A NEW ERA IN PUBLIC ANNOUNCEMENTS REGARDING PERSONAL DATA BREACHES: A 60-DAY TIME LIMIT

The Personal Data Protection Board (“Board”) has introduced a significant change in the procedures for public disclosure of personal data breach notifications by imposing a time limit on announcements published on its website. The Board’s decision dated 25 December 2025 and numbered 2025/2451 has paved the way for a new practice that is of close relevance to data controllers. 

Article 12(5) of the Law No. 6698 on the Protection of Personal Data (“KVKK”) stipulates that personal data breaches must be notified “as soon as possible,” and with the Board’s decision dated 24 January 2019 and numbered 2019/10, the phrase “as soon as possible” was interpreted as 72 hours. Pursuant to the same decision, once data controllers identify the data subjects affected by the relevant personal data breach, they are also required to notify the data subjects within a reasonable period as soon as possible, either directly if the contact details of the data subjects are available, or, if not, through methods such as an announcement on their website. 

In addition to these actions to be taken by the data controller, personal data breaches are also announced on the website of the Personal Data Protection Authority (“Authority”) in order to ensure that measures enabling the prevention or minimisation of potential adverse consequences for individuals arising from the breach are taken as promptly as possible. 

Under the previous practice, breach announcements published on the Authority’s website remained accessible without any time limitation. With the Board’s new decision, this practice has been revised. Accordingly, a maximum publication period of 60 days has now been introduced for personal data breach announcements that were previously published on the Authority’s website for an indefinite period without any time restriction. Furthermore, where the data controller evidences, before the expiry of this 60-day period, that it has notified the data subjects affected of the breach, it is possible for the relevant announcement to be removed from the Authority’s website at an earlier stage.

Authority’s announcement is available here: https://www.kvkk.gov.tr/Icerik/8595/kamuoyu-duyurusu