Why data is your most valuable and riskiest asset

Organizations know their data is valuable; the way they protect it rarely reflects that knowledge. Anything valuable is tracked simultaneously in an inventory, a backup, an access list and a disposal schedule. This is seldom done for data, because data does not sit in one place and does not have one owner. This entry explains why personal data, special-category data, trade secrets and competitively sensitive information need to be handled under a single “data” roof, where that data accumulates, and why it becomes invisible.

Four classes of data, one responsibility

The data an organization must protect should be classified by consequence rather than by origin. When it is exposed, who is harmed, and how? Looked at that way, four sets emerge.

Personal data. Any information relating to an identified or identifiable natural person: national ID number, name, phone, email, address, IBAN, vehicle plate. In Türkiye the processing of this set is governed by the Personal Data Protection Law (KVKK) and the secondary regulation issued by the Personal Data Protection Authority.

Special-category personal data. A narrower set, including health data, biometric data, criminal convictions and security measures, and association or union membership, whose exposure can come back to the person as discrimination or serious harm. The Authority has published a dedicated guide for this set; its operational message is that this data demands tighter access, narrower purpose and shorter retention.

Trade secrets and company secrets. Information that belongs to the organization rather than to a person, is not public and derives economic value from its secrecy: product formulas, source code, customer lists, strategic plans, merger and acquisition files. The protecting law is different here, but the mechanism for managing the data, knowing where it is and who can reach it, is the same.

Competitively sensitive information. Current or future prices and discounts, bid and tender terms, costs and margins, customer-specific terms, capacity and production plans. This information is legitimately produced and used inside the organization; the risk arises when it is shared with competitors or circulates without control. The Turkish Competition Authority’s guidelines explain under which conditions information exchange between undertakings becomes a problem; this entry offers no legal interpretation and looks only at where the information accumulates.

These four sets answer to different legislation, different advisers and, often, different teams. On the organization’s disks, in its databases and in its mail archives, however, they sit side by side. An HR folder can hold payroll (personal data), an occupational physician’s report (special-category data) and collective bargaining notes (trade secret) in the same tree. A sales folder keeps customer contact details and the price list in the same spreadsheet. Treating data as separate projects by legislation means scanning the same folder three times, or not at all.

Where data accumulates

The gap between where data is and where it is supposed to be is the real subject of data governance. Data accumulates through a few typical mechanisms.

• Copying. A report is exported from the core system, pulled into a spreadsheet, dropped into a shared folder, attached to an email, saved to a personal OneDrive. Every copy is as real as the original, but none carries the original system’s access control.
• Archiving. Projects end, employees leave, mailboxes are exported to PST files and parked in a corner of a file server. An archive becomes invisible the moment its contents are forgotten.
• System migrations. The old ERP’s tables are moved to the new system; the old database is left running “just in case”. Nobody reads it, but the grants are still valid.
• Collaboration platforms. SharePoint sites and Teams channels are opened for a project, files are shared by link, the project ends, and the links and site memberships remain.
• Object storage. Application logs, backups and exports are written to S3-compatible buckets; the bucket policy stays as it was set on day one.

The table below shows, by way of example, where each of the four classes typically accumulates. These are recurring patterns seen in the field, not statistics.

Data class	Typical accumulation point	Typical reason for invisibility
Personal data	HR and accounting shares, CRM exports, database columns	Column names do not describe content; copies multiply
Special-category data	Occupational health folders, insurance files, access control systems	Mixed with other documents inside one folder
Trade secrets	R&D folders, board files, source code repositories	Unlabelled; assumed secret while the ACL is wide
Competitively sensitive information	Sales and tender folders, price lists, email attachments	Not personal data, so it enters no inventory at all

Why data becomes invisible

Invisibility is not a system fault; it is the natural outcome of everyday work. Data has a context at the moment it is created: which system, which purpose, whose responsibility, for how long. Every copy, move and archive step drops a piece of that context. The file keeps its function but loses its ownership, its purpose and its retention period.

The second cause is that inventories rest on declarations. An inventory collected through a questionnaire reflects the data a department head knows about and remembers. It does not reflect the export left on the desktop of someone who left four years ago. Building the VERBİS inventory from a survey rather than from discovery carries this invisibility straight into the official record.

