The Most Common KVKK Mistakes on Municipal Websites

⏱️ Reading time: 18 min · 📁 Category: KVKK & Digital Compliance

Most Common KVKK Errors on Municipal Websites (2026)

Detailed institutional risk map (Unauthorized access • Telephone disclosures • Staff permissions • Cookies • New projects • Institutional complacency)

For KVKK purposes, municipalities fit the profile of “high-risk data controllers” because they simultaneously process a broad range of data:

• Citizen requests (Beyaz Masa service desk, CİMER referrals, complaints and reports)
• Social assistance and vulnerable groups (income, health, disability, family information)
• Planning, permits, assessed property values and online municipal services
• Personnel/workers processes
• Camera recordings and urban security-like applications
• Websites and digital services (online payments, appointments and information requests)

Below, common KVKK errors encountered in practice are examined through root cause + scenario + risk + corrective controls in detail.

1️⃣ Unauthorized Accesses Within the Institution

“Everyone can access everything” is the most common and most costly source of risk in municipal information systems.

Typical error patterns

• Shared account / shared password (department email, CRM, Beyaz Masa service panel)
• No access-permission matrix: broad permissions granted simply “to get the job done”
• Arbitrary individual permissions instead of RBAC
• Departing employees’ accounts remain active (no handover process)
• Remote access/VPN unchecked (home/phone access)
• Logs are missing or not reviewed (it is unclear who opened which record)

Concrete scenario:

Beyaz Masa staff should only see records for their own district, but can access the social-assistance records of all districts in the panel: disability status, income, family members, addresses and children’s information.

KVKK risk

• Risk of breaching the data-security obligation under KVKK Article 12
• A finding of “no access control” aggravates the penalty in a breach, according to this guide.
• Where internal access is abused: breach notification and harm to citizens

The question asked in the audit:

“How are access permissions granted? How are changes recorded? Where are the logs?”

Practical corrective controls at municipal scale

• Permission matrix (RACI + RBAC): minimum access by department and role
• MFA: especially remote access and admin accounts
• Offboarding: close accounts within 24 hours
• PAM: record and trace system-administrator access
• Logging + regular review: audit who viewed each record
• Data masking: display only part of the Turkish ID number or phone number on screen

2️⃣ Information Provided by Phone

This guide describes telephone disclosures as municipalities’ most common leak channel. The process is fast and often subject to pressure to satisfy citizens.

Most frequent errors

• Without verifying the caller, sharing addresses, debts or application status over the phone
• Social engineering: “I’m a relative / a colleague in public service / the neighbourhood head (muhtar)”
• Failing to distinguish formal information-access requests from general enquiries
• During phone enquiries, screenshots or WhatsApp are used to send information

Concrete scenarios:

1. A caller claims to be the applicant’s spouse and asks about a social-assistance application; staff disclose whether it was approved or rejected.
2. A person asking about a parcel’s planning status is told the owner’s name or the applicant’s contact details.

KVKK risk

• Clear breach: transfer to unauthorized third party
• Loss of trust in the municipality + complaints processes
• Systematic defect if violation is widespread

Secure telephone protocol (practical):

• Caller verification: e-Devlet verification code / SMS OTP / verification of the registered phone line
• Rule against disclosing personal data by phone: “View your application through e-Devlet or the online municipal portal.”
• Representative or authorised agent: written authorisation + verification
• Sensitive matters: never disclose details of social assistance, health, violence or similar matters over the phone

3️⃣ Staff misuse of access permissions

“Authorised access used for an unrelated purpose” is an insider threat that many institutions underestimate, although it causes particularly serious harm in practice.

The most common types of abuse

• Looking up records about a former spouse, neighbour or relative
• Checking where people live for political or personal reasons
• Leaking information from tender or permit procedures for competitive advantage
• Leaking phone lists, address lists or similar data to outsiders

Concrete scenario:

An employee looks up a shopkeeper’s permit or penalty information in the municipal system and passes it to a third party, resulting in pressure on the shopkeeper and reputational harm.

KVKK risk and institutional responsibility

Even if an employee is personally at fault, the institution faces questions under KVKK Article 12: Were permissions restricted? Were access logs kept and monitored? Were training and disciplinary mechanisms in place?

