KVKK Series 5/5: Data Breaches, International Transfers and Penalties

A data incident calls for a prompt, documented response. Overseas cloud services and group company transfers also need a suitable legal mechanism; a general consent clause is not a substitute for transfer compliance.

The final part of this series explains security duties, notification requirements, the revised international transfer framework and potential sanctions.

1. Data security duties

Article 12 of Law No. 6698 requires appropriate technical and organisational measures against unlawful processing and access, and to protect personal data. Controls should reflect the risks, data categories and actual processing environment.

Using a processor does not remove the controller’s Article 12 responsibility. Contracts should clearly address protection duties, incidents, access and the return or deletion of data.

2. Data breaches and the 72-hour rule

Where processed personal data are unlawfully obtained by others, Article 12(5) requires notice to the Board and affected individuals. Board Decision 2019/10 interprets the deadline for notifying the Board as without delay and no later than 72 hours after the controller becomes aware.

• Do not wait for a complete investigation before notifying. Explain any delay beyond 72 hours and provide missing information in stages without further delay.

• After identifying affected individuals, inform them within the shortest reasonable time, directly where contact details are available or by an appropriate alternative.

• Document the incident, its effects, the response and notifications. A processor must notify its controller without delay.

• Assign responsibilities in an incident response plan and review the plan periodically.

Examples include customer details exposed through an e-commerce vulnerability, payroll sent to a wrong recipient, a lost device and ransomware. A loss of availability, such as encryption by ransomware, is a security incident requiring investigation; whether the statutory notification trigger is met must be assessed on the facts, including evidence of unlawful acquisition.

3. International transfers after the 2024 reform

Law No. 7499 revised Article 9 with effect from 1 June 2024. The implementing regulation was published on 10 July 2024 in Official Gazette No. 32598. The former consent-based transitional regime ended on 1 September 2024.

Adequacy and appropriate safeguards

A transfer requires an applicable processing basis under Articles 5 or 6 as well as a valid transfer route. Check whether a Board adequacy decision covers the destination country, sector or international organisation. In its absence, appropriate safeguards may be used subject to the statutory conditions, including enforceable rights and effective remedies for individuals.

• Board-published standard contracts appropriate to the parties’ controller/processor roles.
• Board-approved binding corporate rules for a group of undertakings.
• A written undertaking providing adequate protection, with Board approval.
• The specific agreement route for public bodies and organisations covered by Article 9, also requiring Board approval. This is not a general route available through any private international contract.

Standard contracts

Use the applicable Board-published standard text without changing its mandatory substance, complete the required annexes and ensure that signatories have authority. Notify the Authority within five business days after signature. Keep the signed contract and notification evidence; comply with the relevant rules concerning changes and termination.

Occasional transfers and consent

Only where adequacy and appropriate safeguards cannot be used may a transfer rely on one of Article 9’s limited exceptions, and it must be occasional. Informed explicit consent after disclosure of the possible risks is one such exception. It is not a routine solution for continuous overseas cloud hosting or regular group company data flows.

4. Administrative fines and criminal liability

2026 administrative fine ranges

These are the Authority’s published 2026 ranges, following a 25.49% revaluation. The applicable amount depends on the infringement and assessment; the maximum is not imposed automatically. Amounts are updated annually.

Compensation and offences

A person suffering damage from unlawful processing may seek compensation under the applicable rules. Articles 135–138 of the Turkish Criminal Code address offences involving unlawful recording, disclosure, dissemination or acquisition of personal data and failure to destroy data when legally required, with relevant qualifications and aggravating circumstances. An administrative violation does not automatically establish a criminal offence; each offence’s elements must be assessed.

5. Preparing for an inspection

The Board may investigate on a complaint or on its own initiative. Practical implementation matters as much as written documents.

• Maintain an accurate inventory and VERBIS record where registration is required.

• Keep suitable notices for employees, customers, candidates and visitors, with evidence of delivery.

• Apply retention and disposal arrangements and keep disposal records where required.

• Retain processor contracts, international transfer documents and standard contract notifications.

• Document safeguards, training, access responsibilities and testing.

• Keep records of data subject requests and responses, incident handling and breach notifications.

Documents should describe what the organisation actually does. Templates left unimplemented do not establish compliance.

Official sources

• Law No. 6698: Articles 9, 12, 17 and 18
• Board Decision 2019/10: breach notification
• Authority: official 2026 fine table

Previous part: Employee data, biometrics, CCTV and email.

General information on Turkish law. References reviewed: 30 October 2026. A specific incident or transfer requires an individual legal assessment.