The 10 most common critical KVKK compliance mistakes in metropolitan municipalities

⏱️ Reading time: 11 min · 📁 Category: KVKK, Public Institutions & Local Government

The 10 most common critical KVKK compliance mistakes in metropolitan municipalities

Because of their diverse services, high data volumes and multilayered organisational structures, metropolitan municipalities
are among the most vulnerable public institutions in terms of KVKK compliance.
Examining Board decisions and data breach announcements published as of 2025 shows that
breaches in municipalities have become a recurring structural problem rather than an “exception”.

To answer the question “Why do breaches keep happening?”, this article
provides an overview of 10 critical, systematic mistakes
that undermine KVKK compliance in metropolitan municipalities.

The main problem is:
In municipalities, the KVKK is seen as an administrative formality, not as a legal process. 1. Treating KVKK compliance as a “project”

The fundamental mistake is treating KVKK compliance as a one-off consulting or documentation project.
Yet municipal data processing activities change constantly; new services, software and subsidiaries
are added every year.

• The initial inventory is never updated
• Privacy notices remain unchanged for years
• New systems are not checked for KVKK compliance

2. Fragmented organisation and no ownership of KVKK compliance

Data processing in metropolitan municipalities is spread across departments, directorates,
subsidiary companies and subcontractors.
However, responsibility for KVKK compliance is often assigned to a single unit in name only.

Basic rule in the KVKK:
Responsibility is non-transferable, coordination is imperative. 3. Overlooking subsidiary companies and affiliated organisations

Although municipal subsidiary companies (transport, water, energy, social facilities, etc.)
effectively act as separate data controllers,
KVKK compliance is often addressed merely by relying on the main municipality’s documents.

• No separate inventory
• No separate privacy information
• Transfer relationships unclear

4. The “we are a public institution” misconception

A common mistaken assumption in municipalities:
“We are a public institution, so the KVKK applies to us more flexibly.”

Board decisions explicitly reject this approach.
Providing public services does not justify disproportionate data processing or
avoiding transparency.

5. Generic, template-based privacy notices

Most privacy notices used by municipalities:

• Use generic wording
• Are not specific to the service
• Do not reflect actual processing activities

The Board’s approach is clear:
Privacy information must reflect actual practice; merely having a written notice is not sufficient. 6. Disproportionate camera and monitoring systems

Camera systems, number plate recognition,
facial recognition and area monitoring are among the most frequent sources of breaches in metropolitan municipalities.

• Broad scope, unclear justification
• Unclear retention periods
• Uncontrolled access permissions

7. Failure to manage supplier and subcontractor risks

Municipalities work with numerous software companies, call centers, maintenance and support suppliers.
However, the distinction between data processor and data controller is often not made in these relationships.

• Weak KVKK provisions in contracts
• Access logs are not kept
• Subcontractors further down the chain are not audited

8. Treating data security as an “IT problem”

Municipalities often treat data security as solely the IT department’s responsibility.
According to the KVKK, security is a whole of administrative, technical and organizational measures.

The absence of logs does not mean a breach did not happen;
security measures that cannot be demonstrated are deemed not to have been taken. 9. Mishandling data subject requests

One of the most common municipal mistakes is
mishandling data subject requests in terms of deadlines, scope and authority.

• Deadlines are missed
• Incomplete or generic replies are given
• Records of requests and replies are not kept

10. Lack of training and awareness

KVKK compliance often fails to reach day-to-day operations because staff lack knowledge of the subject.
Field staff, municipal enforcement officers, call centres and social service units in particular
are areas with the highest KVKK risk.

The main reason breaches keep recurring:
KVKK compliance has not been integrated into everyday working practices. Why do breaches keep recurring? (Summary)

• KVKK compliance is not treated as a “living system”
• Responsibility is distributed but no one takes ownership
• Practice and documentation are disconnected
• Violations are viewed as "events", not as lessons.

Conclusion

The main cause of KVKK breaches in metropolitan municipalities
is not a lack of knowledge of the legislation, but
the failure to restructure the organisation from a data protection perspective.
Compliance is achieved by creating a culture of processes, responsibility and oversight, rather than by producing documents alone.

KVKK compliance analysis for municipalities