Information Security and Personal Data Protection Policy

Istanbul Beykent University’s Information Technology Department manages information security processes in compliance with the ISO/IEC 27001:2013 Information Security Management System (ISMS) standard and takes all necessary administrative and technical measures in accordance with the Personal Data Protection Law No. 6698 (PDPL). Our primary goal is to protect the organisation’s information assets, ensure the security of personal data, and minimise operational risks.

ISO 27001: Information Security Management System (ISMS) Practices

The principles of confidentiality, integrity, and availability are taken as the basis for ensuring information security. The technical measures implemented in this context include:

• Risk management and regular assessment of information assets
• Policy and procedure documentation, implementation and monitoring of ISMS processes
• Continuous improvement of systems through regular internal and external audits (ISMS Internal Audit)
• Developing and testing incident management and disaster recovery (DRP) processes

PDPL Compliance Processes and Personal Data Security

Within the scope of the PDPL No. 6698, administrative and technical measures are taken for the processing and protection of personal data:

• Preparation of a personal data inventory and process-based data classification
• Implementation of data masking, anonymisation, and encryption methods
• Effective management of access authorisation and logging processes
• Development of data breach notification mechanisms and crisis management processes
• Implementation of data retention and destruction policies

Technical Measures and Security Solutions

1. Network and System Security

• Intrusion Detection and Prevention Systems (IDS/IPS)
• Advanced Security Firewalls (Next-Generation Firewall) and VPN services
• Isolation of critical systems through network segmentation
• Penetration testing and regular vulnerability scans

2. Data Security

• Data encryption and integrity checking
• Centralised backup and disaster recovery infrastructure
• Data Loss Prevention (DLP) solutions for protecting sensitive data

3. Identity and Access Management

• Multi-Factor Authentication (MFA) and Single Sign-On (SSO)
• Access control matrices and user authorisation controls
• Anomaly detection through logging and monitoring systems

4. Malware and Email Security

• Antivirus and antimalware solutions
• Email security scanning and phishing protection
• Digital signature and email encryption services

5. User Awareness and Training Programmes

• Information security awareness trainings and simulations for social engineering attacks
• Personal data protection awareness sessions
• Secure password policies and data sharing protocols

Aim and Continuity

The aim is to maintain continuity of systems, effective management of risks and full compliance with legal requirements. Audits within the framework of ISO 27001 ISMS, along with compliance efforts with the PDPL, are continuously monitored and updated.