Breach Notification and DPIAs

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access to personal data.

It is broader than a hack. A lost laptop, a misaddressed email, ransomware that encrypts (loses availability of) personal data, or an exposed S3 bucket all qualify.

Breaches map to the three security pillars:

• Confidentiality breach: unauthorized disclosure or access
• Integrity breach: unauthorized alteration
• Availability breach: loss or destruction (e.g., ransomware)

Recognizing that availability loss is also a reportable breach is a common blind spot.

Under GDPR, a controller must notify the supervisory authority of a notifiable breach without undue delay and within 72 hours of becoming aware, where feasible.

KVKK requires notifying the KVKK Board as soon as possible (the Board has specified short timeframes). The clock starts at awareness, so detection and triage speed are critical.

Not every breach must be reported to the regulator. GDPR ties it to risk to individuals:

• Notify the authority unless the breach is unlikely to result in risk to rights and freedoms
• Notify the data subjects when the breach is likely to result in high risk

Strong encryption of the exposed data can lower the risk and may remove the obligation to notify individuals.

A breach notification to the regulator should describe:

• The nature of the breach and categories/approximate number of people and records affected
• Likely consequences
• Measures taken or proposed to address it and mitigate harm
• Contact point (DPO or equivalent)

If full detail is not yet available, provide it in phases rather than missing the deadline.

An effective breach process is rehearsed in advance:

• Detect and contain
• Assess scope and risk to individuals
• Notify regulator and, if high risk, data subjects
• Remediate root cause
• Document everything in a breach register

Even non-notifiable breaches must be logged internally under GDPR accountability.

When individuals must be told, communication should be in clear, plain language: what happened, what data, likely consequences, what you are doing, and what they should do (e.g., reset passwords, watch for phishing).

Avoid downplaying the incident. Transparent, prompt notification preserves trust; cover-ups multiply regulatory and reputational damage.

A Data Protection Impact Assessment (DPIA) is a structured process to identify and reduce privacy risks before starting high-risk processing.

It shifts privacy left: instead of reacting to breaches, you assess and mitigate risk at the design stage. KVKK has an analogous risk-assessment expectation.

GDPR mandates a DPIA when processing is likely high risk, especially:

• Systematic, extensive profiling with significant effects
• Large-scale processing of special-category data
• Systematic monitoring of a public area
• New technologies with uncertain impact (e.g., AI, biometrics)

A DPIA typically:

• Describes the processing and its purpose
• Assesses necessity and proportionality
• Identifies risks to individuals
• Defines mitigations (minimization, encryption, access control)

If high residual risk remains after mitigation, the controller must consult the supervisory authority before proceeding.

When a processor suffers a breach, it must notify the controller without undue delay, because only the controller reports to the regulator and owns the 72-hour clock.

Contracts (the DPA) must specify rapid breach reporting from processors. A slow vendor can consume the controller's entire notification window, so monitoring and contractual SLAs matter.

Test your understanding of breach timelines.

You completed breach response and risk assessment:

• A breach covers loss of confidentiality, integrity, or availability
• GDPR's 72-hour notification clock starts at awareness
• Notify individuals when risk is high; encryption can reduce obligations
• Run a rehearsed detect-contain-assess-notify-remediate-document workflow
• DPIAs assess and mitigate high-risk processing before it starts

You can now respond to incidents and proactively manage privacy risk.