The third cause is that access and content are managed by different teams. The system administrator knows the ACLs but not what is in the folder; the business unit knows the content but not who can reach it. A payroll file shared with “everyone in the organization” looks normal to both sides from their own vantage point.

The fourth cause is specific to Turkish data. Identifiers such as the national ID number (TCKN), Turkish IBANs and Turkish phone numbers have particular formats; detection tools tuned for other languages either miss them or produce noise in Turkish text. Once the false-positive rate rises, teams stop trusting the findings, and the data becomes invisible once more.

Value and risk are two faces of the same coin

The value of data grows with the number of people who can use it; so does its risk. The debate between “lock the data down” and “open it to everyone” is therefore framed wrongly. The right question is which data sits at which confidentiality level, and what access is appropriate to that level.

A public product catalogue and a top-secret merger file can sit on the same file server; managing both under one access policy either restricts the catalogue needlessly or opens the merger file needlessly. Confidentiality level is therefore the common measure of both value and risk. Once a taxonomy (type, confidentiality level, business category) is in place, access policy and retention schedule can be tied to it, and decisions are made at the label level rather than file by file.

This view is consistent with the proportionality logic of KVKK: data is processed only as far as its purpose requires, by those who need it and for as long as needed. The same logic corresponds to the “need to know” principle for trade secrets and to “limited distribution” for competitively sensitive information. Three bodies of law, one operational rule.

One roof: unifying data governance

Handling the four classes under one roof does not mean merging legal responsibilities; the KVKK obligation stays with the data controller, the competition-law obligation with the undertaking, trade-secret protection with contracts and internal policy. What is unified is the mechanism: one discovery, one classification, one access graph, one remediation flow, one evidence chain.

The practical consequence is this. A file server is scanned once; each file is labelled with type, confidentiality level and business category; the label triggers the rules of whichever process it corresponds to. An occupational physician’s report is marked as special-category data and enters the KVKK readiness score as a “special-category data in wide sharing” gap. A tender file found in the same scan falls into the competitively sensitive category and lands in the competition-compliance module’s review flow. Two findings, two different teams, one scan and one audit trail.

How Seratus closes these gaps

Each of the invisibility mechanisms described in this entry corresponds to a concrete capability in Seratus.

• Four data classes searched in separate projects with separate tools. Seratus assigns type, confidentiality level and business category in the same scan with a single taxonomy; personal data, special-category data, trade secrets and competitively sensitive information appear in the same findings list with the same access context (data classification).
• Data piling up in copies and archives that nobody remembers. Agentless discovery scans file servers, local disks, Microsoft 365, databases, object storage and PST/OST/MSG archives over read-only connections; an interrupted scan resumes where it stopped (agentless DSPM, email archives).
• Content and access living in different teams. The access and exposure graph places ACLs, sharing links and database roles next to the content finding; special-category data readable by “everyone in the organization” is ranked by risk (access and exposure graph).
• Low confidence on Turkish identifiers. The Turkish-specific detection engine applies separate rules and a false-positive reduction program for TCKN, tax ID, Turkish IBAN, phone and plate numbers; every finding is reviewed with a confidence percentage and a masked sample (Turkish detection accuracy).
• Competitively sensitive information entering no inventory. The competition-compliance module detects documents and communications using categories defined in the organization’s taxonomy (prices, bid and tender terms, costs and margins, customer terms, capacity plans), shows who has access and routes them into an approved review flow.
• Labels not tied to action. In Seratus, labels are tied to policy and to retention and disposal processes; “data past its retention period” is listed as a gap and enters the approved disposal flow (KVKK compliance).

Takeaway

Data is the organization’s most valuable asset because the business runs on it, and its riskiest asset because it is copied, moved, forgotten and left ownerless. Handling personal data, special-category data, trade secrets and competitively sensitive information as separate projects means scanning the same folder three times or not at all. One taxonomy, one discovery and one access graph make it possible to manage these four sets with a single operational discipline while keeping each tied to its own body of law. The next entry takes up why that discipline has to begin with discovery.