Law on the Protection of Personal Data No. 6698 — data security and breach notification

Art. 12(5) of the Law itself says only that a breach must be reported to the data subject and the Board 'in the shortest time' — no number. The operative deadline comes from Board Decision No. 2019/10, in which the Board fixed that as no later than 72 hours from becoming aware, with reasons required if that is missed. Read the two together: the citation a Turkish regulator will enforce against is the statute, but the timeline is regulator interpretation, and a reviewer should check whether later Board decisions have refined it. Foreign data controllers caught by the Board's practice of applying KVKK to processing of data about people in Turkiye owe this duty too, alongside the VERBIS registration and local-representative requirements described in the comprehensive-law entry.