A personal data breach must be notified to the Board within 72 hours. A practical guide to the timeline, roles and notification content.
Article 12 of the Personal Data Protection Law (KVKK) obliges data controllers to prevent unlawful access to data. When a breach occurs, the Personal Data Protection Board must be notified without delay and at the latest within 72 hours. The 72 hours run from the moment the breach is learned. Though it looks long from the outside, it is used up very quickly during technical investigation and legal assessment.
Hours 0–6: Detection and containment
- Log the incident: time, source and first observations.
- Disconnect affected systems from the network but do not power them off (to avoid losing forensic evidence).
- Convene the incident response and KVKK committee.
Hours 6–24: Scope analysis
- Which data categories were affected? (identity, contact, finance, special-category data such as health)
- How many people were affected? Was the data encrypted?
- How long was the attacker in the system?
Hours 24–48: Legal assessment
Assess whether the breach poses a risk to individuals. If special-category data is involved or identity-theft risk is high, affected individuals must also be notified.
Hours 48–72: Board notification
Complete the Data Breach Notification Form published by the Board. It covers when and how the breach happened, affected data and number of people, likely consequences and measures taken. If information is incomplete, missing parts can be provided in stages afterwards.
Afterwards
Perform root-cause analysis, update technical and organisational measures and keep a breach register. Failing to notify, or notifying late, carries the risk of an administrative fine.
At Surnet we run the technical investigation and legal notification as one team at the time of a breach. If you have no breach plan you can download our KVKK Data Breach Response Plan template from the Whitepapers section.
Common mistakes in the breach notification form
- Leaving the number of affected people as ‘unknown’; an estimated range should be given.
- Answering measures taken with generic phrases (‘security was increased’).
- Treating a processor’s breach as out of responsibility and delaying notification; the controller remains responsible.
- Not keeping a breach register; even small breaches should be recorded.
The easiest way to be prepared is to run a 72-hour tabletop exercise once a year.