Order No. (43) of 2022 on technical and organisational measures for personal data protection
Plain-English summary
Issued 17 March 2022 by the Minister of Justice, Islamic Affairs and Waqf under the Personal Data Protection Law. Lists protective measures (Art. 2), requires impact assessments in specified high-risk cases (Art. 3) and breach notification to the Authority within 72 hours (Art. 4). Takes effect the day after Official Gazette publication (Art. 9).
Article 4 of Order No. (43) of 2022 requires controllers to notify the Authority within 72 hours of discovering a breach, unless it will not affect data subjects' rights, and to document all breaches.
This site uses only the cookies it needs to work, such as keeping you logged in. It uses no advertising or tracking cookies.
Read the Cookie Notice.
Suggest a correction or addition
Spotted something wrong, missing or worth adding? Tell our editors. Every submission
is reviewed and verified against its source before anything changes — nothing you send appears on the
site automatically.
Thank you — our editors will review this
Your suggestion has been received. Contributions from practitioners keep these profiles accurate. Nothing appears on the site until an editor has verified it against its source.
