May 30, 2026, 10:14 a.m.

Cybersecurity Awareness Training: Data Classification, Personal Data Privacy and KVKK

In today's digital business world, the data handled by employees is one of a company's most valuable assets. However, protecting and properly managing this data depends more on employee awareness than technological infrastructure. An email attachment, an incorrect cloud storage share, or a carelessly discarded document can expose your organization to serious legal sanctions and reputational damage. This is why cybersecurity awareness training has become an indispensable part of the modern workplace.

In this comprehensive guide, we will cover critical topics that every employee should know, from the fundamentals of data classification to KVKK compliance requirements, from the risks of improper data sharing to secure data disposal procedures.

What is Data Classification and Why is it Important?

Data classification is the process of categorizing and labeling information within your organization according to sensitivity levels. Just as books in a library are organized by subject, corporate data must be classified according to its value and protection requirements. This systematic approach both enhances data security and ensures employees clearly understand how to handle different types of information.

Without data classification, employees may treat a routine marketing report with the same level of care (or carelessness) as a critical customer contract. This situation leads to either unnecessary protection of trivial information or, more dangerously, inadequate protection of critical data.

Data Classification Levels

Most organizations classify data into four basic levels. Each level requires different protection measures and sharing restrictions:

• Confidential/Highly Confidential Data: The most critical information for the organization. Disclosure could cause serious financial loss, legal issues, or loss of competitive advantage. Examples include trade secrets, strategic plans, source code, patent information, and board decisions. This data must be shared through encrypted channels and access should be strictly controlled.
• Private/Internal Data: Information intended for use only within the organization that would pose moderate risk if released publicly. Internal communications, organizational charts, budget plans, project schedules, and employee directories fall into this category. Unauthorized sharing of this data can disrupt internal business processes.
• Public Data: Information intended for or already disclosed to the public. Press releases, marketing materials, website content, and job postings are in this category. While this data doesn't need protection, maintaining its integrity is important.
• Personal and Special Category Personal Data: Information requiring special protection under KVKK. This category carries separate and special importance, as we will discuss in detail below.

KVKK and Personal Data Privacy: What Employees Need to Know

The Personal Data Protection Law No. 6698 (KVKK), which entered into force on April 7, 2016, initiated a new era in data privacy in Turkey. This law directly concerns not only IT departments or senior management, but every employee who comes into contact with personal data.

What is Personal Data?

According to KVKK, personal data is any information relating to an identified or identifiable natural person. These include:

• Identity information (name, surname, Turkish ID number, passport number)
• Contact information (phone, email, address)
• Location data (GPS coordinates, office entry-exit records)
• Financial information (bank account numbers, salary information)
• Visual and audio recordings (photos, videos, audio recordings)
• Customer transaction history and behavioral data
• IP addresses and cookie data

Special Category Personal Data

Some personal data is considered special category due to its sensitive nature and requires stricter protection:

• Health data and medical records
• Biometric and genetic data (fingerprints, facial recognition, DNA)
• Data concerning sexual life
• Race and ethnicity information
• Political opinions, philosophical beliefs, and religion
• Criminal convictions and security measures
• Trade union membership information

Processing this data is only possible in exceptional circumstances provided by law and with the explicit consent of the individual. As employees, if you have access to such data, it is critically important that you exercise extra caution and process it only as required by your job duties.

Fundamental Principles of KVKK

KVKK establishes six fundamental principles that must be followed when processing personal data:

• Processing in accordance with law and rules of integrity: Data must have a legal basis and be processed transparently.
• Being accurate and up-to-date: Incorrect or outdated data must be corrected or deleted.
• Processing for specific, explicit, and legitimate purposes: Your purpose for collecting data must be clear and no use outside this purpose should be made.
• Being relevant, limited, and proportionate to the purposes: Only necessary data should be collected.
• Retention for the period stipulated in relevant legislation: Data must be destroyed when specified retention periods expire.
• Ensuring data security: Data must be protected with technical and administrative measures.

Common Mistakes in Data Sharing and Their Risks

Some actions employees take with good intentions can inadvertently lead to serious data breaches. Here are the most common mistakes:

1. Sending Work Data to Personal Email Addresses

Sending a file to your personal email to work from home may seem innocent, but it is a serious security breach. Personal email accounts generally