Kamu Sektöründe Veri Yönetimine İlişkin Anonimleştirme, Silme ve Yok Etme Süreçlerinin Hukuki ve Teknik Açıdan Değerlendirilmesi: Aydın İli Örneği
Bireylerin mahremiyetini korumanın giderek zorlaştığı kamu kurumlarında kişisel verilerin güvenli biçimde saklanması ve işlenmesi için teknik ve idari boyutları içeren politika ve prosedürlere olan ihtiyaç her geçen gün artmaktadır. Bu çalış5 mada kamu kurumlarındaki veri yönetimi süreçleri, hukuki düzenlemeler, teknik gereksinimler ve uygulamada karşılaşılan zorluklar çerçevesinde incelenmiş ve tespit edilen eksikliklere yönelik çözüm önerileri sunulmuştur. Araştırma kapsamında, Aydın ilindeki 103 kamu kurumunun yöneticileri, idari ve teknik personeliyle yüz yüze görüşmeler gerçekleştirilmiş, yarı yapılandırılmış sorular yöneltilmiştir. Bulgular, veri yönetim politikalarının genellikle merkezi yönetimle sınırlı kaldığını, taşra teşkilatlarında etkin uygulanmadığını göstermiştir. Veri anonimleştirme, silme ve yok etme süreçlerinde K5anonimlik, L5çeşitlilik ve T5yakınlık gibi teknik yöntemlerin kullanılmadığı; risk analizleri ve veri eğitimlerinin yetersiz olduğu tespit edilmiştir. Ayrıca, veri silme süreçlerinin çoğunlukla dosya sistemi düzeyinde pasifleştirme ile sınırlı olduğu ve bu durumun güvenlik risklerini artırdığı belirlenmiştir. Çalışmada, teknik prosedürlerin ulusal ve uluslararası düzenlemelerle uyumlu hale getirilmesi ve kamu kurumlarında uygulanabilir bir veri yönetimi çerçevesinin oluşturulması gerekliliği vurgulanmıştır.
Legal and Technical Evaluation of Anonymization, Deletion and Destruction Processes Related to Data Management in the Public Sector: The Case of Aydın Province
Safeguarding personal data in public institutions is becoming increasingly important due to growing risks to individual privacy. This study examines legal and technical challenges in data management within the Turkish public sector, focusing on anonymization, deletion, and destruction processes. Semi5structured interviews were conducted with administrators and personnel from 103 public institutions in Aydın province. Findings reveal that data management policies are largely centralized and rarely implemented effectively in local branches. Technical methods such as k5anonymity, l5diversity, and t5closeness are not employed, and risk analysis procedures are insufficient or undocumented. Data deletion practices are often limited to superficial file system deactivation, increasing the risk of data recovery. Training programs on data governance are infrequent and lack depth. The study highlights the absence of standardized practices for secure data handling at the local level, despite existing national and international legal frameworks. It recommends developing an applicable and auditable data management framework for public sector institutions that aligns with privacy legislation and ensures organizational accountability. By addressing both regulatory and procedural gaps, this research contributes to the advancement of secure, transparent, and rights5respecting data governance in public administration.
In an era where personal data flows have become integral to public service operations, ensuring data security, privacy, and legal compliance has emerged as a critical challenge for public institutions. This study investigates the data governance landscape within the Turkish public sector by focusing on the legal, technical, and organizational dimensions of anonymization, deletion, and destruction processes. Despite the existence of national regulations such as the Turkish Personal Data Protection Law (KVKK), discrepancies between central and regional data management practices persist. This research provides a comprehensive evaluation of these inconsistencies and offers practical recommendations to establish a harmonized and enforceable data governance framework.
The study employs a qualitative research design based on semi5structured interviews with managers, administrative staff, and IT personnel in 103 public institutions located in Aydın province. The data collection process involved face5to5face interviews guided by a flexible set of open5ended questions aimed at exploring institutional awareness, technical infrastructure, regulatory compliance, and procedural implementation concerning data protection and management.
The results reveal that although public institutions demonstrate a general awareness of data protection require5 ments, substantial gaps exist in terms of practical implementation. One key finding is that data governance strategies are often limited to central authorities, with regional offices lacking the autonomy or expertise to operationalize relevant procedures. This imbalance creates a significant vulnerability in the public sector’s ability to maintain secure and legally compliant data practices across decentralized units.
From a technical standpoint, methods for data anonymization, such as k5anonymity, l5diversity, and t5closeness, are rarely employed, even though they are widely accepted in privacy5preserving data analytics. Most institutions still rely on rudimentary approaches such as logical deletion (file deactivation) instead of irreversible deletion or secure overwriting methods. This limited technical capacity elevates the risk of unauthorized access and data leakage, particularly in cases of external audits or cybersecurity incidents.
Institutional policies on data classification, access control, backup, and disposal are either missing or inconsistently applied across different departments. Where such policies exist, they tend to be centrally managed by IT units with minimal input or oversight from legal or administrative departments. Moreover, the absence of a unified data responsibility matrix means that individual accountability for data handling is often unclear, leading to fragmented implementation and poor coordination during data lifecycle transitions (e.g., from collection to deletion).
Another significant barrier identified is the inconsistent interpretation of the legal obligations outlined in the Regulation on the Deletion, Destruction, and Anonymization of Personal Data. Although this regulation derives from KVKK, many public institutions—especially those exempt from registration in the Data Controllers' Registry (VERBIS) —struggle with defining the scope and depth of their compliance duties. This ambiguity is particularly pronounced in public agencies operating in the domains of social services and local governance, where data5intensive programs are prevalent, but internal control mechanisms are weak or outdated.
The study also finds that employee training on data protection remains insufficient in both frequency and content. Central authorities may offer periodic training sessions, but regional units report limited participation and poor retention of information. As a result, frontline personnel who directly handle sensitive data often lack the necessary skills to identify potential vulnerabilities or apply preventive measures. This lack of capacity further compounds institutional exposure to risks such as unauthorized disclosures, legal sanctions, and reputational damage.
Importantly, the research underscores the need for a multi5dimensional data governance framework that bridges regulatory mandates with practical enforcement mechanisms. Such a framework should include standardized procedures for data anonymization, deletion, and destruction; clearly defined roles and responsibilities; mandatory training programs; and periodic audits to ensure compliance and accountability. The establishment of a centralized but adaptable data governance model would also facilitate better coordination between central and local units, allowing for uniform implementation without compromising operational flexibility.
In conclusion, this study contributes to the broader discourse on public sector digital transformation by highlighting the critical role of secure data governance in ensuring citizen trust, institutional transparency, and regulatory compliance. As public institutions increasingly adopt digital tools for service delivery, investing in robust data management policies and infrastructures is no longer optional but essential. The findings are particularly relevant for policymakers, public administrators, and data protection officers seeking to align institutional practices with both national regulations and global standards in data privacy and security.