Personal data breach at a hotel: the KVKK notification routine

A personal data breach is any incident where guest or staff personal data is exposed, lost or taken by people who should not have it. Article 12 of Law No. 6698 requires notice to the person and the Board as soon as possible; the Personal Data Protection Board's decision 2019/10 of 24.01.2019 reads that as 72 hours from learning of the breach. This article gives you the full KVKK data breach notification routine, step by step.

At 07:40 the front office manager discovers that a shared folder link holding last month's guest list has been open to anyone with the address since Friday. Nobody has been harmed yet. The hotel has just learned of a personal data breach, and a clock has started. After reading this article you will be able to decide whether an incident counts as a breach, run the first hours correctly, file the Board's form, inform the affected guests, and keep the record the law requires.

What counts as a personal data breach at a hotel?#

A breach is any event in which personal data is obtained, copied, lost, altered or exposed by people who should not have it, whether it was deliberate or a mistake, and whether or not anyone has been harmed yet.

The definition covers three kinds of failure. Confidentiality fails when someone sees data they should not have. Integrity fails when data is changed. Availability fails when data is lost, for example on a stolen reception laptop or through ransomware. Any one of the three is enough.

Hotel work produces breaches in ordinary ways. A printed arrival list left at the airport transfer desk. Passport scans emailed to the wrong guest. A booking-site extranet account taken over. One shared password for the whole front desk. A departing employee's personal cloud folder of guest records. Accidental breaches count: sending a file to the wrong address is a common hotel case, and it is still a breach. If account takeovers are your concern, read our piece on fake booking messages and extranet takeovers.

Not every incident is a reportable breach. A phishing email that a staff member reported and deleted before anyone signed in, with no data accessed, is an incident to record, not a breach to notify. The test is whether personal data was actually obtained, lost or exposed.

Data held for the hotel by a processor, such as a mailing provider or booking engine, is still the hotel's responsibility as controller. The processor must tell the hotel without delay, and the hotel carries the notification duty. The general manager owns the decision, taken with the adviser. Write the reasoning down either way, because the file that says "assessed, not a breach, because no data was accessed" is as valuable as a notification.

What does Turkish law require after a breach?#

Article 12 of Law No. 6698 requires the hotel to take technical and administrative measures, to be jointly responsible for anyone processing data on its behalf, and to notify the person and the Board as soon as possible when data is obtained by others unlawfully.

The article sets two duties that are often read as one: prevent unlawful processing and access, and, when prevention fails, notify. A hotel that notifies well but had no measures in place is still exposed. The law's phrase is "as soon as possible" (en kısa sürede). The Board's decision 2019/10 of 24.01.2019, announced on the Authority's site on 15.02.2019, reads that phrase as 72 hours from the date the controller learns of the breach, according to the Personal Data Protection Authority's announcement on breach notification procedures (opens in a new tab) (kvkk.gov.tr, 2026-11-04).

If a justified reason prevents notice within 72 hours, the reason is explained with the notice. The deadline is not a reason to send a wrong or empty form. The same decision requires the breach notification form, notice to affected persons within the shortest reasonable time, a breach record kept for the Board, and a response plan reviewed at regular intervals.

Article 9, as rewritten by Law No. 7499 in 2024, matters when the breach touches a transfer abroad, for example a mailing provider outside Türkiye: transfers rest on an adequacy decision or on appropriate safeguards such as a standard contract announced by the Board, which must be notified to the Authority within five business days of signing. The consolidated text is on the Presidency of the Republic's legislation system, mevzuat.gov.tr (opens in a new tab) (2026-11-01).

This is a summary for planning, not legal advice. Confirm dates, scope and your own case with a lawyer or your adviser before you file. For the wider duties around consent, staff access and retention, see our guide to KVKK for hotels.

When does the 72-hour clock start, and what happens in the first hours?#

It starts when the hotel learns of the breach, not when the breach happened, so the first hours go to containing the exposure and writing down what you already know.

Fix the moment of learning in writing: who saw it, at what time, in which time zone, and what exactly they saw. That timestamp anchors the whole file and is the only defensible answer to "when did you know".

Contain without destroying evidence. Revoke sessions, reset passwords, close the shared link, disable the account, and isolate an affected machine from the network rather than wiping it. Keep logs and screenshots before anything is cleaned.

Name one owner, usually the hotel's KVKK contact person, and one decision-maker, the general manager. Everyone else reports to those two, so the file has a single version of events. Call the adviser before drafting the form, not after. The same call decides whether the police, the insurer or the processor's incident team is involved.

