Cyber security and personal data protection are no longer just an IT matter; they belong on the board agenda. A ransomware attack can halt production and invoicing for days, and a data breach brings both a duty to notify Türkiye's Personal Data Protection Authority (KVKK) and a loss of customer trust. The figures show this is far from rare. According to TurkStat's ICT Usage Survey in Enterprises 2026, 9.4% of Turkish enterprises experienced at least one ICT security incident in 2025. The KVKK 2025 Annual Report shows the Authority received 328 data breach notifications that same year.
This hub gathers our cyber security and data protection articles into a reading path from first steps to decision. On the compliance side, start with KVKK compliance steps, which sets out eight stages from data inventory to audit. Then check whether you must register with VERBIS, and read about the data retention and disposal policy that decides how long data is kept. So that you know what to do when a breach happens, keep our guide to breach notification within 72 hours to hand.
Two articles go deeper into these first steps: the personal data inventory guide, which shows what data sits where, and explicit consent vs privacy notice, which clarifies which text people should receive. When an employee, applicant or customer exercises their rights, the workflow in handling data subject requests helps you meet the 30-day deadline.
Once the inventory is done, three specific topics usually stand out. If your email, backups or software run outside Türkiye, the rules on KVKK cross-border data transfer apply. For security cameras in offices, warehouses and shops, CCTV recording and KVKK covers notices and retention periods. If staff use AI tools or the company starts its own AI project, our guide to AI and personal data protection in Turkey answers the questions on legal basis, transfers and automated decisions.
On the HR side, read employee personal data under KVKK for records from personnel files to attendance, and digital tracking of OHS training records for mandatory training documents. A data processing agreement with the payroll firm, cloud provider or software house that can reach your data puts the division of responsibility in writing.
On the technical side, the SME cyber security checklist is a good place for small teams to start. To go deeper, read about business password security, 3-2-1 backups against ransomware and penetration testing, which tests your defences through an attacker's eyes. For manufacturers, OT security for SCADA networks is essential, and for anyone planning to move infrastructure, cloud migration cost is the key article at the decision stage.
The processes that keep the checklist alive have their own articles: vulnerability scanning, which finds weaknesses regularly, the patch management process, which puts fixes on a schedule, and SIEM and log management, which lets you notice incidents. For companies offering internet access to guests or staff, Law 5651 log retention is the legal frame for those logs.
On identity and data, the zero trust security model, which re-verifies every access inside the network, our SAML vs OIDC comparison of single sign-on protocols and data loss prevention (DLP), which limits sensitive data leaving uncontrolled, complete the path. The human side needs a security awareness training program that goes beyond an annual presentation. For the security questions your customers ask you, and you ask your suppliers, see third-party vendor security assessment; companies selling into the EU should also read NIS2 requirements for suppliers.
We also cover the two most effective checklist items on their own: rolling out multi-factor authentication for business, which stops most account takeovers, and backup restore testing, which proves your backups actually work. For those who want to turn these controls into an auditable management system, the last stop is ISO 27001 certification for SMEs.
For delivery, see our pages on data protection compliance, cyber security and cloud migration and infrastructure consultancy. Before you start, answer three questions. What personal data do you hold, and in which systems? When did you last actually restore something from your backups? And how many hours does it take to remove a leaver's access?
Reading list by topic
- Email-borne risks: SPF, DKIM and DMARC, how to spot phishing emails and email archiving and data protection.
- Identity and access: single sign-on (SSO), offboarding email access and biometric attendance and data protection.
- AI and company data: is it safe to put company data into ChatGPT?.