KVKK and Remote Access Tools: Where Does Your Data Go?

Where does data pass during a session?

• Screen stream: any personal data visible on screen.
• File transfer: files moved between two devices.
• Clipboard: copied text and files.
• Session records and logs: who connected to which device and when.
• Account and device metadata: user name, device name, IP address.

Whether the connection is direct or goes through the vendor’s servers depends on the product and the network. Confirm this in the vendor’s documents.

What does KVKK Article 9 say?

Law No. 7499 amended KVKK Article 9. The change took effect on 1 June 2024. A transfer abroad can rest on an adequacy decision, appropriate safeguards (for example standard contracts or binding corporate rules), or incidental cases. A standard contract must be notified to the Authority within five business days after all signatures. The related regulation was published on 10 July 2024.

Checklist

• In which countries does the vendor process session data?
• Do you have a data processing agreement with the vendor?
• If data goes abroad, which mechanism do you rely on?
• If you use a standard contract, did you notify the Authority?
• Are your VERBIS entry and privacy notice up to date?
• Are sessions recorded? Where, and for how long are records kept?
• Are technician permissions and access logs defined?

Keeping data inside your organisation

If the remote access infrastructure runs on your own servers, session traffic does not leave your network. This can reduce the cross-border transfer question. You still need controls for permissions, logs, and retention. Moftgate can run on your own servers (on-premises), and the first 200 endpoints are free.