Public Announcement on the Publication Period of Personal Data Breach Notifications Published

The Public Announcement (Announcement) regarding the Decision of the Personal Data Protection Board (Board) dated 25.12.2025 and numbered 2025/2451 (Decision) was published on 20.01.2026.

Pursuant to the Personal Data Protection Law No. 6698 (Law), in cases where processed personal data is obtained by third parties through unlawful means, the data controller is required to notify the relevant data subject and the Board as soon as possible. In accordance with the Board’s decision dated 24.01.2019 and numbered 2019/10, data controllers are obliged to notify the Board without delay and at the latest within 72 hours from the date they become aware of the personal data breach and to inform the data subjects affected by the breach within a reasonable period as soon as possible, either directly or through appropriate alternative means.

Where deemed necessary, the Board may publish such data breaches on its website or through other methods it considers appropriate. Pursuant to the Announcement, when deciding whether personal data breach notifications will be published on the website of the Personal Data Protection Authority, criteria such as the nature of the breach, the manner in which it occurred, the group and number of affected data subjects, and the nature and scope of the affected personal data are taken into consideration.

Under the previous practice, such publications on the Authority’s website were not subject to any time limitation. However, with the Decision, it has been resolved that personal data breach notifications shall be published for a limited period of 60 days, and that where the data controller substantiates that notification has been made to the relevant data subjects within a shorter period, the relevant publication shall be removed from the website.