Protecting Personal Data and Corporate Information (KVKK)
Learn what constitutes personal data under KVKK, how to report a breach, and the essential rules for protecting corporate and personal data in daily workflows.
Why Does It Matter?
A customer's ID number, an employee's medical report, or a parent's phone number—all of these constitute personal data, and safeguarding them is a legal requirement.
Fundamentals
- Personal Data Protection Law No. 6698 (KVKK): Personal data refers to any information that identifies an individual directly or indirectly: name, phone number, email address, IP address, photo.
- Special categories of personal data (health records, biometric data, religion, trade union membership, etc.) require even stricter protection.
- Core principles: Lawfulness, explicit and legitimate purposes, data minimization and proportionality, accuracy, and retention only for the necessary period.
- Obligation to inform: When collecting data, individuals must be informed about who is processing their data, why, and for how long.
- Data breach: When personal data falls into unauthorized hands, it must be reported to the Personal Data Protection Board as soon as possible (within 72 hours under Board guidelines). Therefore, it is critical that employees report any suspected breach immediately.
- Corporate information: Proposals, pricing strategies, customer lists, and source code must also remain strictly confidential, even if they do not contain personal data.
Everyday risks: Sending an email to the wrong recipient, placing sensitive files in general shared folders instead of restricted ones, leaving printouts on desks, forwarding work documents to personal email or cloud storage, and exposing customer spreadsheets during screen sharing.
A Realistic Scenario
An HR employee sends candidate CVs via a group email with everyone added to the "CC" line instead of "BCC"; all candidates can now see each other's email addresses and CVs. A simple moment of carelessness instantly turns into a reportable data breach.
Best Practices
- Use "BCC" for bulk emails.
- Store personal data exclusively on corporate-approved systems.
- Lock your screen and clear your desk before stepping away; shred physical documents.
- If you suspect a breach, report it immediately without hesitation.
Key takeaway: Personal data is held in trust; you are not its owner.
*This article is part 10 of the 14-part Cybersecurity Awareness series.* Up next: Using AI tools securely