PDPL amendments entered into force
On 1 June 2024 amendments to the Personal Data Protection Law (“PDPL”) entered into force. The reforms expanded conditions for the processing of special categories of personal data; introduced alternative rules on data transfer abroad; and introduced the administrative court as the appeal mechanism against fines. In addition, an administrative fine was stipulated for failing to notify the Board within 5 business days of standard contracts regarding the transfer of personal data abroad.
You can read our latest short article on this issue here.
Crypto hacker attack
A Turkish crypto asset service provider was targeted by hackers. The company announced that hot wallets related to ten currencies were affected, but that most assets were secure in cold wallets. The company, which has not yet provided details about the breach, advised platform users to use strong passwords, activate identity confirmation methods, and report suspicious activity without delay.
National data protection authorities meet in Istanbul
On 6 June 2024, a consultation meeting was held in Istanbul with the participation of representatives from the data protection authorities of Turkey, Azerbaijan, Algeria, Morocco, Qatar, Malaysia and Mali. The establishment of a strong communication mechanism between data protection authorities, the realization of safe country studies, and the importance of information exchanges were among the topics of discussion.
The DPA announced the following data breach notifications in June:
| Data Controller (and sector) | Affected Data Subjects | Affected Personal Data | Number of Data Subjects |
| Karakaya (food) | employees, users, customers | identity, communication, location, personal data, customer transaction, transaction security, risk management, finance, marketing, audiovisual records, racial and ethnic origin, health data, criminal convictions and security measures | 200 |
