Why device management is a data protection topic
A managed phone is usually carried by one person. Its serial number, its location, the apps on it and the logs it sends can all be linked to that person. Under GDPR and Türkiye’s Personal Data Protection Law (KVKK, Law No. 6698), this makes them personal data.
When your organization manages these devices, it decides why and how the data is processed. That makes it the data controller. If you use a cloud MDM, the vendor that hosts the data usually acts as a data processor on your behalf, and the two of you need a written agreement that sets out the processor’s duties.
This page is general information to help you ask the right questions. It is not legal advice; have your legal team or data protection officer review your own setup.
The principles both laws share
GDPR (Article 5) and KVKK (Article 4) are built on very similar principles. For an MDM project, five of them matter most:
- Lawfulness and fairness: process data on a valid legal basis and in a way employees would reasonably expect.
- Purpose limitation: decide in advance why you collect each type of data, and do not reuse it for unrelated purposes.
- Data minimisation: collect only what the purpose needs. KVKK words this as data being “relevant, limited and proportionate”.
- Storage limitation: keep data only as long as necessary, then delete or anonymise it.
- Security: protect the data with appropriate technical and organizational measures (GDPR Article 32, KVKK Article 12).
Informing employees
Both laws require you to tell people about the processing before or when it starts. Under KVKK this is the duty to inform (aydınlatma yükümlülüğü, Article 10). Under GDPR it is the information duty in Articles 13 and 14.
A good information notice for managed devices covers:
- who the data controller is
- which data the MDM collects on each type of device (for example inventory, app list, location, logs)
- why each type is collected and on which legal basis
- who can see it inside the organization, and which service providers process it
- where it is stored, including any transfer abroad
- how long it is kept
- the employee’s rights and how to use them
Show the notice at the moment it matters: when the device is handed over or enrolled. Keep a record that the employee received it.
Choosing a legal basis
Consent is often the first idea, and often the wrong one. In an employment relationship the employee may not feel free to refuse, so regulators on both sides are cautious about relying on consent. Under KVKK, explicit consent is one basis among several, and the Personal Data Protection Authority’s guidance indicates that it should not be used where another basis applies.
Other bases usually fit device management better:
- Performance of a contract: managing the device the employee needs to do the job.
- Legal obligation: for example security measures the organization is required to take.
- Legitimate interests: protecting company data, recovering lost devices, keeping devices working. This requires a balancing test against the employee’s rights.
Decide the basis per type of data. Inventory and security status may rest on one basis; continuous location tracking needs a much stronger justification.
Data minimisation in practice
Minimisation is where MDM configuration and law meet. Questions to ask for each data type:
- Location: Do we need it on every device, or only on field and high-risk devices? Do we need a continuous trail, or only on demand when a device is lost? Can collection stop outside working hours?
- Call history and network logs: Is there a specific security or legal reason? If not, leave them off.
- App inventory: On a company device this is normally needed. On a personal device with a work profile, limit it to work apps.
- Screen viewing and remote control: Use it for support, with the user’s knowledge, and record who started each session.
Then set retention periods and make sure old data is actually deleted.
What an employer can and cannot see
The answer depends on the device’s ownership model. Our guide to device ownership models explains the modes in detail.
| Company-owned, fully managed | Personal device with work profile | |
|---|---|---|
| Device model, OS version, security status | Yes | Yes |
| Apps installed | All apps | Work profile apps only |
| Location | Possible, if enabled by policy | Generally not available from the personal side |
| Call history, network logs | Possible on some products, if enabled by policy | Not from the personal side |
| Remote wipe | Whole device | Work profile only |
| Personal messages, photos, browsing content | No, MDM is not built to read them | No |
The table shows typical behaviour. Check what your product actually collects in each mode, and write it into your notice.
Data residency and transfers abroad
Where the data is stored matters under both laws. GDPR restricts transfers outside the European Economic Area unless there is an adequacy decision or appropriate safeguards such as standard contractual clauses.
KVKK Article 9 was substantially amended in 2024. Transfers abroad can now rely on an adequacy decision, on appropriate safeguards such as standard contracts approved by the Authority, or on limited exceptions. Standard contracts must be notified to the Authority within five business days of signing.
For an MDM this means one practical question: where are the servers, and does the vendor use subcontractors in other countries? Keeping the MDM inside Türkiye, or inside your own facility, removes most transfer questions. The comparison in cloud vs on-premises MDM covers this choice.
Security measures your MDM should support
Data protection is also about protecting the data you hold. Look for:
- role-based access, so each admin sees only the devices and data their job requires
- integration with your directory, such as LDAP, for central account control
- records of admin actions and remote sessions
- encryption of data in transit and on the device
- remote lock and wipe for lost devices
Our security and compliance page shows how these work in practice.
How DeepManage does it
DeepManage lets you decide per policy whether a device sends location, call history and network logs, so you collect only what each group needs. Organizations can publish their own terms of use in the console. Users see them on the device, and DeepManage keeps a record of who accepted which version on which device. Admin access is controlled through roles, organizational units and LDAP integration.
For data residency, DeepManage runs either in the cloud hosted by Infoline or on-premises in your own network, including closed networks. See location and geofencing and reports for what each feature collects.