TÜRKIYE Law and Practice Contributed by: Bora Yazıcıoğlu, Yağız Soymen, İbrahim Yıldırım and Ezgi Girenay, YAZICIOGLU Legal
availability” elements are also evaluated under the heading of Breach Impact, indicating that the DPA interprets this concept broadly. Controllers are required to notify the DPA without delay and no later than 72 hours after becoming aware of the breach. Additionally, controllers must inform affected data subjects as soon as possible, with the necessary details regarding the breach and the poten - tial risks to their personal data. The DP Law does not establish risk thresholds for assessing the requirement to notify the breach to the DPA and the data subjects, meaning that every breach must be reported, regard - less of its perceived risk level. In terms of supervision, written audits are typically pre - ferred by the DPA over on-site inspections, although the DPA is entitled to conduct the latter. After report - ing the breach to the DPA, controllers should keep an internal breach log and be prepared for any ex officio inquiries. Immediate internal documentation, prompt official notifications, and the compilation of technical evidence for written regulatory inquiries are important action items. Additionally, the Cybersecurity Law obliges those who provide services, collect data, process data, or con - duct similar activities using information systems to notify the Cybersecurity Presidency, without delay, of any vulnerabilities or cyber incidents they detect in the field in which they provide services. Therefore, when controllers suffer a personal data breach, the breach will most likely also be notified to the Cybersecurity Presidency. 1.7 Regulators The primary supervisory and regulatory authority is the DPA. It is an independent administrative institution. The DPA regulates data protection activities and safe - guards the rights of data subjects. Some of its duties and powers are as follows: • conducting investigations and taking temporary measures; • concluding the complaints;
• approving transfer mechanisms that require DPA approval. The Ministry of Trade is authorised to oversee market - ing communications (see 4.2 Personalised Advertis- ing and Other Online Marketing Practices ). Additionally, sector-specific administrative institutions as the Banking Regulation and Supervision Agency, the Capital Markets Board, the Turkish Republic Cen - tral Bank, and the Cybersecurity Presidency have the authority to regulate issues within their respective sec - tors. 1.8 Enforcement Proceedings and Fines The DPA may initiate investigations upon receiv - ing a complaint from a data subject or ex officio if it becomes aware of the alleged violation. The Course of an Investigation The DPA may request information and/or documents from controllers. Controllers are required to provide requested information and/or documents within 15 days, unless they constitute a state secret. The DPA may request additional information and/or documents and conduct an on-site inspection during an investi - gation. Administrative Fines The DP Law outlines five types of violations, each sub - ject to administrative fines that are adjusted annually. As of 2026, they are: • failure to inform data subjects of processing activi - ties (between TRY85,437 and TRY1,709,200); • failure to take the necessary technical and organi - sational measures (interpreted broadly, includ - ing unlawful data transfer abroad and breach of fundamental principles) (between TRY256,357 and TRY17,092,242); • failure to comply with the decisions issued by the DPA (between TRY427,263 and TRY17,092,242); • failure to comply with the obligation to register with VERBIS and failure to submit information to VER - BIS (between TRY341,809 and TRY17,092,242); and
• imposing administrative sanctions; • issuing adequacy decisions; and
516 CHAMBERS.COM
Powered by FlippingBook