What is the level of awareness among businesses regarding information security, and what is the status of their compliance with regulations?

In an interview with Wise TV, attorney Esra Tekil offers compelling insights into data security, the protection of personal data, regulatory awareness, and the differences between the approaches taken in Turkey and the European Union. Emphasizing that information security should be addressed not only from a technical perspective but also from legal and administrative standpoints, Tekil highlights the importance of a multidisciplinary framework.

Globally, the European Union serves as one of the most relevant benchmarks for data security. Both the European Union and the United States began implementing regulations in this area as early as 40 years ago; when strictly enforced, these regulations have driven significant positive change across all sectors. In Turkey, however, these issues unfortunately gained prominence much later. For instance, while the European Union currently enforces the General Data Protection Regulation (GDPR), the personal data protection legislation in place in Turkey is comparable to the most basic versions of the frameworks the EU began adopting as far back as 1997. Consequently, we lag behind in terms of both regulation and awareness—a gap that leaves us vulnerable to risks regarding information security across all sectors. Data security should not be narrowly defined as pertaining only to personal data; it must also encompass a business’s inventions, production systems, and trade secrets. Foreign companies proactively implement legal measures to ensure information security, whereas this process began late in Turkey. Furthermore, while administrative, technical, and legal safeguards should be implemented in tandem, these steps are not yet being fully realized. It is essential to approach information security through a multidisciplinary lens, utilizing systems designed to protect all forms of information. Relying solely on legal professionals or the IT department to implement safeguards is insufficient. Administrative, legal, and technical units must work together to identify an organization’s valuable information, establish access policies, and implement security measures. In Türkiye, the number of companies that approach information security in a comprehensive manner—encompassing legal, technical, and administrative aspects—is far below what it should be. Although awareness is growing day by day, it has not yet reached the desired level.

The Importance of Data Security

In today’s digital age, data security has become more critical than ever. With the rapid advancement of technology and the increasing pace of digitalization, data security is no longer limited to personal information; it now encompasses the trade secrets and strategic data of businesses—assets that also require protection. Consequently, awareness regarding data security and the implementation of relevant regulations are gaining increasing importance, both globally and in Türkiye.

Data Security in the European Union and the United States

The European Union and the United States are pioneers in the field of data security. In these regions, regulations concerning data security began to take shape approximately 40 years ago and have since been rigorously enforced. In particular, the European Union’s General Data Protection Regulation (GDPR) has played a pivotal role in elevating data security standards.

The State of Data Security in Türkiye

Compared to the European Union, Turkey has taken steps toward data security at a later stage. The Personal Data Protection Law in Turkey is implemented in a form that mirrors the foundational principles of the regulations the European Union has applied since 1997. This has caused Türkiye to lag behind in terms of data security, thereby increasing risks across various sectors.

The Scope of Data Security

Data security is not confined solely to personal data. It also extends to a business’s inventions, production systems, and any information classified as a trade secret. Therefore, these elements must be taken into account when developing data security strategies.

The Role of Various Disciplines

Data security is not merely a legal or technical issue. Administrative, legal, and technical departments must work together to establish systems that protect all of an organization’s valuable information. This interdisciplinary collaboration plays a critical role in ensuring effective data security.

Awareness and Practices in Türkiye

Although awareness regarding data security is gradually increasing in Türkiye, it has not yet reached the desired level. The number of companies that approach data security in a holistic manner—encompassing legal, technical, and administrative aspects—remains far below what it should be. This indicates that Türkiye needs to exert greater effort in the realm of data security.

Conclusion

In today’s world, data security has become more important than ever. Regions such as the European Union and the United States have taken pioneering steps and implemented rigorous regulations in this area. Turkey, having taken steps later, is currently working to raise the level of awareness. Data security should not be limited solely to personal data; it must encompass all of an organization’s strategic information. Administrative, legal, and technical departments need to collaborate to develop effective data security strategies. Increasing efforts in this field will help Türkiye mitigate sectoral risks and strengthen data security.