KVKK Technical Measures Checklist: Firewall, Logs, Access and Backup
KVKK technical measures are the information security controls that a data controller must put in place under KVKK, Türkiye's personal data protection law (Law No. 6698), to protect personal data against unlawful access, unlawful processing and loss. This checklist turns the Turkish Data Protection Authority's Personal Data Security Guide (Technical and Administrative Measures) into concrete firewall, logging, access and backup steps that an IT manager can implement and prove.
What Are KVKK Technical Measures and Who Must Apply Them?
KVKK technical measures are the security controls a data controller applies in its IT infrastructure. The law's data security provision requires "all necessary technical and administrative measures to ensure an appropriate level of security" in order to prevent unlawful processing of and access to personal data; the Authority's guide fills in the detail. Every organization that processes personal data is in scope, regardless of size.
The law does not name a firewall brand, a logging platform or an encryption algorithm. That is deliberate: the obligation is tied to the outcome, not to a technology. The data controller decides what "appropriate" means given the nature of the data and the risk it carries, and must be able to demonstrate that level when asked. Use the text of the law and the Authority's page on data security obligations as your primary sources.
The Personal Data Security Guide (Technical and Administrative Measures) published by the Personal Data Protection Authority makes this abstract framework concrete. It covers cyber security, monitoring of personal data security, security of environments that hold personal data, cloud storage and backup, and it summarizes technical and administrative measures in reference tables. The technical and administrative measure options that controllers tick when registering in VERBİS, the Turkish data controllers' registry, largely overlap with these headings.
Who is bound? Every natural or legal person that processes personal data and determines the purposes of processing. Registration in VERBİS depends on employee count and balance-sheet thresholds (check the current thresholds on kvkk.gov.tr), but an organization that is exempt from registration is still not exempt from the duty to take technical measures.
For international companies operating in Türkiye, KVKK will look familiar if you already run a GDPR program, yet it has its own local obligations such as VERBİS registration and separate rules for cross-border transfers. Map the two regimes together with your legal counsel rather than assuming that one covers the other.
12-Point Checklist: Measure, Reason, Tool, Evidence
The KVKK technical measures checklist takes the headings from the guide's technical measures table and looks at each from four angles: what the measure is, why the guide asks for it, which tool implements it and what evidence you show in an audit. The evidence column matters most, because a review asks for a dated, repeatable output rather than a statement that "we have taken measures".
| Measure | Reason (as reflected in the guide) | Tool | Evidence |
|---|---|---|---|
| Access matrix and least privilege | Limiting access rights to duties and responsibilities | Active Directory groups, role-based access, FortiGate admin profiles | Approved access matrix, group membership report |
| Strong passwords and multi-factor authentication | User account management and authorization control | AD password policy, FortiToken, Microsoft 365 conditional access | Policy screenshot, MFA coverage report |
| Access and activity logs | Traceability of access to personal data | Server and application logs, FortiAnalyzer, SIEM | Sample log extract, retention setting |
| Firewall and network segmentation | Blocking unauthorized access from the internet, network security | FortiGate next-generation firewall, VLANs, policy set | Policy list, rule audit report |
| Intrusion detection and prevention | Stopping known attack patterns | FortiGate IPS profile | IPS event summary |
| Up-to-date endpoint protection | Current anti-malware systems | FortiEDR, Bitdefender GravityZone, Trend Micro | Agent coverage and currency report |
| Patch and update management | Closing software vulnerabilities | WSUS or Intune, RMM, FortiOS updates | Patch compliance report |
| Encryption in transit and at rest | Keeping intercepted data unreadable | TLS, BitLocker, IPsec VPN | Encryption inventory, certificate list |
| Backup and restore testing | Backing up personal data against loss and ransomware | Acronis Cyber Protect, 3-2-1 rule, immutable copy | Backup report, restore test record |
| Penetration testing and vulnerability scanning | Regular testing of security weaknesses | Periodic penetration test, vulnerability scanner | Test report, remediation tracker |
| Data masking and data loss prevention | Preventing unauthorized leakage | DLP profile, masking, USB control | DLP policy, incident report |
| Erasure, destruction and anonymization | Disposing of data at the end of its retention period | Retention and destruction policy, secure erasure tools | Destruction records |
The sections below open up the four headings we most often find incomplete in our projects. For endpoint protection and ransomware defense, see our 10-step ransomware defense plan for SMEs; for choosing between EDR, XDR and MDR, read our article on the difference between EDR, XDR and MDR.
The guide does not present its measures as a numbered list of mandatory items. Which measure you need depends on the nature of your data and on your risk analysis. If you process special categories of personal data such as health data, add the Board's decision No. 2018/10 on adequate measures for special category data to this list as well.
Firewall and Network Security: What Counts as Adequate?
