Cyber incident response must coordinate evidence preservation and duties under Law No. 7545, KVKK, criminal law, sector rules and contracts on separate timelines.
Preserve evidence in the first hours
While isolating affected systems, keep logs, alerts, timestamps, images and every intervention in an immutable incident record. An immediate reset may destroy evidence needed for investigation, insurance or litigation.
Map notification duties
Cybersecurity, sector, KVKK and contractual notices do not share one trigger or deadline. Identify affected systems, data, people and services, then record a separate decision for each possible recipient.
Criminal and contractual tracks
Unauthorised access, data interference, fraud or extortion may require a criminal-law assessment. Supplier fault, service levels, backups, security promises and liability caps form a separate contractual analysis.
Post-incident remediation
Review root cause, privileges, patching, backups and third-party dependencies. The report should record not only technical findings, but also decision times, legal grounds, measures and residual risks.
Relevant legislation and official sources
General legal information. Applicable law, jurisdiction, deadlines and remedies depend on the facts and current official texts; no outcome is guaranteed.
Content is for general information and is not personal legal advice. Contact alone does not establish a lawyer-client relationship.
Related practice areasIT & Technology Law