Journal
Entries on data discovery, KVKK and GDPR practice, anonymization, access risk and competition-law compliance, written from what Seratus sees in the field. Each entry names the gap it closes and ends with questions people actually ask.
- Entry 20
19 October 2026Being audit-ready: the evidence chain behind every compliance claimAudit readiness through an audit log with who, when and why, an approval chain, the KVKK readiness summary and audit report, and evidence produced on-premises.audit · evidence chain · KVKK · on-premises - Entry 19
18 October 2026Trade secrets and company secrets: a DSPM view of critical dataTrade secrets fall outside KVKK yet are an organization's most critical data: confidentiality taxonomy, classification, access narrowing, departing employees.trade secrets · data classification · access control · DSPM - Entry 18
17 October 2026Turkish Competition Authority 2026 agenda: what it means for your dataThe Turkish Competition Authority's 2026 announcements on tenders, sector investigations, a sector inquiry and AI services, and what they mean for your data.competition law · Turkish Competition Authority · compliance program · data governance - Entry 17
16 October 2026Competition law compliance: competitively sensitive informationA concrete definition of competitively sensitive information, where prices, bids, costs and customer terms pile up, and how data controls reduce exchange risk.competition law · competitively sensitive information · compliance program · DSPM - Entry 16
15 October 2026File servers and mail archives: where forgotten personal data piles upHow old payroll, HR and customer data piles up on SMB/NFS shares, local disks and PST/OST/MSG archives, and how to handle unreadable permissions and quarantine.data discovery · file servers · mail archives · KVKK - Entry 15
14 October 2026Personal Data in Databases: Oracle, SQL Server and PostgreSQLColumn-level sampling, unmasked TCKN and IBAN columns, the role-to-table permission graph, and why not found in the sample is never a risk decision.databases · Oracle · SQL Server · PostgreSQL - Entry 14
13 October 2026Oversharing in Microsoft 365: Anonymous Links and Org-Wide AccessHow anonymous and organization-wide links accumulate in SharePoint, OneDrive and Teams, and how read-only Graph access and delta scanning measure oversharing.Microsoft 365 · SharePoint · oversharing · DSPM - Entry 13
12 October 2026Who Can Reach What? How Access and Exposure Analysis WorksHow to read ACLs, sharing links and database roles, and how departed users, unresolvable SIDs and cyclic groups quietly break least privilege.access analysis · exposure · least privilege · DSPM - Entry 12
11 October 2026Special Category Data and Biometrics: Where It Piles UpWhere health reports, ICD codes and biometric records pile up, and how to find the special category data overshared gap after the 2026/921 decision.special category data · biometric data · KVKK · health data - Entry 11
10 October 2026Anonymization vs Masking vs Pseudonymization: What DiffersWhen to use each method, which one takes data out of scope as personal data, how to measure quality, and the mistakes that recur in organizations; with a table.anonymization · masking · KVKK · disposal - Entry 10
09 October 2026Why anonymization matters: expired data, irreversibility and proofWhy personal data past its retention period should be anonymized, how irreversibility is measured with uniqueness checks and why the original must be destroyed.anonymization · KVKK · retention · disposal - Entry 09
08 October 2026Data subject requests under KVKK: the clock, the search, the evidenceHow data subject requests (DSAR) run under KVKK, why the statutory deadline is missed, how to find a person's data across sources and how to evidence the reply.KVKK · data subject request · DSAR · evidence - Entry 08
07 October 2026Building the VERBİS inventory from real discovery, not questionnairesWhy questionnaire-based VERBİS inventories decay, how a discovery-based inventory is built, and how to map findings to category, purpose and retention.VERBİS · KVKK · data inventory · data discovery - Entry 07
06 October 2026Corporate e-mail monitoring: what the 2026 KVKK decision changesPrinciple Decision 2026/2035 of 16 September 2026: technical versus legal access, proportionality, limits on content review and what it means for mail archives.KVKK · principle decision · email archives · access control - Entry 06
05 October 2026KVKK in 2026: principle decisions and their effect on data operationsTürkiye's 2026 KVKK principle decisions, announcements, webinar and guides, and their concrete effect on data discovery, access control and retention work.KVKK · principle decision · data operations · 2026 - Entry 05
04 October 2026KVKK: the operational duties of a data controllerInventory, privacy notices, retention and disposal, data subject requests, breach notification and VERBİS: KVKK duties in plain operational language.KVKK · VERBİS · data controller · compliance - Entry 04
03 October 2026What agentless scanning means: read-only data discoveryHow agentless data scanning works, how it connects to each source type, how an interrupted scan resumes, how it compares with agents, and where its limits are.agentless scanning · DSPM · data discovery - Entry 03
02 October 2026Why data discovery comes first: surveys are not enoughWhy a survey-based inventory decays, why DLP, policy and disposal fail without discovery, and what outputs a sound data discovery exercise must produce.data discovery · DSPM · VERBİS · KVKK - Entry 02
01 October 2026Why data is your most valuable and riskiest assetPersonal data, special-category data, trade secrets and competitively sensitive information belong under one roof: where they pile up and why they go invisible.data governance · KVKK · trade secrets · competition law - Entry 01
30 September 2026What is Seratus: agentless data discovery and KVKK consoleA product walkthrough of Seratus: the Define, Scan, Review, Remediate, Prove flow, who it is built for, and why it runs on-premises without agents.Seratus · DSPM · KVKK · data discovery