Do not message guests in the first hour with guesses. The decision requires notice within the shortest reasonable time once affected people are identified, and a wrong first message is hard to correct. Keep a running log with times, decisions and who decided; it becomes the breach record and the basis of the Board form.

For the preventive side of this, see our hotel cybersecurity checklist for owners and general managers.

How do you notify the Board, and what does the form ask for?#

You notify the Board through the Kişisel Veri İhlal Bildirim Formu, without delay and within 72 hours of learning, and if you cannot answer every field you send what you have and complete it in stages.

The Board's form is built around the controller's identity, the breach and detection dates, the data categories, the number of people affected, the cause, the consequences, the measures taken and whether affected people were told; check the current form on kvkk.gov.tr before you file.

Prepare the numbers before you type. How many people, which data fields, which systems. A stated range with its counting method is better than a confident guess. Staged submission is allowed by the decision: send the first version, then add the rest without delay. Say in the file what is still missing and when it will arrive.

If 72 hours pass, notify anyway and explain the justified reason in the notice. A late, explained notice is a different file from silence. Keep the submitted version with its date, time and reference. The form is a legal statement, so the person who signs it should be the person who can stand behind the facts.

Do not describe the form as a formality. It is the document the Board will read first if it later asks questions, and it should match the guest message word for word on dates and numbers.

Will the Board publish your breach notice?#

Sometimes. Since Board decision 2025/2451 of 25.12.2025, breach notices sent to the Board are published on the Authority's website for a set period limited to 60 days, and the Board weighs several criteria before publishing at all, according to the Personal Data Protection Authority's public announcement of 20 January 2026 (opens in a new tab).

Before this change, notices sent to the Board were published on the Authority's site with no time limit. The Board now weighs the group and number of people affected, the nature and amount of the data, how the breach happened, the controller's sector, and whether the controller has notified the affected people.

Early removal exists: if the hotel documents that it informed affected persons within a shorter time, the notice is removed from the Authority's website. The practical consequence is that the speed and quality of your notice to guests is also your argument for early removal. Keep proof: send times, delivery reports and the exact text you used.

Publication is disclosure, not a penalty. Do not describe it as a fine, and do not promise a guest that nothing will appear publicly.

What should you tell the guests whose data was affected?#

Tell them directly, in plain language: what happened, which of their data was involved, what the hotel has done, what they should watch for, and whom to contact. Use your own website only when you cannot reach them.

The decision requires notice within the shortest reasonable time once the affected people are identified. Direct contact comes first; a notice on the hotel's own website is the fallback for people whose contact address cannot be reached.

The message needs five things: the period involved, the data categories, the cause in one sentence without blame, the measures taken, and what the guest should do, such as changing a password or treating messages that quote their stay with suspicion. Send individually, or with recipients hidden. A visible recipient list turns one breach into two.

Keep the guest message consistent with the Board form: same dates, same counts, same cause. Two versions of the same event is the fastest way to lose credibility with both the guest and the Board. Do not speculate about who did it and do not promise outcomes you do not control. Give a named contact and a phone number that a person actually answers. Log who was told, when and how; that log is the evidence you will need if you ask for early removal from the Authority's website.

What goes in the breach record, and what is the one-page incident sheet?#

The record holds what happened, its effects and the measures taken, kept ready for the Board to review; the one-page sheet is the version a duty manager can start at 03:00 without reading this article.

The record's fields: detection time and source, systems and data categories involved, number of people, cause, containment steps with times, notification dates to the Board and to individuals, measures to prevent recurrence, owner and review date. Keep it as a controlled document, not in a personal inbox. The decision also requires a breach response plan, reviewed at regular intervals, naming who reports internally and who is responsible for the legal notifications.

Fix the cause with the smallest structural change that removes the exposure: drop standing export rights, shorten retention so the data is not there to lose, separate guest-data folders from marketing folders, put two-step sign-in on the extranet. On retention periods, see our guide to how long a hotel should keep guest records.

Test the sheet once a year with a tabletop exercise: one invented scenario, 45 minutes, who does what, who calls whom. A plan nobody has walked through is a document, not a routine. The record is also how you answer the Board months later, and how you avoid repeating the same breach with a different file name.

What to do next#

Write the one-page incident sheet this week, name its owner and put the adviser's number on it. The article's logic runs in one line: decide whether it is a breach, start the clock at the moment you learned, contain and record, notify the Board with the form, tell the guests directly, then fix the cause so the record is never needed twice.