Both the Turkish Personal Data Protection Law (KVKK, Article 12) and the EU GDPR (Article 32) require organisations to take appropriate technical and organisational measures to protect personal data against unlawful processing and access. In practice, that means looking at IT infrastructure and internal processes together.
Organisational measures
- Data inventory: Know which personal data you hold, for what purpose, where and for how long.
- Policies: Prepare a retention and deletion policy, an access rights matrix and confidentiality commitments.
- Training: Train employees regularly on data protection and secure working.
- Processor agreements: Sign contracts with data security obligations with suppliers that process data for you.
- Registration duties: Check whether registration obligations (such as VERBİS in Türkiye) apply to you under current criteria.
Technical measures
- Access management: People should only access the data they need; leavers lose access immediately.
- Authentication: Use multi-factor authentication on critical systems.
- Encryption: Disk encryption on laptops, HTTPS and VPN for data in transit.
- Logging: Keep logs that show who accessed personal data and when.
- Patching and vulnerability management: Update systems regularly and scan for vulnerabilities.
- Backup: Back up data securely and test restores.
- Data minimisation: Do not collect data you do not need and delete data when its retention period ends.
If a breach happens
Under GDPR, a personal data breach must generally be reported to the supervisory authority within 72 hours; the Turkish Data Protection Board applies the same 72-hour expectation. Affected people must also be informed where required. To meet that deadline, an incident response plan defining who does what must be ready in advance.
Compliance is a process, not a project
Risks change as systems, people and suppliers change. An internal audit and security assessment at least once a year keeps measures up to date. For legal assessments, we recommend working with a data protection adviser or lawyer.
ujans supports the technical side of data protection compliance with access management, encryption, logging, backup and security assessments.