The Law on the Protection of Personal Data (“LPPD”) and its secondary legislation is a living law that is frequently updated since its effective date. Many procedures and principles related to data protection are determined not only by the Law, Regulation and Communiqué, but also by the Board Decisions, Principle Decisions and Board Decision Summaries. Therefore, our monthly bulletins aim to inform those concerned about the practices of the Personal Data Protection Board (“Board”) and to keep them up-to-date.

In December, only Data Breach Notification was published by the Personal Data Protection Board.

In December, the Board and the Union of Turkish Bar Associations signed a Protocol on Cooperation for the Protection of Personal Data. Within the scope of the cooperation protocol, it is planned to establish a coordination group, establish working groups and carry out activities in order to carry out joint work on the protection of personal data.


Article 12/5 of the LPPD titled “Obligations regarding data security” states that “In the event that the processed personal data is obtained by others through unlawful means, the data controller shall notify the relevant person and the Board as soon as possible. If necessary, the Board may announce this situation on its website or by any other method it deems appropriate.”

In December 2022, one data breach notification was published on the website of the Personal Data Protection Authority,

Sitil Çizgi İnşaat Turizm ve Tekstil A.Ş.

In summary, in the data breach notification submitted to the Board by the data controller; It was stated that the servers could not be accessed as a result of being subjected to a ransomware attack on 05.12.2022 and it is suspected that some personal data may leak, employees and customers were affected by the breach, but the number of relevant persons has not yet been determined, the personal data categories affected by the breach are identity, contact, personal, customer transaction information, and the relevant persons can get information about the data breach at