"If the firm that supplies our e-commerce infrastructure or software suffers a breach, who is responsible, and what should we do in the contract and when an incident occurs?" This question should be on the agenda of every company that entrusts a significant part of its operations to external providers. The breach announcements that the Kişisel Verileri Koruma Kurumu (KVKK, Türkiye's Personal Data Protection Authority) published in September 2026 show that the question is not theoretical.
One announcement dated 30 September 2026 states that the breach arose from an information-security incident in the systems of the data controller's e-commerce infrastructure service provider and was detected through the data processor's notification; the number of people affected is 3,642. Another announcement, dated 23 September 2026, reports that unauthorized access was gained to a server in the data processor's systems, that the breach was again learned of through the data processor's notification, and that 779 people were affected. The list contains nine announcements dated 30 September.
In this article we focus not on the technical response steps for an incident but on the legal and managerial side of the supplier relationship. For the technical response at the time of an incident, see our article on cyber breach and incident response.
The framework: how does the law allocate responsibility?
Law No. 6698 (Türkiye's Personal Data Protection Law, "the Law") defines two roles. The data controller is the party that determines the purposes and means of processing; the data processor is the natural or legal person who, on the basis of the authority given by the data controller, processes data on its behalf. According to KVKK's June 2025 guide, a cloud service provider that cannot use the data for its own purposes under the contract has the status of a data processor. Firms that provide e-commerce infrastructure, hosting or software services are also in this position in most scenarios; the precise characterization must be made according to the content of the relationship.
Article 12 of the Law, titled "Obligations concerning data security," is decisive in this relationship:
- Duty to take measures (paragraph 1): The data controller must take the necessary technical and administrative measures to prevent unlawful processing of and access to data and to ensure its safekeeping.
- Joint responsibility (paragraph 2): If data is processed by another person on behalf of the data controller, the data controller is jointly responsible with that person for taking these measures. KVKK therefore stresses that data processors, too, are under an obligation to take measures.
- Audit (paragraph 3): The data controller must carry out the audits necessary to ensure the Law is applied, or have them carried out.
- Notification (paragraph 5): If data is obtained by others through unlawful means, the data controller notifies the person concerned as soon as possible and notifies the Personal Data Protection Board (Kurul, "the Board"); the Board may make the situation public if necessary.
In short, even if the incident occurs in the supplier's system, the text of the Law places the notification obligation on the data controller. In addition, Article 18 of the Law provides for an administrative fine for those who fail to fulfill the data security obligations in Article 12.
The 72-hour rule and the supplier's role
By its decision of 24 January 2019, no. 2019/10, the Board interpreted the phrase "as soon as possible." Accordingly, the data controller must notify the Board without delay and within 72 hours at the latest from the date it learns of the breach. The provisions of the decision that stand out for the supplier relationship are as follows:
- If data is obtained by others while held by the data processor, the data processor must notify the data controller without delay.
- Once the affected persons have been identified, they too must be notified as soon as reasonably possible, with direct notification where possible.
- If the 72 hours are exceeded for a justified reason, the reasons for the delay must be explained; if the information on the form cannot be provided all at once, it may be submitted in stages.
- Information about the breach, its effects and the measures taken must be recorded; a data breach response plan that is reviewed regularly must be prepared.
The practical weak point is this: the 72-hour period runs from the moment the data controller learns of the breach. Since the breaches in the September announcements were learned of through the data processor's notification, how quickly and in how much detail the supplier reports directly affects whether the company can meet its own obligation on time.
There is also an update on the publication side. According to KVKK's announcement of 20 January 2026, the Board, by its decision no. 2025/2451, limited the publication of breach notices to 60 days; if it is documented that the persons concerned were notified earlier, the published notice can be taken down sooner. This makes prompt, documented notification to affected persons important from a reputational standpoint as well.
A practical path: a checklist for the contract and for the moment of an incident
The items below are a general framework derived from the sources above; each company should adapt them, together with its legal team, to its own contract structure and sector.
At the contract stage
- Put the role in writing. Define what data the supplier processes, for what purpose and on whose instructions. The KVKK guide states that, through a data processing agreement, a data controller may leave decision-making authority to the data processor on matters such as the details of security measures; the limit of that authority should be clear in the contract.
- Fit the notification period inside the 72 hours. Write down within what time frame, through which channel and with what minimum information (affected data categories, an estimate of the number of people, the start of the incident) the supplier will report a suspected incident to you.
- Define the measures and the audit. Because of the joint responsibility, document the technical and administrative measures the supplier has taken; add to the contract your right to audit, to request reports and to obtain information.
- Cover subcontractors. Clarify whether the supplier has the data processed by another firm and, if so, how the same obligations will be passed on.
- Add record-keeping and cooperation obligations. The preservation of records after an incident, support for the information to be provided to the Board, and coordination in communications should be in the contract.
At the moment of an incident
- Record the time. Document the moment the first notification arrived from the supplier; the 72-hour calculation will rest on this record.
- Activate the response plan. Those responsible who are defined in the plan envisaged by the Board's decision (legal, IT, communications) should convene immediately.
- Gather information in stages. Start preparing the notification without waiting for every detail; missing information can be completed later.
- Identify and inform affected persons. If direct communication is possible, prefer it; document that the notification has been made.
- Assess the aftermath. When the incident is closed, review the contract, the supplier selection criteria and the response plan.
Conclusion
The September 2026 announcements show concretely that a breach can start not only in a company's own systems but also at the provider whose services it uses. In this situation, Article 12 of Law No. 6698 shares the responsibility, but leaves the obligation to notify the Board and the persons concerned with the data controller. The supplier relationship is therefore not a text that is signed at the purchasing stage and forgotten, but a risk area that has to be managed together with the notification period, the right to audit and the response plan.
From Orient Global's perspective, a calm and workable first step is to compile an inventory of the suppliers that process personal data and to check the notification period and the communication channel for each one.
Why logistics experience matters here. A logistics or distribution business runs on third parties: carriers, warehouse operators, e-commerce platforms and software providers, which often hold customer names, addresses and phone numbers on its behalf. Managing such a network is a daily discipline: a service-level agreement that sets how quickly an exception must be reported and through which channel, a right to audit each partner, clarity on which subcontractor handles which leg, and a dated record of every handover. The contract checklist above asks the same of a data supplier. One of Orient Global's consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations and large-scale distribution networks at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is for general information purposes only and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering