Digital Business Card Data Protection: What to Check

Digital business card data protection comes down to five checks: encrypted connections, controlled access, a record of changes, data location, and your KVKK duties. If one is missing, a handy card becomes a liability. Below, each check is a decision you can make before rollout.

Why a business card is personal data

A paper card travels one hand at a time. A digital card sits on a server and can be opened by anyone with the link. It carries names, titles, phone numbers and email addresses of your employees.

That makes the company a data controller for this information. Once you publish it, you are responsible for how it is stored, who can edit it and how long it stays online.

A common mistake is treating the card as a marketing page only. Treat it as a small database that happens to look good on a phone.

Is the connection encrypted by default?

Every card page and every admin screen should load over HTTPS. This protects the data while it moves between the visitor, the employee and the server.

Test it yourself. Open a card, look at the address bar and try the admin panel from a different network. If any page loads without encryption, stop the evaluation there.

Ask also about rate limiting, which slows down automated requests. It makes scraping your team's contact details and guessing passwords far harder.

Who can edit which card?

Most leaks inside companies are not attacks. They are an intern who can edit the CEO's card, or a former employee whose account still works.

Role-based access solves this. Administrators manage templates and the whole team, while an employee may touch only their own fields. Decide these roles on paper before you invite anyone.

Our guide on corporate digital business card management for teams shows how to split roles, templates and approvals without slowing people down.

• List who needs full admin rights, and keep that list short.
• Give employees edit rights only over their own card.
• Remove access on the day someone leaves.
• Review the role list every quarter.

Can you see what changed and when?

An audit log records who changed what and at what time. Without it, you cannot answer a simple question: who changed this phone number?

This matters during a dispute or a suspected misuse. It also discourages careless edits, because people know changes are traceable.

Account lockout adds a second layer. On the platform we build, an account locks automatically after five failed login attempts, which blunts password guessing.

Where is the data stored?

Ask the provider in writing where the data lives. On DigiCardSystem, data is held on servers in Türkiye and the setup is designed around KVKK.

Location matters because transfers abroad are regulated. Law No. 7499, published in the Official Gazette on 12 March 2024, amended Article 9 of Law No. 6698 on transfers of personal data abroad. The change took effect on 1 June 2024.

If a provider uses servers or subcontractors outside Türkiye, ask which transfer basis they rely on. Do not accept a vague answer. If your legal advisor is unsure, ask them to confirm with the KVKK guidance.

Your own duties under KVKK

Even with a safe platform, the legal duties stay with you. The duty to inform people is not triggered by a request. According to the KVKK, the data controller must fulfil it on its own whenever personal data is processed.

In practice, tell employees what data appears on their card, why, and for how long. Tell visitors what happens if the card has a contact form or collects details.

Keep the wording short and clear. A one-page notice that people actually read beats a long text that nobody opens.

Language settings and signatures can leak data too

If you serve foreign clients, keep Turkish and English fields separate. The right language then appears automatically based on the visitor's preference. This also prevents the wrong phone number or title from showing in the wrong version.

Another overlooked spot is the email signature. If you build it from the card, one source of truth keeps details consistent. Read how to create a corporate email signature from your digital business card so the two never drift apart.

Whenever an employee changes a role or number, update the card first and let everything else follow.

Run this review before you sign

Put the checks into one meeting with IT, HR and whoever handles KVKK. Ask the provider to answer each point in writing, and keep the answers.

If you are a small business without a security team, ISO has published a guide for small and medium enterprises. It helps them set up and maintain an information security management system aligned with ISO/IEC 27001. It is a useful reference for the questions you ask vendors.

Then decide: if HTTPS, roles, audit logs, data location and a clear notice are all in place, roll out to one team first. If any is missing, postpone until it is fixed.

• Confirm HTTPS on every card and admin page.
• Define roles and remove unused accounts.
• Check that an audit log and account lockout exist.
• Get the data location and transfer basis in writing.
• Publish a short privacy notice for employees and visitors.