KVKK and Data Security Standards in Educational Institutions

The Importance of Personal Data in Education

Educational institutions are among the organisations processing the most sensitive categories of data under the Personal Data Protection Law No. 6698 (KVKK).

Students' identity and contact details, parents' financial/contact records, mock exam net scores, private guidance consultation notes and health/attendance records are data that must be protected by law.

1. Institutional Data Isolation and Access Controls

Traditional software stores all institutions' data in a single database and filters it at the application layer. This creates the conditions for serious security vulnerabilities.

In the AktEdu architecture: * **Multi-Layer Institutional Isolation:** Each institution can query only its own students. * **Teacher Authorisation:** A subject teacher can access only the data of their assigned groups; they cannot view other groups or general guidance notes. * **Student Portal:** Students can see only their own reports and study schedules.

2. Audit Logging and Historical Tracking

One of the most important technical requirements for KVKK compliance is recording who accessed data and when.

In the system: - When a student's grade is changed, - When a new parent phone number is added, - When a report is exported (Export)

the identity of the staff member performing the action, their IP address and a timestamp are written to immutable logs.

3. Duty to Inform and Explicit Consent

Educational institutions must provide parents and students with a transparent **Privacy Notice** during enrolment. AktEdu guides institutions through their legal processes and provides infrastructure that meets 100% of technical and administrative measures.