When a personal data breach is discovered in a company's systems, the first question is usually the same: "How long do we have to notify the Board (Kurul, Türkiye's Personal Data Protection Board)?" The list of data breach announcements published by the Kişisel Verileri Koruma Kurumu (KVKK, Türkiye's Personal Data Protection Authority, "the Authority") contains ten announcements dated 21 October 2026 alone. The topic is current for organizations of every size.
In this article we summarize, from primary sources, the notification deadline, when the clock starts, and how the Board and the affected individuals are notified. How responsibility is shared when a breach starts at a supplier was covered in our article on supplier-originated data breaches, and technical incident response in our article on cyber breach and incident response.
What the law says: "as soon as possible"
Paragraph 5 of Article 12 of Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, Türkiye's data-protection law, "the Law") says that if processed personal data is obtained by others through unlawful means, the data controller must notify the data subject and the Board as soon as possible. The text of the Law gives no number of hours or days. According to the same paragraph, the Board may, if necessary, announce the matter on its own website or by another method it considers appropriate.
Where does the 72-hour period come from?
The period was set by the Board, not by the Law. The Board's decision no. 2019/10 of 24 January 2019 on Personal Data Breach Notification Procedures and Principles (Kişisel Veri İhlali Bildirim Usul ve Esaslarına İlişkin Karar, "the Decision") interpreted "as soon as possible" as 72 hours. According to KVKK's announcement of 15 February 2019, it was decided that the data controller must notify the Board without delay and "within 72 hours at the latest" from the date it learns of the breach.
The Decision's other provisions also outline the framework for notification:
- Reason for delay: If notification cannot be made within 72 hours for a justified reason, the reasons for the delay must be explained to the Board together with the notification.
- Form: The Personal Data Breach Notification Form (Kişisel Veri İhlal Bildirim Formu) must be used when notifying the Board.
- Staged notification: If the information on the form cannot be provided all at once, it may be provided in stages, without delay.
- Records: Information about the breach, its effects and the measures taken must be recorded and kept ready for the Board's review.
- Data controllers abroad: If a breach occurs at a data controller established abroad but affects people resident in Türkiye, and those people benefit from the product or service in Türkiye, the Board must be notified on the same principles.
- Response plan: A data breach response plan that determines who reports to whom within the organization and who is responsible must be prepared and reviewed at regular intervals.
Current status: In the Authority sources reviewed for this article, no decision changing the 72-hour rule was found. KVKK's announcement of 20 January 2026 restates Decision 2019/10 and the 72-hour interpretation without change. The change that came with this announcement concerns publication, not the deadline: by its decision no. 2025/2451 of 25 December 2025, the Board capped at 60 days the publication of breach announcements, which had previously been published with no time limit. If it is documented that data subjects were notified in a shorter time, the announcement is removed from the website.
When does the clock start?
The Decision ties the period to the date on which the data controller learned of the breach. The Authority's notification form and form guide, on the other hand, tie the late-notification field to the case where more than 72 hours pass between the detection of the breach and its notification to the Board. The form asks separately for the start, end and detection dates and times of the breach; if the breach was reported by a data processor, the data processor's detection and notification times are also requested.
The practical consequence is this: the moment the breach is noticed should be recorded to the minute and documented. This record is the basis for the 72-hour calculation and, if necessary, for the justification of any delay.
Notifying the Board: what does the form ask?
Notification is made through the online form on the Authority's breach notification page or by completing and sending the form. According to the guide, a tracking number is generated after the online form is registered; the notification is looked up and later updated with this code. A warning at the start of the form says that the personal data affected by the breach must not be added to it. The form has five sections:
- About you: The data controller's identity and contact details and the person preparing the notification; an authorization document if the notification is sent on someone else's behalf.
- About the breach: Whether it is an initial or a follow-up notification; the source of the breach (options such as unauthorized access, ransomware, device loss, accident/negligence); the effect on confidentiality, integrity or availability; how it was detected; the affected data categories; the number of people and records. If the numbers are estimates, the reason the exact number could not be determined must be explained.
