Incident guide
Suspected personal data breach (data controllers)
Your organisation suspects that personal data was accessed, lost or sent to the wrong people, and the notification clock may be running.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- A device or account that held personal data was lost or compromised.
- A message with personal data went to the wrong recipients.
- A supplier tells you it was breached and it holds your customers' or staff's data.
- Your data appears for sale or posted somewhere.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not delay the decision to notify while you wait for every detail. The 72 hours run from the moment you learn of the breach.
- Do not delete logs, messages or data that show what happened.
- Do not pay or negotiate with whoever holds the data without advice.
- Do not speak publicly about it before management and your adviser agree on what to say.
Keep as evidence
- The date and time you learned of the breach, and who told you.
- System and access logs for the period, copied before anything is changed.
- The list of data types, systems and approximate number of people affected.
- Your decisions and the reasons for them, and correspondence with suppliers.
Where to report
Anywhere
Your IT contact or provider
When: Right away.
How: Tell them before systems are changed, and ask for the logs to be preserved.
In Turkey
Personal Data Protection Board (KVKK)
When: Within 72 hours of learning of the breach.
How: A data controller notifies the Board without delay and within 72 hours at most of learning of the breach. If it is late, the reason for the delay goes into the notification (Board Decision 2019/10).
Siber Güvenlik Başkanlığı (USOM services)
When: When you can, if the breach came from a cyber attack.
How: Use the cyber incident report and malicious link services on siberguvenlik.gov.tr.
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If a crime was committed and you want it investigated.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.