A tourism company
- Country
- Turkey
- Fine
- 500,000 TRY
- Date
- 2019-08-27
- Sector
- Technical Sector
- Articles
- Article 12 and 18 of the DPL
Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA and the data subjects in the compulsory deadline
A database of the company has been leaked after a cyberattack. The details of the breach could not have been totally determined since the company failed to detect and analyse the breach. A penalty was issued based on the lack of sufficient technical and organisational measures and failure to notify the DPA and the affected data subjects in the compulsory deadline. Authority: Turkish Data Protection Authority (KVKK)
Source: https://www.kvkk.gov.tr/Icerik/5537/2019-255
Reported by: Mehmet Gün