Blog
Data Protection and Security articles
We have written down the questions our clients ask most often, the mistakes we see in the field and the methods that actually work.
Don't let anyone else send email in your name
What are SPF, DKIM and DMARC and how do you set them up? Protection against domain spoofing and fake invoice emails, tightening DMARC step by step, and deliverability.
30 August 2026 Data Protection and SecurityYour contact form may be the most open door on your site
Web form security in practice: spam and bot protection, validation against injection, safe file uploads and data minimization. A guide to KVKK-compliant forms.
25 July 2026 Data Protection and SecurityNot complex passwords, but long passwords and a second step
How to set up a company password policy and 2FA: length, breached password checks, password managers, two-factor authentication and admin accounts, explained.
19 June 2026 Data Protection and SecurityYou have backups, but can you actually restore them?
What is the 3-2-1 backup strategy? Three copies, two media, one offsite copy, immutable backups against ransomware, restore testing and what KVKK expects.
14 May 2026 Data Protection and SecurityIs the padlock in the address bar enough?
What SSL certificates and HTTPS do and don't protect: certificate types, renewal, mixed content, HSTS and the security obligation under Türkiye's KVKK, in plain terms.
8 April 2026 Data Protection and SecurityDo you have to register with VERBIS?
Who does the VERBIS registration obligation cover? Employee and balance sheet thresholds, special category data, the limits of the exemption and what to do after registering.
3 March 2026 Data Protection and SecurityYour cloud tools may be moving data out of Türkiye
KVKK rules on cross-border data transfers changed in 2024. Standard contracts, adequacy, and a practical roadmap for cloud, email and analytics tools used abroad.
26 January 2026 Data Protection and SecurityWhy asking for explicit consent for everything is the wrong approach
When does KVKK require explicit consent? The other legal grounds such as contract, legal obligation and legitimate interest, and why consent must not be a condition of service.
21 December 2025 Data Protection and SecurityDoes your privacy notice actually describe your website?
How to prepare a KVKK privacy notice for a website in Türkiye: required elements, per-form notices, keeping it separate from consent, and keeping it up to date.
15 November 2025 Data Protection and SecurityHow do you get cookie consent, and what belongs in the banner?
How do you get cookie consent? Separate essential, analytics and marketing cookies, make rejecting as easy as accepting, and follow the KVKK authority's guide.
10 October 2025