The issue of complying with KVKK and maintaining this compliance is getting more and more complex day by day. It requires labor and focus to follow the announcements periodically published by the Personal Data Protection Authority and to update the processes accordingly. The fact that the legal persons responsible for the data do not pay attention to this issue causes data breaches with consequences such as both fines and loss of reputation.

As stated in article 2.1 of the KVKK Technical Measures Guide; In order to ensure the security of personal data, first of all, it is necessary to correctly determine what all personal data is processed by the data controller, the probability of the risks that may arise regarding the protection of this data, and the losses to be caused in case of realization, and take appropriate measures.

Again, in Article 3.2 of the KVKK Technical Measures Guide, the process of penetration testing is described as follows: In order to protect against vulnerabilities, regular vulnerability scans and penetration tests should be carried out, and evaluations should be made according to the results of the tests on security vulnerabilities.”

Although data controllers do not realize the systems, they are exposed to both internal and external attacks. More importantly, this situation cannot be noticed for a long time and it becomes impossible to intervene when leakage occurs. It is recommended as a best practice to perform penetration tests periodically (at least every 6 months) to cover all endpoints and all infrastructures of the organization. In this way, an important contribution can be made to the continuation of the business processes of the legal entity without experiencing any reputational and financial losses by identifying and closing system vulnerabilities before a data breach has occurred.