Lessons from Data Breaches in Türkiye in 2025: Incident Response and Notification
Adding up the numbers of people affected in different company announcements is not a reliable way to produce a single “2025 total” for data breaches in Türkiye. Announcements about the same…
What’s in this article?
Adding up the numbers of people affected in different company announcements is not a reliable way to produce a single “2025 total” for data breaches in Türkiye. Announcements about the same incident may be updated on different dates, their scope may change, and public notifications do not cover every breach. These factors can make such totals misleading.
This guide therefore does not present national or sector totals of affected people, or average breach detection times, that cannot be verified against publicly available official sources.
How to Interpret Data Breach Reports from 2025
The Turkish Personal Data Protection Authority publishes breaches selected for public disclosure in its Data Breach Notifications section.
For each incident, these announcements may identify:
- the data controller,
- the dates when the breach occurred and was detected,
- the scope of affected people or records,
- affected data categories
These details may be included in the announcement.
Simply adding up figures from the announcement archive should not be presented as a national data breach total.
72 Hours in KVKK
Under Board Decision 2019/10 of 24 January 2019, the controller must notify the Board without delay and no later than 72 hours after becoming aware of the breach.
Why Is the Time of Awareness Critical?
The date when the breach technically started and the date the data controller found out about the incident may not be the same.
The incident management system should record:
- The first alarm,
- The first confirmation,
- the time when the incident was recognised as a data breach,
- notification to the Board
Each step must have a separate timestamp.
Core Controls for Breach Response
Identity and Access
MFA, least privilege and regular reviews of authorised accounts are critical security layers.
Logging
There must be enough logs to understand when and how the event occurred.
Endpoint and Server Security
Unauthorized access signals must be monitored centrally.
Supplier Risk
A breach may originate with a SaaS provider, hosting service or another processor, rather than in the company’s own systems.
Notification to Affected Data Subjects
Notifying the Board and communicating with affected data subjects are separate processes.
Once the affected persons are identified, they must be informed by appropriate means as soon as reasonably possible.
Incident Register
Not every security incident is a data breach. Incident records should nevertheless be kept centrally.
| Field | Example |
|---|---|
| Incident time | First technical signal |
| Time of awareness | The moment the data breach is confirmed |
| Data categories | Contact, identity and transaction data, etc. |
| Affected system | CRM / SaaS / server |
| Action | Containment / notification / password reset |
A Sound Lesson from 2025
The sound conclusion is not a specific total of affected people. It is that organisations need to establish incident detection, escalation, technical evidence, notification and data subject communication processes in advance.
Data Breach Incident Response Checklist
- Are the incident response owners clearly identified?
- Can the time of awareness be evidenced?
- Is the 72-hour deadline tracked automatically?
- Are logs retained long enough?
- Are suppliers in the chain of escalation?
- Is there a notification template for affected data subjects?
- Is a post-incident review carried out?
The B10 Approach
B10 Digital Agency treats data breach management not merely as filling in notification forms, but as a shared workflow combining logging, security controls, a technical inventory and legal processes.
Official Sources
Conclusion
Data breach analysis should use official incident-specific notifications, a technical timeline and actual operational data rather than unverified totals.