The Turkish Data Protection Authority ("DPA") has
published Guidelines for Data Security ("Guidelines").
These guidelines were long overdue since the Data Protection Law
("Law") came into force almost two years ago. Yet,
luckily, the Guidelines answer many questions that the data
controllers have been asking.
HOW TO DETERMINE THE RISKS AND THREATS?
In regards to the Guidelines, these are determined by assessing
several factors regarding personal data:
- Are they special categories of
data?
- Which level of privacy is
needed?
- The damage that a security breach may
inflict on the data subject?
However, this does not mean that every data controller must
implement extreme security measures. Guidelines specifically state
that the data security measures should be determined by considering
the cost, applicability, and effectiveness. The best way to follow
is maintaining a balance between these three factors.
