KVKK Technical Measures Checklist: A Self-Check for Personal Data Security in Turkey

Article 12 of Turkey’s Personal Data Protection Law No. 6698 (KVKK) requires data controllers to take all necessary technical and administrative measures to keep personal data secure. This tool turns KVKK technical measures into a 15-item KVKK compliance checklist based on the Personal Data Protection Authority’s own guide. You mark each item Yes, Partly or No; the tool calculates a weighted score and lists the gaps in order of importance.

Your answers stay in your browser and are not sent to any server. The result is a self-check: it is not legal advice, and it is not a compliance audit or certification.

What are KVKK technical measures?

Technical measures are the security controls in your IT systems that prevent unauthorized access, unlawful processing and loss of personal data. Their legal basis is Article 12 of Law No. 6698.

Article 12 asks the data controller to ensure an appropriate level of security for three purposes: preventing unlawful processing, preventing unlawful access and safeguarding the data (Law No. 6698, Article 12, in Turkish). The law names no specific products; measures should fit the organization’s structure, activities and the sensitivity of the data it processes.

The Authority’s main reference is its Personal Data Security Guide (Technical and Administrative Measures), whose current edition is dated April 2025. Its technical measures summary table covers the authorization matrix, access logs, user account management, network and application security, encryption, penetration testing, intrusion detection and prevention, data masking, data loss prevention, backups, firewalls, up-to-date anti-virus, deletion and anonymization, and key management. The 15 items in this tool group those headings into practical checks; key management, a separate row in Table 4.1, has its own item.

Technical vs administrative measures

Technical measures are controls that run in your systems; administrative measures are the policies, contracts and processes that govern them. This checklist only scores the technical side.

The guide’s administrative table lists items such as a personal data processing inventory, corporate policies, contracts with data processors, confidentiality undertakings, risk analysis, training and awareness, and registration with VERBİS, the data controllers’ registry. None of these are scored here. The two sides still depend on each other: an authorization matrix is a technical control, but an administrative access policy decides who needs which data and why.

How to use the checklist

For each item choose Yes (1), Partly (0.5) or No (0); each answer is multiplied by the item’s weight of 1 to 3 and the total is converted to a score from 0 to 100; the total weight of all 15 items is 31. The authorization matrix, passwords and MFA, access logs, encryption and backups carry the highest weight of 3.

A score below 50 is shown as low, 50 to 79 as medium, and 80 or above as high. Gaps are listed by weight, each with a short recommendation and a link to a related service. The “Print / save as PDF” button prints only the checklist with your answers, a useful internal record.

Answer each item together with the person responsible for that system. If a control is believed to exist but there is no record showing it works, mark it Partly.

What evidence should you keep for each item?

A measure counts when you can show a record of it. The table below lists the 15 items and the typical evidence worth keeping for each.

Item (weight)	Evidence to keep
Authorization matrix and need-based access (3)	Current authorization matrix, periodic access review records
Strong passwords and MFA (3)	Password policy settings, MFA coverage list, records of leaver accounts being disabled
Access and activity logs (3)	List of log sources, retention setting, sample log output
Network security (2)	Firewall rule review, network segmentation diagram, remote access (VPN) configuration
Encryption in transit and at rest (3)	TLS settings, disk and database encryption settings, where keys are stored and who holds them
Encryption key management (2)	Key inventory, list of accounts with key access, rotation records, key destruction plan for when a cloud service ends
Malware protection and patch management (2)	Agent coverage report, patch compliance report
Intrusion detection/prevention and event monitoring (2)	IDS/IPS and monitoring rule list, alert review records
Penetration testing and vulnerability scanning (2)	Pentest report, remediation tracking, scan reports
Secure backups with restricted access (3)	Backup policy, record of the off-network copy, restore test records, list of accounts with backup access
Application security (1)	Software version inventory, secure configuration review
Data loss prevention and removable media (1)	DLP or USB restriction policy, exception list
Data masking and anonymization (1)	Test environment masking rules, anonymized reporting samples
Deletion and destruction process (2)	Retention and destruction policy, periodic destruction records
Physical security of server rooms and storage media (1)	Entry logs, authorized staff list, records of storage removed before devices go for repair

How to prioritize the gaps

Start with high-weight items marked No, because they directly affect unauthorized access and data loss. The tool lists gaps in this order.

In practice three groups stand out. On identity and access, MFA, an authorization matrix and prompt removal of leaver accounts can be put in place quickly. On visibility, without access logs and event monitoring you cannot tell when or how a breach happened; SIEM and log management addresses this. On resilience, backups need to sit outside the production network with restricted access and tested restores, and our KVKK data backup guide covers the details.

Items marked Partly are often the quickest wins: the control exists, but its coverage is incomplete or nobody keeps a record. The guide recommends regular vulnerability scans and penetration tests, and a penetration testing report doubles as evidence in the table above.

Breach notification and technical measures

Technical measures make it possible both to prevent a breach and to report it on time. Article 12(5) requires the data controller to notify the data subject and the Board “in the shortest time” when personal data is obtained by others through unlawful means.

The Personal Data Protection Board’s decision 2019/10 of 24 January 2019 sets the expectation that the Board is notified without delay and at the latest within 72 hours of the controller becoming aware of the breach (KVKK, data breach notification, in Turkish). Without access logs and incident records, scoping a breach within that window is very hard. The guide also recommends collecting and securely storing evidence when incidents occur.

Common mistakes

The most common mistake is assuming one security product completes the job. The guide itself notes that the view that a single product delivers full security is not always correct.

1. Collecting logs nobody reviews: records exist, but alerts go unread and retention is undefined.
2. Storing encryption keys next to the data: if keys are not kept separately under restricted access, encryption loses its value.
3. Keeping backups on the production network: ransomware can reach the backups along with live data.
4. Disabling leaver accounts late: old accounts are one of the easiest paths to unauthorized access.
5. Copying real data into test environments: without masking, production protections do not carry over.
6. Leaving destruction on paper: a retention and destruction policy exists, but no destruction records do.

KVKK security consulting at MAV Cloud

MAV Cloud reviews the technical items in this checklist and helps close the gaps through its KVKK security consulting service. The work moves from a review of current systems to evidence collection and a prioritized action plan.

MAV Cloud is certified to ISO/IEC 27001 for information security management and ISO/IEC 27701 for privacy information management, as well as ISO 22301, ISO/IEC 20000 and ISO 9001 (see our certifications).

MAV Cloud’s backup storage is located in Türkiye. This is a description of our service, not a claim about legal requirements; where data is kept and any transfer abroad should be assessed separately, including sector-specific rules.

First response time matters during a security incident. The first-response targets in MAV Cloud’s service level agreement are 15 minutes for critical, 1 hour for high, 4 hours for medium and 1 business day for low priority.

Frequently Asked Questions

Is there a mandatory format for KVKK security requirements?

No. The Authority’s guide explains measures through example headings, and its page on data security obligations states that no single model can be prescribed. Suitable measures depend on the organization’s risks and the data it processes.

Does a high score mean we are KVKK compliant?

No. The score only reflects a self-check of technical measures; it does not cover administrative measures, lawful processing conditions or the duty to inform. It is not legal advice.

How often should the checklist be completed?

At least once a year and after major system changes is a sensible routine. Comparing printouts shows progress.

Who is responsible for technical measures when we use a cloud provider?

When personal data is processed by another party on the controller’s behalf, the law makes the controller jointly responsible with that party for the measures. The guide also says the controller should assess whether the cloud provider’s security measures are adequate.

Are my answers stored anywhere?

No. Answers stay in your browser and are not sent to a server. If you need a record, use the print button to save a PDF.