Technical Measures

Also known as: Technical Security Measures, Information Security Controls, KVKK Article 12, Teknik Tedbirler

In short

Measures taken by the controller in information systems to secure personal data, such as access management, logging, encryption, firewalls, backups and penetration testing.

Article 12 of the KVKK requires controllers to take all necessary technical and organisational measures to ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. Technical measures are the information systems side of this obligation.

Main Technical Measures

The Board’s Personal Data Security Guide (Technical and Organisational Measures) highlights:

Authorisation matrix and access management: Each employee accessing only the data needed for their role,
Logging: Keeping and regularly reviewing access and activity logs,
Encryption and authentication: Encrypting data and multi-factor authentication,
Network security: Firewalls, malware protection and patch management,
Backups: Regular backups and backup security,
Testing: Penetration testing and vulnerability scanning,
Portable media: Security measures for portable storage and remote access,
Data masking: Pseudonymisation and masking in test and analytics environments.

Special Category Data

The adequate measures set by the Board for special categories of personal data must also be taken, chiefly storing such data using cryptographic methods, using secure transfer channels and logging access.

A Risk-Based Approach

The level of measures depends on the nature and volume of data processed, the processing environments and the harm a breach would cause data subjects. In a personal data breach, the Board’s first question is whether the necessary measures were taken. Breach of the data security obligation is subject to one of the highest administrative fines under the KVKK. The Cybersecurity Law that entered into force in 2025 also imposes additional obligations on institutions in critical sectors; see Cyber Incident.

Frequently Asked Questions

Who decides which technical measures we must take?

The KVKK requires an appropriate level of security without a definitive list. The Board's Personal Data Security Guide and the adequate measures set for special category data are the main benchmarks; company size, the nature of data processed and risks are also considered.

If we use a cloud service, is the provider responsible for technical measures?

No. The cloud provider is a data processor and the controller is jointly liable with it for taking measures. The provider's security measures should be secured by contract.

← Glossary A–Z