A Turkish Processor Reports a Data Breach to a Foreign Controller: Notification and Evidence

Identify the incident and the legal roles

Article 12(5) of Personal Data Protection Law No. 6698 addresses personal data that are obtained unlawfully by others. It requires the controller to notify the affected person and the Board promptly. A response team must establish what occurred, which personal data were involved and which organisation controlled the relevant processing. An unexplained service interruption, a security alert and confirmed unlawful acquisition should not be described as identical events without examining the available evidence.

Article 3 distinguishes the controller, which determines processing purposes and means, from a processor acting on the controller’s behalf under its authority. Contract labels do not replace that factual allocation. A Turkish service provider can process customer records for a foreign company while controlling separate information used for its own employment or billing purposes. The incident analysis must identify the role applicable to the affected dataset and operation.

Article 12(2) makes the controller jointly responsible with a processor for taking the security measures required by Article 12(1) when processing is carried out on its behalf. This provision concerns security measures; it should not be transformed into an unsupported statement that every person involved automatically owes the same civil damages for every incident. The notification route, security compliance and any contractual or civil liability require connected but separate assessment.

Escalate from processor to controller without delay

The Board’s Decision of 24 January 2019, No. 2019/10 expressly requires a processor to notify the controller without delay when personal data in the processor’s custody are obtained unlawfully by others. It does not give the processor a separate seventy-two-hour waiting period. The processor’s first escalation should therefore not be postponed until its final technical report, internal committee approval or full calculation of affected records is complete.

A useful initial report identifies the notifying provider, affected service, time of detection, known data categories, established facts, immediate containment and a contact able to supply updates. Unknown matters should be identified as unknown. An early report that accurately distinguishes confirmed information from work in progress enables the controller to assess its own obligations without creating false certainty about the cause or scale.

The parties should preserve the original escalation and evidence that it reached the responsible controller contact. A generic service ticket can be insufficient operationally when it hides a breach inside routine maintenance correspondence. The processing agreement and incident plan should provide monitored reporting channels and escalation contacts. Those contractual arrangements implement the decision’s requirement; they cannot validly recast “without delay” as permission to wait for the provider’s next monthly service report.

Document awareness and the seventy-two-hour period

Decision No. 2019/10 interprets the statutory requirement for prompt Board notification as notification without delay and at the latest within seventy-two hours after the controller learns of the breach. Preserve when the relevant information was received, by whom, and what it established. The incident’s occurrence, the processor’s discovery, its report to the controller and the controller’s awareness are distinct entries in the chronology. They should not be collapsed into a single convenient date.

The decision uses hours, not business days. The organisation must therefore have a response route capable of functioning outside ordinary office hours. A foreign head office’s weekend or internal approval calendar does not alter the wording of the Turkish rule. The specific awareness assessment depends on the evidence available to the controller; uncertainty should be recorded accurately rather than used to defer all action until every technical question has been resolved.

Where notification could not be made within seventy-two hours for a justified reason, the decision requires the reasons for delay to be explained with the notification. This is not an automatic exemption from the deadline or an assurance that any stated reason will be accepted. Keep a factual account of the obstacle, the information available at each stage and the action taken. The controller should submit the required notice and explain the delay instead of abandoning notification because the period has already elapsed.

Apply the rule to the foreign controller

Decision No. 2019/10 specifically addresses a breach occurring at a controller established abroad. It requires notification on the same basis where the breach’s consequences affect data subjects resident in Turkey and those people benefit from the offered products or services in Turkey. Both elements in that formulation must be examined. The rule should not be reduced to a person’s nationality or to the existence of a Turkish-language website alone.

A breach at a Turkish processor requires identification of the foreign principal and its affected processing, together with the applicable scope of Law No. 6698. Document where affected individuals reside, the relevant services and the relationship with Turkey. Other jurisdictions’ notifications must be coordinated, but a submission to an overseas regulator is not itself the notification required to the Turkish Board. Maintain a separate record for each legally required recipient and submission.

