Public Announcement on Technical and Administrative Measures Recommended for Data Controllers Regarding User Security

On 15.02.2022, the Personal Data Protection Board (PDPB) published

"Public Announcement on Technical and Administrative Measures Recommended for Data Controllers Regarding User Security"

The Public statement refers to;

• The article 12/1 of the Law on Protection of Personal Data (PPDL, Turkish acronym known as ‘KVKK’) numbered 6698, that determines the obligations of the data controller;
• The recent observations showing the account/log-in information (in sectors such as finance, e-commerce, social media and gaming company websites) are publicly being published on some websites;
• The fact those personal data are illegally sold in return for money and are archived and remarketed by malicious people.

In this context, the PDPB reminds and encourages the data controllers to take necessary technical and administrative measures as recommended in the following;

• Establishment of a two-stage authentication system,
• In case of logging in via different devices, ensuring that the login information is forwarded to the contact addresses of the relevant persons,
• Protecting applications with HTTPS or in a way that provides the same level of security,
• Using secure and up-to-date hash algorithms for user passwords,
• Limiting the number of failed login attempts from the IP address,
• Reminding that the same password should not be used on more than one platform,
• Creating a password policy and ensuring that users' passwords are changed periodically,
• Preventing newly created passwords constituting of old passwords,
• Using security technologies that distinguish between computer and human behavior,
• Limitation of IP addresses allowed access.

The content herein is aimed at providing a general insight regarding the subject. For customized circumstances or for further information, please refer to your lawyer.