Control set (reducing internal abuse)

• Mandatory logs of record viewing + regular reporting
• Anomaly detection: opening a large number of records in a short time
• Dual control (four-eyes principle): for access to highly sensitive data
• Disciplinary procedure: internal KVKK breach policy with clear sanctions
• Purpose statement: choose a reason from a dropdown when opening a sensitive record, with an audit trail

4️⃣ Cookies Collected on Websites

A common issue on municipal websites is a banner that allows analytics or advertising tags to run before consent, or a flawed design such as “continuing means acceptance”.

Frequent errors

• Google Analytics / Tag Manager is triggered before consent has been given
• No reject button / unequal visibility of choices
• Cookie categories unclear: advertising under "performance cookies"
• Uncontrolled third-party scripts (maps, videos, social-media embeds)
• Cookie policy and privacy notice are disconnected

Concrete scenario:

The municipal site sets third-party cookies through Analytics and embedded YouTube as soon as a page opens; the script has already loaded even if the user chooses “Reject”.

Minimum technical standard (applicable to municipality)

• CMP (cookie management platform) or equivalent mechanism
• Analytics, advertising and third-party scripts must not load before a consent signal is received
• A visible “Reject” option requiring only one click
• Cookie inventory: name, provider, purpose, duration, category
• Logging: consent time + preference record

5️⃣ Skipping KVKK Processes in New Municipal Projects

The mistake “Meet the project deadline; deal with KVKK later” is common in mobile apps, smart-city sensors, AI-supported call centres or Beyaz Masa services, facial recognition or PDKS attendance systems, and social-assistance scoring or prioritisation.

Steps most often skipped

• Data inventory not prepared before development begins
• Relying on consent without analysing the legal basis
• Collecting “whatever we can” without data minimisation
• No KVKK clauses in supplier contracts
• Use of real data in a test environment
• No DPIA-like risk assessment for high-risk projects

Concrete scenario:

A smart-city project collects device identifiers or MAC-like data and location data through public-transport Wi-Fi; no privacy information is provided, and retention is unclear.

Solution: a project KVKK approval gate (governance / go–no-go)

Each new project should pass a go–no-go review before launch:

Control	Question	Output
Data types	Does it involve personal data or special categories of personal data?	Inventory
Legal reason	On what basis will it be processed?	Legal analysis
Retention	How long will it be kept, how will it be destroyed?	Retention and destruction rule
Transfer	Is there a transfer abroad?	Transfer assessment
Authorization & access	Who will have access, and how will RBAC work?	Permission matrix
Logging	Can we trace who did what?	Log plan
Privacy information	Which screens and notices will inform people?	Text set
Supplier	Does the contract include provisions governing the processor?	Contract appendices

The project should not launch without passing this approval gate.

6️⃣ Institutional complacency

“We posted a KVKK notice; we’re done” reflects an institutional culture problem, rather than a technical one. KVKK compliance needs a functioning control system, rather than just a set of documents. Municipal success requires senior-management ownership in practice.

Symptoms of underestimation

• The KVKK lead or team is treated as handling “mere paperwork”
• Units think KVKK is "the obstacle that slows things down"
• Breaches are blamed on “staff error” without systemic corrective action
• Trainings are formality; no measurement and follow-up
• No budget for logging, access controls, deletion or destruction

Practical institutional response model:

• A KVKK compliance programme approved by senior management
• Appoint departmental data stewards
• Annual audit plan + violation simulation
• KPIs: permission-review rate, incident-response time, training test scores, deletion and destruction compliance

✅ Municipal quick-diagnosis checklist (10 items)

1. Are any accounts or passwords shared?
2. Are departing employees’ accounts closed?
3. Is it logged who viewed each record?
4. Is there a phone authentication?
5. Are sensitive data screens masked?
6. Do cookies work before consent?
7. Do new projects pass a KVKK approval gate?
8. Do supplier contracts include KVKK clauses governing processors?
9. Is real data being used in a test environment?
10. Does senior management take responsibility for KVKK compliance?

Note: According to the source’s heuristic, if three or more answers are “no”, the municipality has a high-risk systemic gap in its controls.

Request a municipal KVKK risk assessment and compliance programme