- Notification: If 72 hours were exceeded, the reason; whether the data subjects were notified, and the method and date; whether other institutions in Türkiye and abroad were informed.
- Possible consequences: A rating of the breach's impact on the data subjects and on the organization, from low to very high.
- Measures: The training the relevant employees received over the past year, the technical and administrative measures taken before and after the breach, and the estimated completion time of the planned measures.
Notifying affected individuals
According to the Decision, once it has identified the affected individuals, the data controller must also notify them within the shortest reasonable time. If a contact address can be reached, notification is made directly; if not, it can be made by appropriate methods such as publication on the data controller's own website. The form also asks about the contact channels through which data subjects can obtain information. Since Decision 2025/2451, documenting that data subjects were notified also affects how long the announcement stays published.
If the obligation is not fulfilled
Article 18 of Law No. 6698 provides for an administrative fine, with lower and upper limits set in the Law, for those who fail to fulfill the data security obligations in Article 12; this fine is applied to the data controller. Under a paragraph added to the same article in 2024, administrative fines imposed by the Board can be challenged before the administrative courts. For current amounts and an assessment of the specific case, we recommend consulting your legal counsel.
A working plan for the first 72 hours
The steps below are a general framework derived from the sources above; they should be adapted to the company's structure together with the legal and information-security teams.
- Hour 0 — open the record. Document the moment of detection, who detected it and the first findings. If the report came from a data processor, keep the letter or email received; the form asks for these as attachments.
- First hours — activate the plan. The legal, IT and communications leads defined in the response plan convene; whether the breach is still continuing and which systems are affected are determined.
- First day — map the scope. The affected data categories, whether special-category data is involved, the estimated number of people and records, and the groups of people concerned are determined. These headings match the second section of the form one to one.
- Before hour 72 — send the initial notification. If not all the information is complete, the Decision allows staged notification; the gaps are filled with a follow-up notification. The tracking number is kept in a secure place.
- Afterwards — inform people and close. Affected individuals are notified and this is documented, the measures taken are recorded, and the response plan is updated with the lessons from the incident.
Rehearsing these steps in a drill keeps the clock in a real incident from being used up on gathering information. The sections of the notification form can also serve as the skeleton of an internal incident record template.
Frequently asked questions
How many hours is the KVKK data breach notification deadline? Under Board Decision 2019/10, without delay and within 72 hours at the latest from the date the breach is learned of.
Is 72 hours business days or calendar hours? The text of the Decision says "72 hours" and makes no distinction for business days. It is therefore important to set up an on-call schedule that covers weekends and holidays.
If not all the information is available, should the notification wait? No. The Decision allows staged notification where the information cannot be provided all at once.
Does the data processor also notify the Board? Under the Decision, the data processor notifies the data controller of the breach without delay; the obligation to notify the Board rests with the data controller.
Conclusion
The Law says "as soon as possible," the Board interprets this as 72 hours, and this interpretation appears unchanged in the Authority's announcement from early 2026 as well. What changed was the 60-day limit on publishing breach announcements. From Orient Global's perspective, the most concrete step to make the pressure of the 72 hours manageable is to write the response plan before any breach occurs and to prepare an incident record template built on the sections of the notification form.
Why logistics experience matters here. The first-72-hours plan above will feel familiar to anyone who has run a warehouse or a distribution network. The Decision speaks of 72 hours without distinguishing business days, and logistics operations run through weekends, holidays and peak seasons, so an on-call schedule that covers every shift is already second nature there. Recording the exact moment of detection works like a timestamped scan at each handover; sending an initial notification and completing the gaps later follows the same logic as an exception report that is refined as the shipment moves; and rehearsing the plan is the contingency drill that well-run operations hold ahead of their busiest weeks. Delivery work also puts customers' names, addresses and phone numbers in the hands of carriers, depots and partners, which is one more reason to have the incident record template ready in advance. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations, large-scale distribution networks, and network and capacity planning at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and does not constitute legal or financial advice. For your own situation, consult an expert.
#interimmanagement #forwarddeployedengineering