The Personal Data Protection Authority’s October 24, 2026, announcement regarding Cybersecurity Awareness Month

In light of October being recognized worldwide as “Cybersecurity Awareness Month,” the Personal Data Protection Authority issued a notice on October 24, 2026, reminding data controllers of personal data security measures. The notice emphasizes the importance of cybersecurity in ensuring the security of personal data and lists the key measures that institutions and organizations must take under ten headings.

The Authority’s starting point is the recognition that, in an environment where digital threats are constantly evolving and becoming more complex, full protection of personal data cannot be achieved with a single security measure. Therefore, it is stated that these measures must be implemented in conjunction with one another and reviewed on a regular basis.

Who Is Affected by This Notice?

The guidance applies to all data controllers that process personal data. The text specifically states that data controllers must ensure they are aware of which personal data is stored in their data record systems, review existing security measures to confirm compliance with other legal obligations, and clearly define how risks and security breaches for each category of personal data will be managed.

A notable aspect of the guidance is that the measures are not limited to technical aspects alone. Administrative measures—such as the establishment of policies and procedures, the documentation of controls, access authorization matrices, and employee training—are also included in the list.

Data Security Measures Highlighted by the Organization

• Establish personal data security policies. A good policy ensures that risks can be identified in advance and that measures can be taken consistently. Policies and procedures must be integrated in a manner consistent with the data controller’s operations and workflows; regular audits must be conducted, the results documented, areas requiring improvement identified, and audits continued following necessary updates. Additionally, the risks that may arise for each category of personal data and how security breaches will be managed must be clearly defined.
• Create strong passwords. Strong and complex passwords must be used, and passwords must be updated at regular intervals. Passwords that are related to personal information or are easy to guess should be avoided; combinations of uppercase and lowercase letters, numbers, and special characters should be preferred. The number of password entry attempts should be limited to protect against attacks such as brute-force algorithms, and, if possible, an additional layer of security should be added through two-factor authentication.
• Restrict access permissions. Access to systems containing personal data should be limited only to employees who require it for business purposes. Access permissions should be defined in accordance with employees’ job roles and reviewed regularly; access permission and control matrices should be created, and access policies and procedures should be implemented. When employees leave the company or change roles, their accounts should be promptly deactivated or their permissions updated.
• Install software updates promptly. Software updates and patch management are critical for the security of information technology systems. Security patches for software and must be applied promptly to address known security vulnerabilities, and unused software should be removed to reduce potential security risks.
• Implement data masking and encryption. Encryption and data masking methods should be used to protect sensitive data from unauthorized access. This prevents unauthorized individuals from accessing the data and helps maintain data confidentiality in the event of a data breach.
• Perform regular data backups. Regular backups should be performed to guard against potential data loss. Backup processes should be automated, and backups should be encrypted and stored in a secure environment to ensure data security.
• Protect against threats originating from the internet. In information technology systems containing personal data, measures such as firewalls and network gateways should be implemented to guard against unauthorized access threats originating from the internet. A well-configured firewall can stop breaches before they deeply affect the network; a network gateway, on the other hand, can prevent employees from accessing websites that pose a risk to personal data security.
• Use antivirus software. To protect against malware, software such as antivirus or antispam programs that regularly scan the information system network should be used, and these programs should be updated regularly.
• Use secure connections. When collecting personal data through various websites or mobile applications, ensure that these connections are established via SSL or other secure methods.
• Train your employees regularly. Employees should be provided with cybersecurity awareness training to ensure they are prepared for potential threats. Awareness should be raised regarding common threats such as social engineering attacks and phishing; a culture of security should be fostered throughout the company through regular training and security simulations.

Recommended Steps for Data Controllers

• Convert the ten measures listed in this guidance into an organization-specific checklist; document the current status for each measure as “implemented / partially implemented / not implemented,” and plan for any deficiencies by determining a deadline in coordination with the responsible department.
• The access authorization and control matrix should be updated; a written process should be established between the human resources and IT departments to close accounts or update authorizations in cases of resignation or job changes.
• Documenting the controls performed and the measures taken; ensuring that it is recognized that being able to prove that a measure was taken is just as important as having taken it.
• Reviewing the data breach response procedure to clarify the steps for detection, assessment, and notification to the Board and relevant parties, as well as the responsible parties and timeframes.
• Verifying that backup, encryption, and update practices are in place with regard to vendors and cloud service providers; checking whether data processing agreements contain provisions regarding these measures.

Frequently Asked Questions

• Is a single security software program sufficient for personal data security? No. The Authority states that, in an environment where digital threats are constantly evolving and becoming more complex, full protection of personal data cannot be ensured with a single security tool alone. Measures must be implemented in combination and reviewed regularly.
• Where does the data controller’s obligation regarding data security originate? Pursuant to Article 12 of the Personal Data Protection Law No. 6698, the data controller is obligated to take all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of personal data and unlawful access to personal data, as well as to ensure the protection of personal data.
• Is it necessary to provide cybersecurity training to employees? The organization explicitly states that providing cybersecurity awareness training to employees is among the listed measures. It is recommended to raise awareness about common threats, such as social engineering attacks and phishing, and to foster a culture of security throughout the company through regular training and security simulations.

You can access other announcements regarding the protection of personal data prepared by MC Legal on our Announcements page.