The foreign controller’s Turkish representative can provide the established communication route under Articles 11 and 12 of the Registry Regulation. Our guide to foreign-controller representation and VERBIS explains that arrangement. The representative needs timely access to the facts and the controller’s decisions. Registry entry alone does not provide the technical incident information needed for a complete breach notice or shift the underlying controller role to the representative.

Prepare the Board notification and supplements

Decision No. 2019/10 requires use of the Authority’s personal data breach notification form. The official decision page links to the current notification facility and guidance. The Authority also states that this form is for the controller; complaints and reports by other persons use their appropriate routes. A processor sending an operational incident report to its customer should therefore distinguish that report from the controller’s formal notification to the Board.

The form must reflect the known incident accurately. Establish the affected processing, data categories, relevant dates, available scale information, consequences and measures taken or planned. Do not substitute a marketing statement or a generic claim that the company’s systems are secure. The purpose is to give the Board usable information about the actual event and response, including matters that remain under investigation.

The decision expressly permits information to be supplied in stages without delay where all form information cannot be provided simultaneously. This allows an initial notification followed by supported updates. It does not justify withholding the initial notice until the investigation is complete. Each supplement should identify the investigation reference, the earlier statement being updated, the new evidence and whether the controller’s assessment has changed.

Keep a copy of the exact form, attachments and submission confirmation. The incident file should show what the Board was told at each stage. When technical analysis changes an estimated number or identifies an additional dataset, explain the change and its basis. An evolving factual record is more reliable when corrections are traceable than when earlier versions disappear from the company’s internal file.

Inform the affected individuals

Board notification does not replace communication to affected individuals. Decision No. 2019/10 requires that communication within the shortest reasonable time after the affected people have been identified. Where their contact details can be reached, notification should be direct. Where they cannot, an appropriate method such as publication on the controller’s website is envisaged. This is a separate rule from the seventy-two-hour outer period for notifying the Board.

The Board’s Decision of 18 September 2019, No. 2019/271 prescribes the minimum contents of the communication. It must use clear, simple language and explain when the breach occurred, which data were affected by category with ordinary and special-category data distinguished, possible consequences, measures taken or recommended to reduce adverse effects, and a contact route for further information. The notice should make these elements understandable to the people receiving it.

The communication must match the actual affected data and supported risk assessment. Avoid declaring that no harm is possible merely because no complaint has yet been received. Equally, do not state that identity theft or another consequence has occurred unless there is evidence. Identify the information available, explain the relevant possible effects and provide measures that correspond to the incident.

Preserve the approved notice, delivery records, publication dates and the method used to identify recipients. A public website notice should not disclose the affected people’s identities unnecessarily. Failed delivery and newly identified affected groups require continued attention. The incident team should retain enough information to demonstrate which people were notified, when and by which route.

Contain the breach while preserving evidence

Article 12(1) requires measures to prevent unlawful processing and access and to safeguard personal data. Incident response should therefore address ongoing exposure while preserving the records needed to understand what occurred. Restricting compromised access, securing affected systems and investigating the disclosure must be coordinated with reliable evidence collection. The law does not prescribe one identical technical remedy for every system or incident.

Record who authorised a containment action, when it occurred and which systems it affected. Preserve relevant original logs and technical reports with their time settings and source descriptions. A report that mixes local time and a foreign server’s time without explanation can distort both the incident sequence and the notification assessment. Technical conclusions should identify the underlying material and any limitations.

Distinguish stopping the immediate disclosure from establishing its full extent. Disabling an access credential can end further use of that credential without establishing which records were previously accessed or copied. The controller’s reports should separate those findings, identify the evidence for each and continue the investigation needed to determine affected people and data categories. A containment timestamp is not proof that earlier consequences have been eliminated.

The response file also needs a proportionate scope. Article 4 requires data to remain relevant, limited and proportionate to processing purposes. Investigating an affected account does not automatically justify unrestricted copying of unrelated personal communications. Define the evidence needed for the breach analysis, limit access and retain it according to the applicable purpose and legal obligations. The need to investigate should be documented rather than treated as an unlimited retention exception.

Review security duties and international disclosures

The processor’s notice does not establish that the controller had fulfilled its pre-incident security obligations. Article 12(3) requires the controller to conduct or commission necessary audits within its organisation. Review the actual arrangements for instructions, access, service-provider oversight and incident escalation against the affected processing. A contractual statement that the provider complies with all laws is not a substitute for examining the measures that were implemented.

