In banking, a data leak means regulatory fines and loss of trust. We explain what BDDK, KVKK and PCI DSS expect from DLP, the riskiest channels and a 90-day rollout plan.
Key Takeaways
For a financial institution, DLP is not optional: several regulations expect it. BDDK expects access control and logging, KVKK expects personal data security and PCI DSS expects card data protection. One DLP and data discovery program covers a large part of all three.
- Find sensitive data first: customer data, IBAN, card numbers, loan files.
- Riskiest channels: USB, personal email, personal cloud, AI tools and screenshots.
- Turn on policies in monitor mode first, then move to blocking.
- Keep incident logs in a tamper-proof form for audits.
- Keep data and logs in-country, on your own infrastructure.
Why is the finance sector different?
In a bank, sensitive data is everywhere. Branch staff see customer IDs, credit analysts process income documents, and the call center hears card details. Data moves between many people and systems. This raises the risk of insider and error-driven leaks.
Financial institutions are also supervised by several regulators. One leak can have consequences under KVKK, BDDK and card scheme rules at the same time.
What do regulations expect from DLP?
| Regulation | Related expectation | How DLP and data discovery help |
|---|---|---|
| BDDK Information Systems Regulation (Turkey) | Access control, audit trails, information security management, primary and secondary systems in Turkey | Logging data movement, blocking unauthorized transfers, on-premises deployment |
| KVKK (Law 6698) Art. 12 | Technical measures to prevent unlawful processing of and access to personal data | Personal data discovery, classification and exit control |
| PCI DSS v4.0 | Knowing where card data is stored and protecting it | Card number scanning and finding card data in out-of-scope systems |
This table is not legal advice. Build your own control list with your compliance team.
The 6 riskiest data channels in banks
- USB and external disks: Physical removal of bulk customer lists.
- Personal email: Attachments sent to external addresses.
- Personal cloud storage: Files uploaded to personal accounts.
- AI tools: Loan files or customer messages pasted into prompts.
- Printers and screenshots: Visible leaks with little digital trace.
- Remote access: Access by vendors and outsourced staff.
Which data types should you define?
- National ID and customer number
- IBAN and account number
- Card number (PAN), with checksum validation
- Credit and risk reports
- Salary, income and tax documents
- Internal audit and board documents
90-day rollout plan
- Days 0–30: Discovery. Scan file servers and endpoints. Report where card and ID data lives.
- Days 31–60: Monitor mode. Turn on USB, email, cloud and AI policies in log-only mode. Remove false positives.
- Days 61–90: Blocking. Block the riskiest channels. Write down the exception approval process and incident response steps.
What should you show in an audit?
- Sensitive data inventory and the date of the last scan.
- Active DLP policies and the channels they cover.
- Incident summary for the last 90 days and actions taken.
- Exception list and approvers.
- Where logs are stored and for how long.
How does Moftgate work in financial institutions?
Moftgate can be installed fully on-premises. Data and logs stay in your own data center. The same agent discovers card and ID data with DSPM and controls USB, email, cloud and AI channels with DLP. Audit reports can be exported for the compliance team.
Strategic Takeaway
In finance, a DLP project is a compliance program, not a product install. Run discovery, monitoring and blocking in order, and keep evidence for each step.
Product architects and field engineers who build the Moftgate DLP, device management and data security modules and run customer deployments.
Expert Answers to Core Practitioner Questions
Does BDDK require DLP?
The regulation does not name a product. It does require access control, audit trails and information security management. DLP is a common way to meet these expectations.
Can banks use cloud-based DLP?
The regulation requires primary and secondary systems to be in Turkey. For this reason, banks often prefer on-premises or in-country hosted solutions. Check with your legal and compliance teams.
Can DLP help reduce PCI DSS scope?
Yes. Data discovery shows card data in systems thought to be out of scope. Removing that data reduces scope.
Does DLP slow down employees?
If you start in monitor mode and set up a good exception process, impact stays low. Apply blocking only to high-risk channels.
Authoritative Sources & Regulatory Standards
- •BDDK: Bankaların Bilgi Sistemleri ve Elektronik Bankacılık Hizmetleri Hakkında Yönetmelik (RG 15.03.2020, 31069) ↗(Turkish banking regulator rules on information systems, access, logging and in-country hosting.)
- •6698 sayılı Kişisel Verilerin Korunması Kanunu ↗(Turkish personal data law, data security duty (Art. 12).)
- •PCI Security Standards Council: PCI DSS v4.0 Document Library ↗(Rules for storing and protecting card data.)
- •NIST SP 800-53 Rev. 5: Security and Privacy Controls ↗(Reference catalog for data flow and access controls.)