# Privacy operations

Operate the data inventory through access, retention, deletion and request evidence.

SecNet.Work | 2026.10 | 2026-10-21

An inventory file alone does not show that privacy processes work. Link purpose, legal assessment, recipients and retention rationale to real systems. KVKK and GDPR have different scopes. This workpaper provides operational evidence rather than legal advice; relevant legal/privacy teams validate time limits, transfer mechanisms and obligations.

## Work boundary
Use synthetic records. Real data-subject requests and sensitive data remain in authorized organizational systems.

## Process

### 1. Trace purpose to system
Record data category, purpose, source, recipient and owner. Separate multiple purposes within one system. Reference the relevant legal assessment rather than assuming a lawful basis.

Expected evidence: Purpose–data–system mapping

### 2. Operationalize retention
Tie periods and rationale to owner/legal assessment. Distinguish production, archives, backups and provider copies. Explicitly record the effect of legitimate preservation needs on deletion.

Expected evidence: Justified retention and copy scope

### 3. Handle requests safely
Verify identity proportionately without unnecessary documents. Establish request scope, system owners and applicable response timing. Use a synthetic request to test controls against disclosure to the wrong person.

Expected evidence: Masked request and approval trail

### 4. Verify deletion and transfer
Sample-check deletion beyond the job-success message. Transparently record residual backups and recipient copies. Do not reduce cross-border assessment to a country name; link data paths, roles and appropriate mechanism assessment.

Expected evidence: Copy-specific result and open exception

## One control, three perspectives

### Operator
Which copies still contain data?
Tie deletion sampling to systems and copies.
Evidence: Copy-specific test

### Auditor
Are purpose and retention rationale traceable?
Link decisions to authorized assessment.
Evidence: Assessment reference

### Leader
Are request and breach risks managed?
Coordinate legal, data ownership and operations.
Evidence: Owned timeline and escalation

## Evaluate evidence

**Claim:** Data deletion is complete.

**Weak support:** The batch job reported “success”.

**Stronger support:** Production/archive samples, provider results and the remaining backup exception are linked to one request.

**Rationale:** A completed job does not prove deletion of every copy; explain scope and remaining copies.

## Decision desk
The main app was cleared for a deletion request; archive status is unknown.
Start: start

### start
First decision?

- **Verify copy scope and legal assessment** (good)
  You base the response on actual scope. Test the archive result next.
  Next: verify

- **Reply that everything was deleted** (risk)
  Unknown archive coverage does not support a definitive claim. Investigate remaining copies and exceptions.
  Next: repair

- **Close without a rationale** (incomplete)
  Deferring an open issue is not closure evidence. Record the uncertainty, owner and next verification step.
  Next: revise

### verify
The archive retains a record without a documented preservation decision.

- **Obtain an authorized retention decision and record it transparently** (good)
  Neither automatic deletion nor indefinite retention is assumed. Validate scope and rationale.
  Next: planned

- **Accept the claim without testing** (risk)
  The initial claim and observed result differ. Support closure with a repeatable check in the same scope, rather than a promise or ticket status.
  Next: revise

### repair
A response may have been sent to the wrong person.

- **Stop disclosure and assess incident/data impact** (good)
  Reassess identity and recipient verification. The authorized team evaluates applicable notification needs.
  Next: planned

- **Delete the earlier record and close** (risk)
  Deleting the earlier decision undermines learning and accountability. Link the new action to the prior record and keep the rationale and residual risk visible.
  Next: revise

### supported
This decision is supported by the evidence in the example. Verify closure conditions in your own scope.

### revise
The decision lacks support. Record the rationale and required evidence, then reassess.

### planned
A remediation path is defined. Keep the matter open until implementation and verification are complete.

## Worked example
Entirely fictional.
- Purpose: Example support record
- System / copy: Synthetic archive
- Owner: Support data owner
- Assessment: Fictional PRV-021
- Action: Validate retention decision
- Result / exception: Not closed yet

## Closure checklist
- [ ] Purpose and system match.
- [ ] Retention linked to legal assessment.
- [ ] Request identity verified proportionately.
- [ ] Copies and exceptions reported.

## Official sources
- [KVKK — Silme, yok etme ve anonimleştirme yönetmeliği](https://www.kvkk.gov.tr/Icerik/5441/KISISEL-VERILERIN-SILINMESI-YOK-EDILMESI-VEYA-ANONIM-HALE-GETIRILMESI-HAKKINDA-YONETMELIK)
- [EUR-Lex — Regulation (EU) 2016/679](https://eur-lex.europa.eu/eli/reg/2016/679/oj)

https://secnet.work/learn/toolkits/privacy-operations