The KVKK firewall measure covers the firewall and gateway, which the guide names as priority measures for protecting systems that hold personal data against unauthorized access from the internet. Adequacy is measured by configuration, not by the presence of a device: are policies written on least privilege, are intrusion prevention and web filtering enabled, are logs centralized, is the management interface closed to the outside?
The guide lists the firewall and gateway first among defenses against internet-borne threats. In our field experience the real problem is rarely a missing appliance; it is the rules that have piled up over the years and that nobody owns. A single rule that allows "any source to any port" on a server holding personal data undoes every other investment. That is why the firewall line of this checklist should not be ticked until a firewall rule cleanup and policy audit has been completed.
The minimum elements of a configuration that can be considered adequate are:
- Segmentation: Servers that process personal data (ERP, HR, CRM, databases) sit in VLANs separate from the user network and guest Wi-Fi; traffic between segments is limited to explicitly allowed services.
- Application-layer inspection: Inspection by application and content, not by port alone; IPS, antivirus and web filtering profiles are active on policies toward the personal data segment.
- Management plane: The management interface is reachable only from the internal network and defined IP addresses; administrator accounts are personal and require multi-factor authentication.
- Remote access: Branch and remote-worker connections use encrypted tunnels or zero trust access; personal data sources are never directly reachable from the internet.
- Currency: Firmware and threat signatures are kept up to date.
The FortiGate next-generation firewall family covers these requirements in a single device and makes evidence easier to produce: policy-based UTM profiles, admin profiles and centralized logging live in the same management interface. From a KVKK standpoint, what matters is not the model but that policies are documented and audited regularly.
How Should Logs Be Kept? Access, Changes and Retention
KVKK logging covers the regular recording and monitoring of user activity and access records on systems that hold personal data. In practice this means logs that answer who did what, to which data and when, that are protected against tampering, collected centrally and reviewed on a regular schedule.
The guide's section on monitoring personal data security treats the review of alerts from security software, the regular checking of logs and the reporting of anomalies as one package. In other words, there must be a process that actually reads the logs. A pattern we frequently encounter is a firewall that keeps logs on its local disk for a few days and then overwrites them; by the time a breach is noticed, the records are long gone.
| Log source | What to record | Where to collect |
|---|---|---|
| Firewall | Traffic sessions, VPN logins, admin actions, IPS and web filter events | FortiAnalyzer or SIEM |
| Directory service (Active Directory) | Logons and logoffs, failed logins, group and permission changes | SIEM |
| Servers and databases | Access to personal data tables, queries and exports | Database audit log and SIEM |
| Business applications (ERP, HR, CRM) | Record views, edits, deletions, bulk exports | Application audit log |
| Endpoints | Removable media use, file copies, malware events | EDR and DLP console |
Central collection prevents logs from being erased on the device and merges different sources into one timeline. In FortiGate environments this is the job of FortiAnalyzer; for setup and report design, see our guide to FortiGate logging and FortiAnalyzer integration.
Three technical details decide the outcome of an audit. First, time synchronization: every source must use the same NTP server, or the chain of events cannot be reconstructed. Second, integrity: as the guide stresses, logs must be protected from user intervention, and deletion rights should sit with a single defined role. Third, retention: the guide does not set one period; for organizations that provide internet access, obligations under Türkiye's Law No. 5651 and sector-specific rules apply. We cover this separately in our article on Law No. 5651 and centralized log management; tie your retention period to a written policy and verify the current legislation.
Access Management: How Do You Build an Access Matrix?
The KVKK access control measure covers granting employees access only to the extent their duties require, authenticating users to systems and documenting permissions in an access matrix. In practice it means role-based groups, multi-factor authentication, closing leavers' accounts on the same day and keeping privileged accounts separate.
An access matrix is a table with roles as rows and systems as columns, each cell showing the permission level (none, read, write, admin). Its value comes from matching the technical configuration: if the matrix says "accounting staff cannot access HR data", the Active Directory group must enforce exactly that. Auditors ask for both documents side by side; if they differ, the matrix exists only on paper.
These are the control points we apply in our projects:
- Personal accounts: Shared "accounting" or "reception" accounts are removed; otherwise the access log cannot tell who performed an action.
- Multi-factor authentication: Mandatory for remote access, email, management interfaces and cloud applications holding personal data.
- Privileged account separation: Administrators use a standard account for daily work and a separate account for admin tasks; use of admin accounts is logged.
- Joiner and leaver process: A written HR-to-IT workflow exists; all access of a leaving employee is revoked the same day and the record is kept.
- Periodic review: Permissions are reviewed at regular intervals with line managers and a dated approval is recorded.
The Authority has also explicitly recommended two-factor authentication in its public announcement on user security. For remote access, instead of a classic VPN that opens the whole network, zero trust network access (ZTNA) connects users only to the applications they are authorized for, which is the network-layer counterpart of the access matrix.
