Your IT security team has sent a questionnaire about the payroll tool that runs Turkey. It asks who can see salaries, how bank files leave the system, and what happens if the provider loses a database. HR has a brochure and a certificate. Neither answers the questions, and the review is now blocking the contract.
This is the usual gap when companies buy payroll software in Turkey. Payroll data is among the most sensitive records an employer holds, yet security is often judged from a logo on a slide. This guide gives HR and IT a shared checklist for payroll software in Turkey. It names the controls to require, a quick demo test for each, and the evidence that proves them. Datassist has run Turkish payroll for more than two decades, and the requests below are the ones we see global security teams make most often.
Table of Contents
- What Turkish Law Expects From Payroll Software Security
- Payroll Software Turkey: The Security Features to Require
- Software Controls vs Outsourcing Governance
- The Evidence Pack to Request Before You Sign
- Red Flags in a Security Demo
What Turkish Law Expects From Payroll Software Security
There is no separate statute for payroll software. The rules come from Turkey’s Personal Data Protection Law, Law No. 6698, known as KVKK. Three points shape how you should judge payroll data security.
First, Article 12 requires the data controller to take all necessary technical and organizational measures to prevent unlawful processing of personal data, prevent unlawful access, and protect the data. Your company is normally the controller of its payroll data. Second, when another party processes data on your behalf, the same article makes the controller jointly responsible with that party for those measures. Buying software from a vendor does not hand the duty to the vendor. Third, the Personal Data Protection Board’s Decision 2019/10 reads the breach-notice duty as notification to the Board within 72 hours of the controller learning of the breach.
Payroll files also hold more than names and salaries. They carry national ID numbers, bank account details, family status, garnishment orders, and sometimes health reports. Some of that falls under the special categories of personal data in Article 6, which carry stricter processing conditions.
Regulation Note: The 72-hour clock runs from the moment your company learns of a breach. A provider that takes days to tell you has already used most of it. This is why incident handling belongs in the software evaluation, not only in the contract.
Payroll Software Turkey: The Security Features to Require
Use the seven areas below as a scoring grid. For each one, ask the vendor to show the control working, not to describe it. Good payroll software security leaves evidence you can screenshot, export, or test.
1. Access control: MFA and role-based permissions
Payroll access controls decide who can see salaries, change bank details, and approve a pay run. Require multi-factor authentication for every user, with stricter rules for administrators and payroll approvers. Require role-based access so an HR business partner sees one department, a finance reviewer sees totals, and only named people can edit bank accounts.
The demo test: ask the vendor to create a read-only reviewer, log in as that user, and try to open a salary record outside the assigned scope. Also ask how quickly a leaver’s access is removed and whether access reviews can be exported for your auditors.
2. Audit trail: who changed what, and when
A payroll audit trail is your proof when a number is disputed. It should record the user, the time, the old value, and the new value for salary changes, bank detail edits, approvals, and report exports. Logs should be protected from edits by the same users who make payroll changes.
The demo test: change a bank account in front of the vendor, then ask to see the log entry and export it. If the entry does not show the previous value, the trail will not stand up in an internal audit. In our payroll compliance audit work, missing change history is a gap reviewers flag early.
3. Encryption in transit and at rest
Ask what protects data on the wire, in the database, and in backups. Then ask who holds the encryption keys and how they are rotated. “Encrypted data” with no detail on keys is not an answer.
Also check exports. Payslip PDFs, bank files, and reports often leave the platform, so ask how they are delivered and whether links expire. Datassist describes its Dakika platform as using KVKK-aligned, end-to-end encrypted data management on ISO 27001 and ISAE 3402 certified infrastructure. Whatever a vendor says, ask for the evidence pack described below instead of relying on a product page.
4. Integrations and data transfers
Payroll data is often most exposed between systems rather than inside them. Map every flow: time and attendance in, accounting out, HRIS or ERP sync, bank payment files, and spreadsheets used for variable pay. For each one, ask how it authenticates, who owns the credentials, and what is logged.
Prefer API connections with scoped, revocable keys over shared mailboxes and manual uploads. A vendor with tested connectors to systems such as SAP, Workday, or SuccessFactors will have fewer manual hand-offs to secure. When data moves outside Turkey, for example to group headquarters, confirm which transfer route applies under Article 9 of KVKK before the first file is sent.
5. Backups and recovery
Payroll cannot miss a pay date because a server failed. Ask for the backup scope, where backups are stored, how often restores are tested, and what recovery targets the vendor commits to. A written business continuity plan and a disaster recovery plan should exist and be available for review.
The demo test: ask when the last restore test was run and request the summary. A backup that has never been restored is an assumption.
6. Incident handling
Ask who monitors the platform, how a suspected incident is classified, and how fast you will be told. Get the notification channel and the named escalation contacts in writing. Align the provider’s duty to inform you with your own 72-hour obligation to the Board.
Ask for the vendor’s breach response plan and a description of the last exercise. A plan nobody has rehearsed is a guess.
7. Vendor evidence and sub-processors
Certificates matter, but only with scope and dates. Ask for the ISO 27001 certificate with its scope statement, the current ISAE 3402 report with its period and any exceptions, and a recent penetration test summary. Request the current sub-processor list with locations, because every sub-processor is another place payroll data can sit.
