Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Cross-Border Transfers and Breach Readiness: Cloud Regions, LLM Providers, Standard Contracts and the 72-Hour Notification
A transfer abroad is not only where the server is; logs, backups, e-mail, analytics and LLM prompts are transfers too, and since 2024 they must rely on an adequacy decision, an appropriate safeguard such as a standard contract, or an occasional case. On Bookstore we keep the sub-processor inventory in code, check the five-business-day notification of standard contracts at start-up, and use an access log to get a breach's scope and the 72-hour deadline within the first hour.
Privacy Notices, Explicit Consent and Cookies: Recording Consent, Cookie Banners, Consent Mode and Commercial Message Permissions (İYS)
A privacy notice is given for every processing activity, while explicit consent is obtained separately and only where processing relies on it; consent must be provable, versioned and revocable. On Bookstore we build an append-only ConsentRecord, an Angular banner with equal buttons following the Authority's cookie guide, Google Consent Mode with a denied default, Playwright tests that verify them, and reporting commercial e-mail permissions to İYS within three business days.
Personal Data in Logs, Telemetry and Analytics: URLs, Exception Messages, IP Addresses, Session Replay and Error Reporting Tools
Personal data rarely enters logs through a LogInformation call; it gets in through an e-mail address in the URL, a record passed to a log message, an exception message, a span tag or a metric label. On Bookstore's checkout flow we show these leaks with real output, lock them down with a test that searches for canary values, clean browser error reports, truncate IP addresses and add telemetry to the inventory.
Retention, Deletion and Anonymisation: "Delete My Account", Soft Delete, Backups, Caches and the Periodic Destruction Job
A "delete my account" request is not one DELETE but a separate decision for every piece of data: the profile is erased, orders are detached from the person and kept for the legal period, then anonymised. On Bookstore we show the foreign key pitfall, why soft delete is not enough, how each copy is erased, the periodic destruction job, the destruction log and how an erasure ledger stops erased customers from returning after a backup restore, with real output.
Protecting Personal Data: Always Encrypted, Application-Level Encryption, Pseudonymisation, Masking and Test Data
The way to protect a sensitive personal data field is to choose the layer by threat: TDE protects the disk, Always Encrypted the DBA, application-level AES-GCM the backups and replicas, and masking only the screen. On Bookstore we encrypt the invoice national ID with purpose-bound AES-GCM, search it with an HMAC blind index, show it masked to support and move test environments to synthetic data with deliberately invalid IDs generated by Bogus.
Personal Data Inventory and Privacy by Design: Classifying Data, Marking It in Code and Minimisation
The technical half of a personal data inventory can be generated from code: we classify entities with Microsoft.Extensions.Compliance attributes and derive tables, columns, purposes, retention periods and copies from the EF Core model. A test that catches unclassified fields, a SQL Server sensitivity label script, minimisation decisions such as an age confirmation instead of a birth date, PCI DSS and LINDDUN on Bookstore, with real output.
KVKK and GDPR for Developers: Personal Data, Special Categories, Controllers/Processors and the Principles That Shape Code
Personal data is any information that another record can tie to a person, so hashed e-mail addresses, IP addresses and device IDs are personal data too. We cover the definitions of Turkey's Law 6698 and the GDPR, controllers versus processors, the endpoints behind data subject rights, what Law 7499 changed in 2024 and the KVKK–GDPR differences on Bookstore, with code that was run and primary sources; not legal advice.