The investigation can itself involve international disclosures to headquarters, forensic specialists, insurers or group companies. Identify the recipients, purposes and data involved before sending an unrestricted incident archive abroad. The Article 9 overseas-transfer framework remains relevant to those disclosures. A breach does not automatically authorise unlimited transfers of all affected records to every member of the corporate group.

Article 12(4) restricts unlawful disclosure and use outside the processing purpose and preserves that obligation after a person’s duties end. Limit incident materials to authorised recipients and review access when external assistance ends. The reporting and investigation process should reduce exposure, while retaining the evidence needed for the controller’s legal obligations.

Maintain the incident file and follow-up work

Decision No. 2019/10 requires the controller to record information concerning breaches, their effects and the measures taken, and to keep that material available for Board examination. It also requires an incident response plan identifying internal reporting, notifications under the Law and responsibility for evaluating possible consequences, with periodic review. The completed incident should inform that review through documented findings and remedial actions.

A later Board information request has its own legal basis and timetable. Article 15(3) requires the controller to provide investigation information and documents within fifteen days, subject to its express state-secret exception, and to permit necessary on-site examination. Preserve the breach submissions and supporting records so that a later response can be consistent with what was reported. Do not assume that an earlier notification closes the investigation or removes the possibility of further questions.

Contractual claims between controller and processor require a separate examination of duties, breach, causation and the applicable agreement and law. Timely reporting does not automatically establish full security compliance, while a late report does not itself quantify every claimed loss. A coherent record distinguishes the incident, notification decisions, containment, continuing cooperation and the evidence relevant to any later recovery claim.

Assign an owner to each outstanding remedial action and keep evidence of its implementation. The response plan’s periodic review should address failures in escalation or record availability demonstrated by the incident, with the revised responsibilities communicated to the people expected to act. Recording an intended improvement is different from showing that the relevant control was introduced and checked.

Frequently asked questions

1. Does the Turkish processor have seventy-two hours to tell its customer?

No. Decision No. 2019/10 requires the processor to inform the controller without delay. The seventy-two-hour outer period concerns the controller’s notification to the Board after learning of the breach.

2. Is the Board notification period measured in business hours?

The decision states seventy-two hours, not business hours or business days. The controller needs a response process capable of handling the obligation outside its normal office schedule.

3. Must the controller wait for the final forensic report?

No. The decision allows information to be provided in stages without delay where all form information cannot be supplied at once. Known facts and unresolved issues must be described accurately in the initial notice and supplements.

4. What happens when seventy-two hours have already passed?

The controller should still address notification. Decision No. 2019/10 requires reasons for delay to accompany a late notification where notification within the period was not possible for a justified reason. Acceptance of the explanation cannot be assumed.

5. Does an overseas breach always require notification in Turkey?

The decision’s express foreign-controller rule applies where consequences affect people resident in Turkey and they benefit from the offered products or services in Turkey. The actual processing, affected people and territorial connection must be examined.

6. Is a notice to a foreign regulator sufficient?

No. It does not itself constitute the required notification to the Turkish Board. Coordinate the factual account, but preserve separate submissions and delivery evidence for each applicable regulatory obligation.

7. Do individuals also have to be informed within seventy-two hours?

The decision gives them a separate standard: the shortest reasonable time after affected people are identified. Direct contact is used where contact details can be reached; otherwise an appropriate method is required.

8. What must an individual’s breach notice contain?

Decision No. 2019/271 requires clear information about timing, affected data categories, possible consequences, mitigation measures and a route for further information. Ordinary and special-category data must be distinguished.

9. Does outsourcing remove the foreign controller’s security responsibility?

No. Article 12(2) makes the controller jointly responsible with its processor for the security measures required by Article 12(1). The precise allocation of other liabilities requires separate legal analysis.

10. Can the company close the file after submitting the form?

The decision requires records of the breach, effects and measures to remain available for Board examination. Supplements, individual notifications, remedial work and any later investigation request must be tracked separately.