• Pursuant to Article 12 of the Law The data controller is obliged to take all necessary technical and organizational measures to provide an appropriate level of security for the purposes of:
  a) preventing unlawful processing of personal data,
  b) preventing unlawful access to personal data,
  c) ensuring protection of personal data.
• The Board has power to take regulatory action in order to determine security requirements. Additional measures may be taken according to the nature of the sector-specific processed data by taking into account the minimum criteria determined by the Board.
• In case the processing of personal data is carried out by another natural or legal person on behalf of the data controller, the data controller shall jointly be responsible with these persons for taking the measures. Therefore, the data processors are also obliged to take measures to ensure data security. For example, if the records of the data controller’s company are held by an accounting company (data processor), the controller shall jointly be responsible with the accounting company for taking the measures regarding the processing of the data.
• The data controller shall be obliged to carry out the necessary audits, or have them made, in /its own institution or organization, in order to ensure the implementation of the provisions of the Law
• The data controllers and the data processors shall not disclose the personal data that they have obtained to anyone contrary to the provisions of this Law, neither shall they use such data for purposes other than that for which the personal data have been processed. This obligation shall continue even after the end of their term of office.
• In case the processed data are obtained by others by unlawful means, the data controller shall communicate the breach to the data subject and notify to the Board within the shortest time. The Board in Decision No. 2019/10 of 24.01.2019 interpreted the provision of “the shortest time” in Article 12 (5) of the Law (In case the processed data are obtained by others by unlawful means, the data controller shall communicate the breach to the data subject and notify to the Board within the shortest time…) as 72 hours and within this scope the data controller shall notify the Board without delay and not later than 72 hours after having become aware of the breach.
• Where such notification cannot be achieved within 72 hours, the reasons for the delay should be attached to the notification to be made to the Board without undue further delay.
• The following “Personal Data Breach Notification Form” shall be used in the notification to the Board.
• For data breach notification the following link shall be used.
• Where necessary, the Board may announce such breach on its official website or through in any other way it deems appropriate.
• The appropriate measures to be taken regarding data security should be in accordance with the structure, activities and risks of each data controller. For this reason, a single model for data security cannot be envisaged. In determining the appropriate measures, the nature of the work performed by the data controller and the personal data protected are important as well as the size and turnover of the company
• Adequate measures determined by the Board shall be also taken while processing the special categories of personal data

Personal Data Security Guide has been prepared by the Personal Data Protection Board in order to provide clarity in practice and to create good practice examples for the technical and organisational measures that the data controller responsible for during the processing of personal data.