KVKK and Security Awareness Training: Why Employee Awareness Shapes the Data Protection Board's Decisions

Decisions by Turkey's Personal Data Protection Board (the KVKK Board) on companies that suffered a data breach share a recurring finding: employee awareness was not enough. The Board treats it as a shortcoming even when training was given, if that training did not work in practice. This administrative gap appears in the reasoning for fines alongside technical weaknesses. In this article we use published decisions to explain why security awareness training should be treated as a required measure under KVKK, and how to document it.

Why does KVKK effectively require security awareness training?

Article 12 of Law No. 6698 on the Protection of Personal Data requires data controllers to take "all necessary technical and administrative measures to ensure an appropriate level of security" to prevent unlawful processing of and access to personal data. The authority's Personal Data Security Guide explicitly lists employee training and awareness among those administrative measures.

The law does not say "give this many hours of training a year". But when the Board investigates a breach, its question is clear: did you prepare your employees to reduce this risk, and can you prove it?

Three examples from Board decisions

Example 1: A fake CEO email, 217 people, TRY 1 million (Decision 2024/728). An employee at the Amsterdam office of an international professional body receives an email that appears to come from the Chairman and CEO. It asks for a list of names and email addresses of members in the EU and the EEA. The employee replies with the list attached. The email actually came from an impersonated external account, and the personal data of 217 Turkish members ended up with unauthorised people.

The organisation says it had given its employees various training. The Board concludes that the incident "indicates that data privacy and security were not fully embraced by employees". It also finds that email security settings were tightened only after the breach. The result: TRY 750,000 for failing to take data security measures and TRY 250,000 for not reporting the breach within 72 hours, a total administrative fine of TRY 1 million.

The message is clear: having given training is not enough on its own. You need to be able to show that the training worked in practice.

Example 2: One download, 797 servers, TRY 1 million. At a global industrial company, ransomware spreads to 797 servers on the company network after a program is downloaded from the internet. According to press reports, the affected data included ID, passport, address, IBAN, phone and blood type information, and 4,885 employees, customers and suppliers were affected. The gaps the Board identified:

• Weak password policies
• Insufficient cybersecurity awareness among employees
• Network access rights broader than needed, which made it easier for the malware to spread
• Outdated operating systems and critical security updates left unapplied
• No evidence that critical vulnerabilities found in earlier penetration tests had been fixed
• The breach being reported to the Board 23 days later

The fine: TRY 800,000 for breaching the data security obligation and TRY 200,000 for late notification.

Example 3: A supplier account, ransomware, TRY 500,000. At a company in the automotive sector, the attack is thought to have started with the compromise of a user account belonging to the provider of the company's HR software. Ransomware encrypts files and the attackers publish some of the data online. The Board finds that information systems were not monitored regularly, unusual network activity was not noticed in time and protection against malware was inadequate. It also reminds data controllers that they must ensure the suppliers processing their data take adequate security measures too.

What do these decisions have in common?

In none of the three cases does the attack unfold like a film. The entry point is often an ordinary action by an employee or a supplier: downloading a program, replying to an email that seems to come from a manager, a compromised account. The damage that follows comes from basic measures that were postponed for years.

That is why seeing KVKK compliance only as privacy notices and data inventories falls short. One of the things the Board looks at is what you did to reduce human risk.

The fine is only one of the costs

The administrative fine is the visible cost. These should also be counted:

• Incident response and data recovery costs
• Working days lost while systems are down
• Damaged trust among customers and business partners
• Reputational risk from Board decisions being published in summary

What should effective security awareness training look like under KVKK?

The Board's decisions give an important hint: the effect and the evidence of training matter as much as its existence. For an effective and defensible programme:

1. It should be regular. Training given once at onboarding is not enough, and a video watched once a year does not change behaviour. Short, repeated modules work better.
2. It should target the real risks. The most common entry points in the decisions are phishing emails, malware downloads and weak passwords. The content should focus on these.
3. It should be measured. Phishing simulations show how employees react to a realistic attack, and so whether the training works.
4. It should be documented. Who took which training, and when? What did the simulations show? These records are the most concrete evidence you have during an investigation.

Frequently asked questions

---
InfoLore provides security awareness programmes and phishing simulations that you can document under KVKK and GDPR. Get in touch to assess where you stand.