Organisational Measures

Article 12 of the KVKK requires controllers to take the necessary organisational measures alongside technical measures to secure personal data. Organisational measures govern the people, process and organisation side of security. In practice, a significant share of data breaches stem not from technical vulnerabilities but from employee errors and process gaps.

Main Organisational Measures

• Policies and procedures: Personal data processing, information security, retention and destruction policies and a breach response procedure,
• Training and awareness: Regular KVKK and information security training for employees,
• Confidentiality undertakings: Obtaining confidentiality undertakings from employees and suppliers,
• Contracts: Data processing agreements with processors containing data security provisions,
• Authorisation processes: Removing access rights on role changes and departures,
• Inventory: Keeping an up-to-date personal data inventory,
• Audits: Regular internal audits and remedying deficiencies found.

Audit Obligation

The controller must carry out or commission the audits necessary to ensure compliance with the KVKK within its organisation. Where data is processed on its behalf by another, it is jointly liable with the processor for taking measures.

Employees’ Confidentiality Obligation

Under the KVKK, employees of controllers and processors may not disclose personal data they learn or use it for purposes other than processing; this obligation continues after they leave. Reinforcing this obligation in employment contracts and training is a core part of organisational measures.