KVKK (Law No. 6698): Information Security and Technical Measures for Businesses
Turkey's Personal Data Protection Law No. 6698 (KVKK) concerns every business that processes personal data of customers, employees and suppliers. Article 12 requires data controllers to take technical and organisational measures to ensure an appropriate level of security.
Technical measures on the IT side
- Access control: each user reaches only the data needed for their job, with personal accounts and strong passwords,
- Firewall and network separation,
- Up-to-date software and antivirus,
- Backups: regular, automatic backups to a separate location, with tested restores,
- Encryption: laptop disks, removable media and remote access (VPN),
- Logging of server and network access,
- Server room security with locked racks.
If a breach occurs
The data controller must notify the data subject and the Personal Data Protection Board as soon as possible; logging and monitoring help detect breaches quickly.
KVKK-ready IT infrastructure with Artun Bilişim
We set up servers, user and permission structures, firewalls, backups and virtualization. See our Server Installation and Firewall services or request a quote.
This article is for general information only and is not legal advice. Regulations can change; check the Official Gazette and the relevant authorities for current rules.