Türkiye's data board has ruled on how employers may monitor corporate email. What IT should check: mailbox permissions, audit logs and leaver accounts.
Read more: Can an Employer Read Staff Email? Türkiye's KVKK Principle Decision
On 2 September 2026 Türkiye's data authority published 33 breach notices; in 22 the breach was at a vendor, not the company. Who actually pays under KVKK.
Read more: If Your Vendor Gets Hacked, Who Pays the KVKK Fine? A 33-Breach Lesson
Every VERBİS-registered company must have a written data retention and destruction policy. What it must cover, the three legal methods, and 2026 fines.
Read more: Data Retention and Destruction Policy: Mandatory in Türkiye?
Under KVKK a privacy notice is always mandatory; explicit consent only in specific cases. SMEs that mix the two over-collect consent or skip disclosure.
Read more: Privacy Notice or Consent? Türkiye's Most Confused KVKK Rule
Türkiye's data protection law gives you 72 hours to report a personal data breach. Who to notify, which form to use, and the 2026 fines if you miss it.
Read more: KVKK Data Breach Notification: What to Do in the First 72 Hours
Türkiye's KVKK Board fined a company partly because staff training was assigned but never completed. How often training should run, and how to document it.
Read more: KVKK Staff Training: How Often, and What Should It Cover?
On 28 July 2026 KVKK published decision 2026/1301 for public bodies. The same minimization principle already binds companies under Article 4 of Law 6698.
Read more: KVKK's New Data Minimization Ruling: Does It Bind Private Firms?
VERBİS registration is not a one-off task. The threshold rose to 100M TRY, changes must be filed within seven days, and 2026 fines start at 341,809 TRY.
Read more: VERBİS 2026: The 100M TRY Threshold and the 7-Day Update Rule
Türkiye's KVKK ruled on 29 April 2026 (decision 2026/921) that fingerprint and face recognition for attendance is unlawful. What employers must do now.
Read more: Türkiye's KVKK Ruling: Is Fingerprint and Face-Scan Attendance Over?
What are KVKK Article 12 technical and administrative measures, and which controls do SMEs need? Current 2026 fines and a practical compliance checklist.
Read more: KVKK Technical & Administrative Measures: SME Checklist
Türkiye's data authority issued new CCTV guidance on 8 June 2026: banned areas, no audio, retention limits and access control. What employers must change.
Read more: Workplace CCTV and KVKK: A 2026 Compliance Guide for Türkiye
If your company runs Microsoft 365 or Google Workspace, you already transfer data abroad. What KVKK Article 9 and the standard contract require of you.
Read more: KVKK Cross-Border Data Transfer 2026: Standard Contract Guide
An accounting client called in a panic: an email about a pending e-invoice with a QR code to scan. How quishing works and how to train people against it.
Read more: Quishing (QR Code Phishing): What It Is and How SMBs Defend Against It
An IT lead called: an employee left, used a personal iPhone for company email and downloaded customer files. How Intune and a BYOD policy prevent that.
Read more: Microsoft Intune BYOD Management: A Practical Guide
Microsoft Entra ID is rolling out passkey profiles to corporate accounts and Windows passwordless sign-in is maturing. What to enable, and in what order.
Read more: Passkey & Passwordless Sign-in: The 2026 Guide
An email that looked like it came from the CEO told the finance manager the IBAN had changed. How SPF, DKIM and DMARC stop that email from arriving.
Read more: Email Security 2026: DMARC, DKIM, SPF — The Practical Guide
Microsoft has enforced MFA on Azure and Microsoft 365 admin portals since 2024. Phase 1 is live across all tenants; what to prepare before the next one.
Read more: Microsoft 365 & Azure Mandatory MFA: The 2026 Roadmap
Sensitivity labels, encryption, automatic classification and rights management: how Azure Information Protection, now part of Purview, serves KVKK and GDPR.
Read more: Azure Information Protection for GDPR & KVKK Compliance