Turkish Data Protection Authority fines global company for serious data breach
The Turkish Personal Data Protection Authority (KVKK) has imposed an administrative fine of 1 million Turkish Lira (TRY) on a global industrial company following a significant data breach.
The breach, which resulted in the theft of personal information belonging to 4,885 individuals, was caused by a ransomware attack and was reported to the KVKK a full 23 days after the incident occurred.
The KVKK, established under Turkey' s Personal Data Protection Law No.
6698, is responsible for ensuring compliance with privacy regulations within the country.
The law, which shares similarities with the EU’s General Data Protection Regulation (GDPR), requires businesses to protect personal data and report data breaches promptly.
This fine underscores the authority' s commitment to enforcing strict data security standards for all companies operating in Turkey, regardless of their size or international affiliation. According to the KVKK report, the security breach originated from an employee who downloaded a program from the internet, which resulted in the systems being infected with ransomware.
The attack led to unauthorised access to and theft of sensitive data.
The case highlights the significant risks associated with inadequate internal controls and a lack of cybersecurity training, even for large, globally operating corporations.
A crucial factor in the sanction was the company’s 23-day delay in notifying the KVKK of the breach.
Turkish data protection legislation, much like international standards, requires immediate notification to minimise potential harm to affected individuals and to enable swift countermeasures by the authorities.
Such a delay may indicate deficiencies in a company’s internal security incident response plans. This fine sends a clear signal to both domestic and international companies regarding the importance of prioritising robust data security and adhering to reporting obligations.
The KVKK’s actions demonstrate a proactive approach to data privacy, which may have significant implications for businesses that process personal data in Turkey.
It serves as a stark reminder that failure to comply with privacy legislation can result in significant financial and reputational consequences.
Source: Star