Backup and Encryption: The Last Line Against Loss and Breach
The KVKK backup measure covers backing up personal data against loss from malware, hardware failure or user error, and protecting the backups at the same security level; encryption keeps data unreadable even if it is intercepted in transit or stolen at rest. In practice it means the 3-2-1 rule, an offline immutable copy, regular restore tests, disk encryption and enforced TLS.
The guide specifically asks that access to backed-up personal data be restricted and that data set backups be kept outside the network. Backup servers are often the first target in a ransomware attack; a backup that is network-connected and reachable with an admin password is one the attacker can reach too. To count as a control, a backup must be separated from production, immutable for a defined period and restore-tested. An untested backup is a backup on paper only.
As a practical frame we recommend the 3-2-1 rule: three copies, two different media, one copy off the network. A common misconception in the cloud is that services such as Microsoft 365 back up your data on their own; restoring deleted or encrypted data is the data controller's job. We explain this distinction in our article on Microsoft 365 backup and the shared responsibility model. Acronis Cyber Protect Cloud, which backs up servers, endpoints and cloud workloads from one console and can produce immutable copies and restore test reports, fills the evidence column of this line directly.
On encryption, the guide lists encryption against loss or theft of portable devices holding personal data and the use of secure protocols during data transfer. Minimum practice: full-disk encryption on laptops, encrypted files for email attachments containing personal data, IPsec tunnels between sites and current TLS. Document who holds the keys and where they are stored in a written key management procedure.
Breach Notification and the Link to Administrative Measures
KVKK breach notification requires the data controller, when processed personal data is obtained by others through unlawful means, to notify the data subjects and the Board as soon as possible; the Board's decision No. 2019/10 set this period at 72 hours from the moment the controller becomes aware of the breach. Technical measures are the only way to determine the scope and the affected individuals within that time.
In practice, 72 hours means you must be able to say which system was accessed, with which account, when, and whose data was affected. Those answers come only from logs; an organization that keeps no logs cannot establish scope in its notification. The notification procedure and form are published on the Authority's breach notification page; verify the deadline and procedure against current Board decisions.
Technical measures only make sense together with administrative ones; the guide's administrative section lists the data inventory, policies and procedures, confidentiality undertakings, training and periodic internal audits. For the IT manager there are three connection points:
- Inventory and access matrix: The inventory tells you which data lives in which system; the scope of technical measures follows from it.
- Breach response plan: Who reads the logs, who restores backups and who files the notification is written down in advance; 72 hours is time to execute a plan, not to write one.
- Periodic audit: Reviewing this checklist at least once a year, together with its evidence column, satisfies the internal audit measure.
Technical measures are not a separate "compliance expense"; we discuss which items come first in our article on the 2026 cyber security budget and SME priorities. This information is not legal advice; for deadlines, procedures and sanctions, verify the current legislation and the official guide.
Frequently Asked Questions
Are KVKK technical measures mandatory or only recommended?
The obligation to take technical and administrative measures comes from the law and is mandatory. The Personal Data Security Guide is an advisory document showing how to meet that obligation. Because the Board assesses the adequacy of measures in breach investigations, treat the guide as a de facto standard.
What is the minimum set of technical measures for a small business?
In our field experience four layers form the minimum: a properly configured firewall, centrally collected and regularly reviewed logs, access based on an access matrix with multi-factor authentication, and an offline backup whose restore has been tested. Current endpoint protection and patch management come on top.
How long should logs be retained for KVKK?
The guide expects access and activity records to be kept regularly but does not set a single retention period. The period is determined by Law No. 5651, sector regulations and your own retention policy. Put your decision into a written policy and verify the current legislation.
Is penetration testing mandatory under KVKK?
The law contains no explicit penetration testing requirement, but the guide lists regular testing of security weaknesses among technical measures. For any organization with internet-facing systems that process personal data, periodic vulnerability scanning and penetration testing are a provable part of an appropriate security level.
What happens if the measures declared in VERBİS differ from reality?
The technical and administrative measures selected in a VERBİS registration are a public declaration. If a breach investigation shows that a declared measure was not in place, this counts against the data controller. We therefore recommend keeping the VERBİS declaration aligned with the evidence column of this checklist.
Conclusion
KVKK technical measures are not a separate compliance project; they are the documented form of a well-run information security program. The firewall, log management, access control and backup measures in the Personal Data Security Guide already exist at tool level in most organizations. What is usually missing is a least-privilege review of the configuration, central collection and review of logs, alignment of the access matrix with the technical setup and restore testing of backups. Once you complete this checklist with its evidence column, you are ready both for your VERBİS declaration and for a possible breach investigation.
At Sora Yazılım we design, deploy and operate as a managed service firewall policy audits, central logging infrastructure, access management and backup projects. To assess your current infrastructure against this checklist, you can request a free discovery call.