Product Liability & Certification
CISG and the Turkish Law
The provisions of CISG are applied before other international law legislations and the parties can bring their international trade disputes before Turkish judicial authorities.
A cyber breach usually begins as a technical event, but the decisions made in the first hours shape its legal consequences. This checklist summarises what organisations should watch in the first days.
1. Contain the incident without destroying evidence
Rapidly shutting down or rebuilding systems can wipe logs that are critical for forensics. Technical teams and legal counsel should coordinate, and logs, images and network records should be preserved unaltered.
2. Map your notification duties
Where personal data is affected, the Turkish Personal Data Protection Board must be notified as soon as possible and within 72 hours of learning of the breach. Also assess separately:
- USOM notification: for Corporate Cyber Incident Response Teams (SOME) and critical infrastructure operators, reporting cyber incidents to the National Cyber Incident Response Center (USOM) “without delay / immediately” is essential; depending on the criticality of the incident, the initial notification or early warning is made within the first 24 hours,
- notification to affected data subjects,
- notification to sector regulators (e.g. finance or health),
- notification periods under the laws of other countries where you operate.
3. Protect privilege
Having the forensic review directed by counsel supports the protection of work product. Avoid discussing the incident in broadly distributed emails.
4. Run communications from a single point
Messages to employees, customers, press and regulators must be consistent. Statements that prove inaccurate or unverified can become evidence against you later.
5. Contractual and insurance notices
Cyber insurance policies and supplier contracts often contain short notice windows. Missing them can jeopardise coverage.
6. The ransom decision
Paying a ransom is a separate legal decision that requires weighing sanctions, anti-money-laundering and criminal-liability risks. It should be taken at senior management level and documented.
This article is for general information only and does not constitute legal advice.
This article is for general information only and does not constitute legal advice.