Datassist publishes a Trust Center that lists these documents. They include its ISO 27001:2022 certificate, ISAE 3402 SOC report, penetration test report, and business continuity and disaster recovery plans. Each is available on request, and some require a non-disclosure agreement. Asking every vendor for the same pack makes comparison fair.
Software Controls vs Outsourcing Governance
Security questions get muddled when two different things are bundled together. Software controls are what the platform does: login rules, permissions, logs, encryption, backups. Outsourcing governance is how people operate the process around it: who prepares the data, who approves it, who answers when something looks wrong.
If you run payroll in-house on the software, your team owns most of the governance. You decide who gets access and when to review it. If you buy a managed payroll outsourcing service, the provider’s staff also touch the data. You then need the staff-side controls too: background checks, confidentiality terms, and segregation of duties between preparers and approvers.
For the provider-side questions, see our KVKK payroll outsourcing checklist. Do not let one stand in for the other. A platform with excellent encryption can still leak data through an emailed spreadsheet. A careful service team can still be undermined by weak platform permissions. Ask for both sets of answers, and score them separately.
The Evidence Pack to Request Before You Sign
Turn the checklist into a document request your security team can file. The table links each control to proof.
| Control area | What to ask for | What a good answer shows |
|---|---|---|
| Access | Role matrix, MFA policy, sample access review | Named roles, least-privilege scopes, review dates |
| Audit trail | Log export for a test change | User, time, old value, and new value |
| Encryption | Encryption standard summary and key ownership | Coverage for transit, storage, and backups |
| Integrations | Data flow diagram and credential policy | Each feed mapped with an owner |
| Recovery | BCP, DR plan, latest restore test summary | Dates, scope, and results |
| Incidents | Breach response plan and contact list | Notification path that fits your 72-hour duty |
| Vendor assurance | ISO 27001 certificate, ISAE 3402 report, pen test summary | Scope, period, exceptions, and remediation |
Build these requests into the tender rather than asking after selection. Our guide to payroll software for companies in Turkey covers the wider buying criteria, and the payroll migration checklist shows where security sign-off fits into a switch.
Red Flags in a Security Demo
Watch for these signals during vendor sessions:
- The vendor shows certificates but cannot say what the scope covers.
- Administrators can see every salary with no way to restrict the view.
- The audit log records that something changed but not the previous value.
- Bank files are sent by email or shared drive as a normal step.
- No one can say when a backup restore was last tested.
- Sub-processors are described as “trusted partners” without a list.
- Answers to security questions are promised “after contract signature.”
Any single flag is worth a follow-up. Several together are a reason to pause the evaluation.
Frequently Asked Questions
What security features should payroll software in Turkey have?
At a minimum, look for multi-factor authentication, role-based access, and a detailed audit trail. Add encryption in transit and at rest, controlled integrations, tested backups, a documented incident process, and verifiable certifications with scope.
Does KVKK apply to payroll software?
Yes. Payroll data is personal data, and Article 12 of Law No. 6698 requires the controller to take technical and organizational measures. Using a vendor does not remove that duty, because the controller stays jointly responsible with the party processing data on its behalf.
Is an ISO 27001 certificate enough proof of payroll data security?
No. It shows the vendor runs an information security management system within a defined scope. Check that the payroll platform and the hosting are inside that scope, and ask for the certificate date and certifying body.
How fast must a payroll data breach be reported in Turkey?
Under Board Decision 2019/10, the controller notifies the Personal Data Protection Board within 72 hours of learning of the breach. Agree with your provider how and when it will inform you so you can meet that window.
Who should own the security review, HR or IT?
Both. HR knows which payroll data flows exist and who needs access. IT or security tests the controls and reads the evidence. A shared scoring grid prevents either team from signing off alone.
Key Takeaways
- Judge payroll software security by evidence you can test, not by certificates alone.
- Under KVKK Article 12, your company stays responsible even when a vendor processes the data.
- Require MFA, role-based access, and an audit trail that stores old and new values.
- Map every integration and transfer, because payroll data is often most exposed in transit between systems.
- Score software controls and outsourcing governance separately.
- Ask for scope, dates, and exceptions with every certificate and report.
Secure Payroll Software in Turkey: The Bottom Line
The best payroll software security reviews are short and run on documents. HR lists the data flows, IT tests the seven control areas, and the vendor answers with exports and reports. A vendor that welcomes that process is usually a safer partner than one that leans on a logo.
If your team is comparing payroll software for Turkey, Datassist can walk your HR and IT reviewers through its Dakika platform and the documents in its Trust Center. Discuss payroll requirements with Datassist and bring your security questionnaire. We will answer it with evidence, and our payroll software team will show the controls in the platform itself.
This article is for informational purposes only and does not constitute legal advice. For up-to-date Turkish regulations, consult official sources or contact a qualified advisor.
Related Reading
- Payroll Software for Companies in Turkey: 2026 Buyer’s Guide – The wider criteria for choosing Turkish payroll software
- Payroll Migration Checklist: How to Switch Providers Without Missing Payday – Where security sign-off fits when changing providers
- Payroll Outsourcing in Turkey: In-House vs Outsourced Cost and Risk – How operating models change who controls payroll data
