Law note · Turkey

Personal Data Protection Law (KVKK), breach notification

cite Law No. 6698, Art. 12(5) stage IN FORCE in force since 2016-04-07 kind Breach notification binds public and private bodies reviewed 2026-08-29

What it requires

An app that suffers unlawful acquisition of personal data belonging to a person in Turkey must notify the affected data subject and the Board within the shortest time; KVKK sets no fixed numeric deadline in its own text.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

What we found

Art. 12(5) requires a controller to notify the affected data subject and the Board within the shortest time where personal data has been obtained unlawfully by others; the Board may make the breach public. KVKK's own text sets no numeric deadline. Any numeric standard would sit in KVKK Board secondary guidance, which was not read for this document.

Primary source

official statute text, KVKK Kurumu consolidated English translation

← Back to the example · Lint your app →