Training module
Personal data and privacy
What counts as personal data, why collecting less is the strongest protection and how to share and delete with care.
What you will be able to do
- Tell personal data from other information.
- Apply data minimisation when a form asks for more than it needs.
- Share files and delete accounts in a way that leaves little behind.
What counts as personal data
Personal data is any information that relates to an identified or identifiable person: a name, an identity number, an address, a phone number, a photo, a location trail, an online identifier. Information that looks harmless alone, such as a postcode and a birth date, can identify someone when combined.
The strongest protection is not collecting
Data that is not collected cannot leak. For an individual, that means asking whether a form really needs a phone number or a birth date, and leaving optional fields empty. For an organisation, it means keeping only what a purpose requires, for as long as it requires it. This principle, called data minimisation, is a core idea in data protection law and security guidance alike.
Sharing with care
Prefer a link with an expiry date and a password, or access limited to named people, over an attachment that stays in many mailboxes. Check who has access to shared folders from time to time and remove people who no longer need it. Photos carry hidden details such as time and, often, location; check what your phone adds before posting.
Closing what you no longer use
An old account is a liability: it holds data, it may have a reused password, and nobody is watching it. Delete accounts you no longer use instead of just abandoning them, and remove the data from services where the settings allow it. Your password manager's list is a good inventory to work from.
Rights and the law, briefly
In Turkey, Personal Data Protection Law No. 6698 governs how personal data may be processed, and its Article 12 obliges the controller to take the technical and administrative measures needed for an appropriate level of security. For your own case, read the current text at the official source and, where it matters, ask a lawyer; this module is a general introduction and not legal advice.
Key points
- Combined details can identify a person even when each looks harmless.
- Collect, share and keep as little as the purpose needs.
- Delete accounts you no longer use.
Check yourself
Choose an answer to see the explanation. You can start again at any time.
1. Which item is personal data?
A photo that lets someone be identified relates to an identifiable person.
2. A free newsletter form asks for your birth date and phone number as required fields. What is the sound response?
Data minimisation: a purpose such as sending a newsletter needs an address, not a birth date.
3. Which way of sharing a sensitive document leaves the least behind?
Access can be withdrawn, and the file does not live on in other mailboxes.
Go further
Sources
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).