Kişisel Veri Güvenliği Rehberi (Teknik ve İdari Tedbirler)

Overview

This guide was published by the Personal Data Protection Authority (KVKK) in April 2025 as KVKK Publication No. 72. It describes the technical and administrative measures data controllers should take to meet the security obligation in Article 12 of Law No. 6698. The guide can be read freely on the Authority's website; copying and distribution require permission, so this library cites it only.

The guide treats administrative measures (Section 2) and technical measures (Section 3) separately, with summary tables in Section 4. The topics covered include risk identification, staff training, data minimisation, processor management, cyber security, monitoring, physical security of media and server rooms, cloud storage, system procurement and backups. The document thus turns the legal obligation into concrete control items. The summary tables make it easy to use the measures as a checklist.

For data centre design, the most directly relevant parts are those on physical security and the cloud. Physical environments holding personal data should be protected against external risks such as fire and flood, with controlled entry and exit. Servers, backup devices and media should be moved to a room with extra security, kept locked and have entry and exit logged.

For cloud storage, the controller is expected to assess the provider's security, encrypt the data, use separate keys per cloud service where possible and destroy keys when the service ends. Regular vulnerability scans and penetration tests, log collection and formal incident reporting procedures are also expected. The guide gives no measurable thresholds; the level of measures is set by risk analysis.

Key points

1. The guide separates administrative measures (Section 2) and technical measures (Section 3), with summary tables in Section 4.
2. Physical environments holding personal data should be protected against external risks such as fire and flood, with controlled entry and exit (3.3, p. 23).
3. Servers, backup devices and media should be moved to an extra-secure room, kept locked, with entry and exit logged (3.3, p. 24).
4. For cloud storage, the controller must assess provider security; data should be encrypted, with separate keys per service where possible, and keys destroyed when the service ends (3.4, pp. 25-26).
5. Regular vulnerability scans and penetration tests, log collection and formal incident reporting procedures are expected (3.2, p. 22).
6. The guide is dated April 2025 and published as KVKK Publication No. 72.
7. Related references: Law No. 6698 Article 12, ISO/IEC 27001, ISO/IEC 22237-6.

Using it in design

• When the 'personal data hosted' flag is set, require locked server rooms with access logging, fire and flood protection and segregated backup storage rooms in the layout checklist.
• Encrypt tenant data at rest with per-environment keys.
• Document key destruction when a contract ends.
• Include penetration testing, vulnerability scanning and log collection in operating procedures.

Who should read it

Engineers, security officers and compliance teams designing and operating data centres that hold personal data.

Related standards

• 6698 sayılı Kanun Madde 12
• ISO/IEC 27001
• ISO/IEC 22237-6

Publication details

Authors

Kişisel Verileri Koruma Kurumu (KVKK)

Publisher

Kişisel Verileri Koruma Kurumu (KVKK)

Year

2025

Document number

KVKK Yayınları No: 72

Document language

Turkish

Source type

Turkish regulation

Access

Free to read

Licence

Copyright retained; citation only — the publisher’s terms apply to the original document

Citation