A company’s data-breach notice may call for more than changing a password. Find out which data was affected, reduce misuse risks and distinguish a data-protection application from a compensation claim.
What should the notice explain?
Relevant information includes when the incident occurred, affected data categories, possible consequences, measures taken and a contact point. Identity, contact, password and payment data create different risks. If the notice is unclear, request the scope affecting you in writing from the controller. Keep the notice, subject line and date.
Whose obligation is the 72-hour period?
Under Board Decision 2019/10, the controller must notify the Board without delay and within 72 hours of becoming aware of the breach. Affected individuals should also be informed within the shortest reasonable time. This does not mean a victim must sue within 72 hours. Complaint and litigation deadlines are governed separately.
Distinguish an application from a complaint
An individual’s application under Law No. 6698 generally starts with the controller. Calculate response and complaint periods under Articles 13 and 14 using the actual dates. The Board examines data-protection compliance; an administrative fine is not compensation paid to the individual. A damages claim requires separate legal assessment.
Practical protective measures
Change a compromised password wherever it was reused and enable multifactor authentication. Be alert to fake security calls referring to the breach. Report suspicious transactions to the bank and preserve the timing linking the notice to any misuse. Material or non-material damages require examination of the breach, harm and causal connection.
How to organise your application file
Set out events chronologically and match each payment, instruction and reply to its record. Keep original files and capture screenshots with dates and URLs. Retain proof of delivery for written applications. If a statement changes, preserve the earlier version as well. Avoid publishing identity and account information on public channels.
Frequently asked question
Should I send all leaked data in my first enquiry?
Start with the date of the breach notice, the reported categories of affected data and a short summary. Clarify the need and sharing method before sending an identity copy or a leaked-data file.
DISCUSS YOUR CASE
Assess your options after a personal data breach
We can review the breach notice, affected data and possible applications to the data controller to assess your options under Turkish law.
A brief summary and important dates are enough for an initial enquiry. Send documents only when requested by our lawyers, through the channel they specify. Do not share passwords, one-time codes or wallet keys.
Sources and legislation
KVKK: Personal Data Breach Notification
KVKK: Board Decision No. 2019/271
Personal Data Protection Law No. 6698
Related reading
IT & Technology Law
AI Voice Impersonation: Legal Steps When Someone Requests Money in Your Name
Prepared on 30 September 2026. General information under Turkish law. Available remedies and deadlines depend on the particular records. No outcome or recovery is guaranteed. The image is illustrative.