Access control, logging, backup and incident management are central to protecting personal data on the IT side. This article covers technical measures under KVKK alongside business processes.
Systems that hold personal data are not limited to HR or customer records; mailboxes, support tickets, accounting applications, camera recordings and cloud folders can fall within scope too. Technical measures on the IT side reduce the risk of this data being accessed without authorisation, lost, altered or shared with the wrong people. On their own, however, technical measures do not amount to compliance with Turkey's Personal Data Protection Law (KVKK); they need to be considered together with processes, administrative measures and legal assessment.
This article is for general information only. In practice, the legislation and the guidance of the Personal Data Protection Authority should be your reference, and you should consult a legal adviser where needed. The Authority's Personal Data Security Guide (Technical and Administrative Measures) and its Obligations Regarding Data Security page are good starting points (both in Turkish).
Start by making data flows visible
It is hard to set the right technical priorities without knowing which personal data sits in which application, who processes and accesses it, and how long it is kept. HR, sales, accounting, operations and IT can build a data inventory together. The aim is not to get every detail right first time, but to make the core systems holding personal data and the riskiest flows visible.
Also note whether data goes to external service providers, mobile devices or shared folders. Updating the inventory whenever a new application or integration goes live reduces blind spots later on.
Key areas of technical measures
Limit access rights
Access to personal data should be limited to what the job requires. Instead of giving everyone broad folder or application access, apply role-based permissions. Read, modify, delete and export rights are not the same thing; separate them where needed.
Review access when people join, change roles and leave. Keep admin accounts separate from everyday accounts. Shared accounts should be limited, because they make it hard to track who is actually using the access.
Authentication and password management
Strong, unique passwords, secure password storage and multi-factor authentication are the basic layers. Prioritise email, cloud applications, remote access and management consoles. Set up alerts for failed sign-in attempts and unusual sessions.
A password policy only works if employees can actually follow it. Personal accounts that remove the need to share passwords, and secure storage methods such as a company password manager, matter as much as the written rule.
Network and endpoint security
Firewalls, network segmentation, up-to-date endpoint protection and regular patching play a key role in protecting systems that process personal data. Separate the guest network from the business network, and limit access between servers, user devices and the management network to what is needed. Review internet-facing services and remote access points regularly.
Plan operating system and application updates on computers, servers and mobile devices. On devices that could be lost or stolen, enable screen lock, disk encryption and remote management options.
Logging, monitoring and incident management
Events such as access, permission changes, failed sign-ins and data exports should be logged in a way that suits the nature of the system. It should be clear where logs are kept, who can access them, how long they are retained and which alerts are reviewed. Rather than collecting as many logs as possible, it is more useful to build a meaningful logging set-up that is protected against tampering and actually reviewed.
For situations such as suspicious access, an email sent to the wrong recipient or a lost device, write down which channel employees should use, who must be informed and what the first technical steps are. These steps usually include preserving evidence, containing the affected account or device and informing the relevant teams. Depending on the circumstances, a legal and administrative assessment may also be needed.
Backup, recovery and deletion
Backup is part of data security as much as service continuity. Backups of critical data should be kept separately, access to them should be restricted, and restores should be tested regularly. Backups can contain personal data too, so the same access and protection approach should apply to them.
Deleting, destroying or anonymising data at the end of its retention period should be consistent with the policy and obligations the organisation has set. The technical method should be chosen to suit the system, and copies left in backups and exported files should be taken into account as well.
Manage suppliers and cloud services
For external services that process personal data, don't leave responsibility to the contract alone. Find out which users have access, how support access is opened, how data transfer and backup are arranged, and how you will get your data back when the service ends. Review admin access and shared accounts given to suppliers at regular intervals.
In cloud applications, check sharing links, external user invitations and publicly accessible folders regularly. When a user's business needs change, verify that their sharing has been updated too.
When buying a new application or connecting an existing system to another service, don't leave security until last. Ask about the access model, admin accounts, logging, data export, backup and the exit process before set-up; fixes made after a system goes live are more costly.
A practical starting plan
First choose the areas that are most critical in terms of personal data, and for each one map out the state of access, backup, updates and logging. When prioritising, consider the nature of the data, the number of people with access, the environment used and the potential severity of impact together; HR files and an internal report may not carry the same risk. Steps such as separate admin accounts, multi-factor authentication or closing forgotten leaver accounts can bring meaningful improvement in a short time.
Keep technical measures demonstrable and up to date
Technical measures are not a one-off project. Access lists, update records, restore tests and incident records help show that the measures are actually being applied. Store these documents with restricted access and without more personal data than necessary.
Staff changes, new remote working arrangements or retired applications should be reflected in the design of access, backup and logging. Small, regular reviews deliver more lasting results than a large checklist that can't be managed.
Checklist
- Systems holding personal data, data flows and their owners have been identified.
- Access is granted according to business need and reviewed regularly.
- Multi-factor authentication is used for email, cloud, remote access and admin accounts.
- Patching, network segmentation and endpoint protection processes are in operation.
- Access and critical activity logs are protected and reviewed.
- Responsibilities for incident reporting and first technical response are clear.
- Backups are protected and restores are tested regularly.
- The technical deletion or destruction method used for data past its retention period is reviewed.