Data breach and its consequences in aspect of KVKK and GDPR

Personal data protection law is an important topic that is constantly on the agenda as the use of technology has become an inseparable part of daily life. This has led to the introduction of regulations regarding the personal data to be processed: The Personal Data Protection Law No. 6698 entered into force on 24.03.2016. On 25.05.2018, the General Data Protection Regulation entered into force to be implemented within the borders of the European Union. In this study, the obligation to ensure data security, which is one of the main obligations of the data controller pursuant to the Personal Data Protection Regulation and the General Data Protection Regulation, will be examined and the obligation to notify the relevant Data Protection Board and the relevant persons in case of data security breach will be emphasized. The study consists of three parts. In the first part, the basic concepts of personal data protection law are examined in a limited manner in terms of their relevance to the subject of the thesis. In the second part, the concept of data security and the obligation of the data controller to ensure data security are examined in the light of the Personal Data Protection Law, all other relevant legislation and GDPR. In the third part, the concept of data security breach is examined, the obligation of notification as a result of data security is emphasized and a comparative evaluation is made. Keywords: Personal Data Protection Law, General Data Protection Regulation (GDPR), data security, data security breach, notification to the Personal Data Protection Board in case of data security breach, notification to data subjects. Numeric Code of the Field: 54001