KVKK-Compliant Endpoint Security: A Guide to Local, On-Premises Deployment

1. Who this guide is for

This guide is for IT managers, information security officers and KVKK compliance teams. It covers which technical measures to apply on endpoints that process personal data, and how to keep evidence of them. It is not legal advice. Confirm your obligations with your legal counsel and the current text of the regulation.

2. What KVKK Article 12 means for endpoints

Article 12 of Law No. 6698 on the Protection of Personal Data is titled “Obligations concerning data security”. It requires the data controller to take all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the safekeeping of personal data. The controller is jointly responsible with its data processors, must audit or have audited its own measures, and must notify the data subject and the Board as soon as possible if data is obtained unlawfully.

The KVKK Board’s decision No. 2019/10 of 24 January 2019 expects notification to the Board without delay and within 72 hours at the latest after the breach is discovered. Without endpoint records, answering “which data left which device, and to whom” within 72 hours is hard.

3. The KVKK Board’s technical and administrative measures guide

The KVKK Board’s “Personal Data Security Guide (Technical and Administrative Measures)” gives examples of Article 12 measures. It is guidance, not a checklist. Endpoint-relevant technical measures include access control and authorisation, log records, up-to-date anti-malware, software updates, data loss prevention software, removable media security, backup, and knowing where personal data is stored. The guide also lists administrative measures such as policies, training, confidentiality commitments and data processor contracts. Technical measures do not replace them.

4. Public sector and critical infrastructure: the BİG Guide

The Information and Communication Security Guide (BİG Guide), published by the Presidency of the Republic of Türkiye Digital Transformation Office, follows Presidential Circular No. 2019/12. It defines measures by asset group and security level for public institutions and critical infrastructure operators. Endpoint-relevant areas include asset inventory, removable media control, malware protection, patch management, log management and data leakage prevention. The circular also asks that critical data is stored in secure environments in Türkiye, so the first question for a public institution is where the security tool keeps its telemetry.

5. ISO 27001:2022 Annex A controls for endpoints

6. Why on-premises?

An endpoint security tool processes data too: file names, user names, process lists and matched content snippets in DLP incidents. Much of this is personal data. If the management console runs in a cloud abroad, this telemetry may be transferred abroad, and the cross-border transfer rules in KVKK Article 9 must be assessed. On-premises deployment keeps telemetry inside your boundary and can work on air-gapped networks. The cost is that you maintain, back up and update the server yourself.

7. What “local” does and does not mean

A “local” label alone does not make a product KVKK-compliant. A product built in Türkiye can still keep telemetry in a foreign cloud, and a foreign product can be installed on-premises. Check concrete properties instead: data stays inside your boundary, Turkish interface and support, built-in detection of Turkish ID (TCKN) and tax ID (VKN) numbers, KVKK report templates and local engineering support.

8. Building blocks

• Inventory and visibility: you cannot protect a device you do not know about.
• Sensitive data discovery: find TCKN, VKN and Luhn-validated card numbers on endpoints and file shares; assign an owner to each finding.
• DLP: start in audit mode, measure false positives in a pilot group, add exceptions, then block.
• USB control: allow organisation-issued encrypted drives, block the rest, and log every copy.
• Patch management: track OS patches and outdated third-party software together; apply automation by group or tag.
• Ransomware safekeeping: local rollback points and file integrity monitoring complement, not replace, backups.
• Logging and reporting: generate reports with audit scope and period, and store them. A report shows what the platform observes and enforces; process evidence is kept separately.

9. How Moftgate fits

Moftgate runs as an on-premises appliance in your own infrastructure. Telemetry and data stay inside your boundary, which allows closed-circuit and air-gapped operation. The agent supports Windows, macOS and Linux desktops and servers. Endpoint Visibility is the base module; DLP, DSPM and SSPM are enabled per licence. DLP covers USB, web, email, clipboard, screenshot and printing; classifications include TCKN, VKN and Luhn-checked card numbers; USB rules use device-level allow and block lists; updates cover OS patches and outdated software; snapshots and rollback protect against ransomware; compliance reports cover KVKK, GDPR, ISO 27001, PCI DSS, BDDK and HIPAA. Moftgate does not deliver KVKK compliance on its own; no software does.

10. A 90-day plan

• Days 0–15: Map your personal data inventory and ISO 27001 SoA to endpoint controls. Install the on-premises server.
• Days 16–30: Deploy the agent to a pilot group and confirm the inventory is complete.
• Days 31–50: Run sensitive data discovery and assign owners.
• Days 51–70: Enable DLP and USB policies in audit mode. Start patch automation in the pilot group.
• Days 71–90: Clear false positives, switch to blocking, and store the first compliance report with its scope and period.