKK data breach notification processes the data controller also has a defence strategy in the face of a Board examination or a complaint by the data subject; knowing that strategy in advance makes it possible to document internal processes accordingly.
The defence that notification was made without delay. The data controller may assert that it did not delay the period at all from the moment it learned of the breach. This assertion is met with internal detection records, IT department incident logs and the time stamp of the notification made to the Board.
The defence that there was no breach of a nature giving rise to a duty of notification. It may be asserted that the nature of the data and its impact were limited. In that case an impact assessment report as to the category of data and the number of persons affected becomes decisive.
The defence that the necessary technical and administrative measures were taken. It may be asserted that there is no fault within the scope of the Law. This assertion is assessed by reference to existing security policies, encryption practices and any penetration test reports.
The defence that separate notification to the data subjects was not required. It may be asserted that the risk was not high. In that case the risk assessment criteria need to be applied to the particular incident.
The defence that notification was not made to the correct authority. The other side may assert that the notification was not made through the proper channel or by the authorised person. This assertion is assessed by examining the content of the notification form and the transmission records.
Which defence comes to the fore varies according to the nature of the breach and the data controller’s internal records; for that reason complete documentation of the incident detection and notification processes matters. Keeping internal correspondence and log records in order for the period between the moment the breach was detected and the making of the notification makes it easier to assess in advance which defence will come to the fore. To assess in advance which defence your file will meet, you may get in touch.
Frequently Asked Questions
How many hours is the data breach notification period under the KVKK?
The data controller is obliged to notify the Personal Data Protection Board without delay and within 72 hours at the latest from the moment it learned of the breach. This period was determined by Board Decision no. 2019/10.
From which moment does the 72-hour period begin?
The period begins to run not from the date on which the breach actually occurred but from the date on which the data controller concretely learned of the breach.
Does the 72-hour period apply to notification to the data subject as well?
No. There is no concrete limit expressed in hours in the Law for notification to the data subject; the notification must be made as soon as is reasonably possible.
What happens if notification is not made within 72 hours?
If the period is exceeded without a justified ground, an administrative fine may be imposed for breach of the data security obligation; for 2026 the upper limit is 17.092.242 TL.
Where and how is notification made?
Notification is conveyed electronically to the Personal Data Protection Authority by completing the Personal Data Breach Notification Form at kvkk.gov.tr.
Does every loss of data require notification?
The duty of notification arises where the data has been obtained unlawfully by others. Whether the particular incident requires notification must be assessed separately for the file in question.
Can late notification be made?
If there is a justified ground, notification may exceed 72 hours; in that case, however, the reasons for the delay must also be explained to the Board together with the notification.
Who notifies a breach occurring within the data processor?
Even where the breach occurs within the data processor, notification to the Board and to the data subject is made by the data controller; the data processor’s task is to convey the situation to the data controller immediately.
What information must the notification form contain?
The form must contain the date of the breach, the date on which it was learned of, the number of persons and records affected, the possible consequences of the breach and the measures taken and to be taken.
Time Limits Table
| Time limit | How long | Start |
|---|---|---|
| Data breach notification to the Board | 3 days | From the moment the breach is learned of |
Sources
- Personal Data Protection Authority (KVKK)
- Personal Data Protection Authority (KVKK)
- Legislation Information System (mevzuat.gov.tr)
Related Articles
- Opposition to a Trade Mark Application and the Similarity Assessment
- Action Against Tax and Administrative Fines: Time Limits and Stay of Execution
- The Distinction Between Fraud and Qualified Fraud: Commission by Information Systems
- The Rights of a Suspect at the Statement and Interrogation Stage: The First 24 Hours
- The Obligation to Retain a Lawyer in a Joint Stock Company (2026)
- The Offence of Causing Zoning Pollution (TCK 184): Unpermitted Construction
This article is for general information purposes and does not take the place of legal advice. Your particular situation requires a separate assessment of your own file.
This article was prepared on the basis of the legislation in force as at 17.09.2026.
KCD Hukuk
Find out about our office
