Under the Board's decision, notification must be made without delay and at the latest within 72 hours of becoming aware of the breach. An incident response plan and a breach register help avoid missing the deadline.
Source: 6698 sayılı KVKK md. 12/5, Kişisel Verileri Koruma Kurulu kararları
Related terms
Personal Data Protection Law (KVKK)Law No. 6698, which governs the protection of fundamental rights and freedoms in the processing of personal data and the obligations of data controllers.Data controllerThe natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.Cybersecurity riskThe likelihood of harm to an organisation from attacks such as unauthorised access to information systems, data leaks, ransomware or service disruption.Anti-bribery and corruptionThe set of policies, controls and training designed to prevent the offering or acceptance of undue advantages to or from public officials or private sector employees.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Business continuity planA plan to keep critical activities running at an acceptable level and return to normal within set timeframes after a disruption, disaster or cyber attack.
Last updated: November 8, 2026 · This definition is for general information only.