According to Article 12 of the Personal Data Protection Law, data controllers are required to take administrative and technical measures to ensure an appropriate level of security. So, what measures need to be taken under the KVKK (Personal Data Protection Law)?