April 15, 2026
Turkish personal data presents a set of detection challenges that Western-built DLP tools consistently fail at. We learned this the hard way while onboarding design partners in the Turkish banking and e-commerce sectors.
The Turkish Republic Identification Number (TC Kimlik No, or TCKN) is an 11-digit number. The first digit cannot be zero. The 10th digit is a checksum of the first 9 digits using a mod-10 algorithm. The 11th digit is a checksum of the first 10 digits using the same algorithm.
Most DLP tools treat TCKN as "11 consecutive digits." This produces two failure modes:
False negatives: When TCKN appears with spacing, dashes, or embedded in text like "12345678901" mixed with other numbers, regex-only scanners miss it.:
False positives: 11-digit invoice numbers, internal customer IDs, and even timestamps (20240101123) trigger alerts, drowning SOC teams in noise.:
Tamga solves this with a multi-pass approach:
16-digit numbers are everywhere in enterprise systems: internal transaction IDs, batch numbers, tracking codes. A naive Luhn check on every 16-digit sequence produced a 38% false-positive rate in one of our banking deployments.
The fix is BIN/IIN (Bank Identification Number) validation:
This dropped the FP rate to under 2% without adding measurable latency.
Turkish IBANs start with "TR" followed by 24 digits including a mod-97 checksum. Simple regex catches the format; the checksum confirms validity.
VKN (Vergi Kimlik Numarası) is a 10-digit tax ID. Like TCKN, it uses a checksum algorithm that most tools skip. Tamga validates it natively.
Under KVKK, logging raw PII — even for security purposes — can itself be a compliance issue. Tamga's "hash findings" mode replaces detected values with SHA-256 hashes before they hit the audit log, letting you demonstrate detection coverage without storing the sensitive data itself.
The full detection pipeline and benchmark dataset are public. Clone the repo and run `make redteam-report` to see the numbers for yourself.
