KVKK technical measures: a 10-point checklist for small and mid-sized businesses

Most compliance projects under KVKK, Turkey’s data protection law, begin with the legal texts and end there. Yet Article 12 of the Law obliges the data controller to take the technical and organisational measures that ensure an appropriate level of security, and the Authority’s Personal Data Security Guide gives examples of those measures. Most of the fines issued after data breaches stem from exactly this heading.

A ten-point self-assessment of KVKK technical measures

• Is access to systems holding personal data made with individual accounts, and with no more permission than the job requires?
• Is multi-factor authentication mandatory for email, remote access and administrator accounts?
• Are a leaver’s accounts closed the same day, and is there a record of it?
• Are the disks of laptops and phones encrypted?
• Are backups encrypted, off site and tested for restore?
• Can you answer, from logs, who accessed which data and when?
• Are operating system and application updates applied regularly?
• Are the firewall, endpoint protection and email filtering up to date and monitored?
• Is data past its retention period really deleted from the systems?
• Is there a defined process that can notify the Authority within 72 hours of a breach being discovered?

How to read the result

More than three “no” answers mean there is a serious gap between compliance on paper and practice on the ground. We close that gap in a single project together with our partner law firm: the legal texts are theirs, the technical measures are ours. See our KVKK Data Protection Compliance page for details.

This article is for information only and does not constitute legal advice. It describes the regulatory framework in Turkey.