There was a leak in our customer database, we have to report to the privacy board — how many days do we have?

Hasan K***4 months ago·27 messages·3.2K views#data #violation #privacy

Job title: Sales Manager
Sector: Healthcare services
Organization type: chain store
Joined: Sep 2024
Message: 404

4 months ago#1

The other day our IT manager said 'there was a leak in the customer database'. Panic started immediately. Legal said 'you have to report to the Privacy Board'. How many days do we have? Who is going to do this?

our db has email, phone, and home address for 5000 customers. idk if the leak exposed all their full names. how long do i have to notify the board? will a fine be enough?

there's no map on the customer side, what happens if someone starts posting 'data leak' on twitter? what if it leaks to the press? how do we manage this?

Ali Y***Member

Job title: Site Manager
Sector: E-commerce
Organization type: 40-person manufacturing company
Joined: Jan 2024
Message: 129

4 months agoMost Helpful#2

the legal framework for data breach notification is defined in KVKK. briefly: you must notify the Privacy Board within 72 hours of becoming aware of the leak.

as for customers, you are only obligated to notify them without delay if the data leak poses a 'high risk'.

the person making the notification: ideally it should be the Data Protection Officer (DPO); if not, legal counsel can do it. make the notification in writing (email + document).

Necati A***MemberCommunity member

Joined: Jan 2025
Message: 5

4 months ago#3

72 hours? seems too short, how are we gonna manage to investigate in time?

Taner Y***Expert

Job title: Regional Manager
Sector: Electrical-electronics
Organization type: cooperative
Joined: Sep 2025
Message: 3

Doki · Vulnerability scanning · 2025

4 months ago#4

do we have to write to each of the 5000 customeers separately or is a site announcement enough? edit: site announcement is enough but notify your insurance too

Zehra D***Expert

Job title: Administrative manager
Sector: Electrical-electronics
Organization type: two-branch business
Joined: Jul 2024
Message: 343

4 months ago#5

first things to do right now: 1) tell IT to 'find the extent of the leak within 24 hours', 2) notify the lawyer, 3) tell the company's Data Protection Officer. 72 hours is 3 days, move fast!

Kaan Y***Member

Job title: Social media manager
Sector: Furniture manufacturing
Organization type: two-branch business
Joined: Jun 2025
Message: 84

4 months ago#6

besides the 72-hour window who else should know about the leak? if there's no buzz on twitter, are we just not gonna investigate?

Volkan A***Expert

Job title: Operations director
Sector: Jewelry
Organization type: cooperative
Joined: Nov 2022
Message: 314

3 months ago#7

go to the Privacy Board's website and find the 'data breach notification' section. there's a form there, fill it out. it clearly states which fields are mandatory and which are optional.