[{"data":1,"prerenderedAt":419},["ShallowReactive",2],{"locale-alternates:\u002Fdoes-turkey-kvkk-apply-european-companies":3,"post-\u002Fdoes-turkey-kvkk-apply-european-companies":7},{"path":4,"alternates":5},"\u002Fdoes-turkey-kvkk-apply-european-companies",{"en":4,"de":6},"\u002Fde\u002Fkvkk-europaeische-unternehmen",{"page":8,"translations":265,"nav":269,"related":397,"random":408},{"id":9,"title":10,"body":11,"categories":237,"category":239,"changeHistory":239,"date":240,"description":241,"disclosures":242,"draft":245,"extension":246,"firstLiveAt":239,"image":247,"imageAlt":248,"kind":249,"lang":250,"meta":251,"navigation":252,"omitGermanLocalizationDisclosure":245,"path":4,"publishedAt":239,"readingTime":253,"rights":239,"seo":254,"seoTitle":10,"slug":255,"sources":239,"stem":255,"tags":256,"translationKey":262,"type":263,"updated":239,"__hash__":264},"posts\u002Fdoes-turkey-kvkk-apply-european-companies.md","Does Turkey’s KVKK Apply to European Companies?",{"type":12,"value":13,"toc":228},"minimark",[14,25,28,31,36,39,52,64,70,73,79,83,98,101,104,156,167,170,173,177,180,183,191,194,198,201,209,212,216,219,222,225],[15,16,17],"blockquote",{},[18,19,20,24],"p",{},[21,22,23],"strong",{},"TL;DR:"," GDPR compliance does not exempt a European company from Turkey’s KVKK. Assess the particular processing and its connection to Türkiye, then distinguish your legal duties from commitments to Turkish customers. Existing access controls, retention rules and request-handling systems can help, but Turkish processing grounds, notices, transfers and any registration duties need their own review.",[18,26,27],{},"Suppose your German software company is opening a sales office in Türkiye. Prospects will enter the existing CRM, employees will join the group’s HR system, and customer support will remain in Germany. Your team has already invested in GDPR compliance. Why should entering another market require another privacy project?",[18,29,30],{},"Turkey has its own Personal Data Protection Law, usually called the KVKK. Your GDPR work may not cover what it requires. Which group company decides how those records are used? Does it need to register in Türkiye? Can the Turkish office send the information to the systems you already operate?",[32,33,35],"h2",{"id":34},"when-does-a-european-business-come-within-kvkks-scope","When does a European business come within KVKK’s scope?",[18,37,38],{},"Being based in Europe does not settle the question. Nor should you take GDPR’s territorial rules and simply replace “the EU” with “Türkiye”.",[18,40,41,42,51],{},"In a ",[43,44,50],"a",{"href":45,"rel":46,"target":49},"https:\u002F\u002Fwww.kvkk.gov.tr\u002FIcerik\u002F8873\u002F2025-601",[47,48],"nofollow","noopener","_blank","2025 decision about a Hong Kong hotel operator",", Turkey’s Personal Data Protection Board noted that KVKK has no explicit territorial-scope provision. It assessed the particular processing and its connection to Türkiye. Consider three situations:",[18,53,54,57,58,63],{},[21,55,56],{},"You have operations in Türkiye."," A Turkish office, branch or subsidiary requires you to identify who controls the relevant customer and employee data. In a ",[43,59,62],{"href":60,"rel":61,"target":49},"https:\u002F\u002Fwww.kvkk.gov.tr\u002FIcerik\u002F6772\u002F2020-471",[47,48],"decision concerning a foreign bank’s Turkish representative office",", the Board found that KVKK applied to the bank’s processing and required registration. Its ongoing Turkish presence mattered even though the bank processed the data abroad. The decision does not make every company in an international group responsible for every other company’s processing.",[18,65,66,69],{},[21,67,68],{},"You serve people in Türkiye without a local office."," Being established overseas does not necessarily put you outside KVKK’s scope. The Board has required foreign controllers to report breaches affecting people who live in Türkiye and use the products or services there.",[18,71,72],{},"By contrast, the Hong Kong hotel ruling found no Turkish notification duty for the processing at issue: the operator had no local presence and the affected people used its services outside Türkiye. These decisions show how the Board assesses a connection to Türkiye. They concern breaches, so they do not provide a complete checklist for every KVKK obligation. Where people use the service and how the business operates matter; a customer’s Turkish nationality alone does not answer the question.",[18,74,75,78],{},[21,76,77],{},"You process records for a Turkish business."," A European CRM provider may store and use records only on its customer’s instructions. That role is different from deciding why the data will be collected and used. The customer may need contractual commitments from the provider to meet Turkish requirements. That contract question and the provider’s direct legal obligations must be assessed separately.",[32,80,82],{"id":81},"what-can-you-reuse-from-your-gdpr-programme","What can you reuse from your GDPR programme?",[18,84,85,86,91,92,97],{},"Your data inventory, staff access controls, deletion procedures and supplier reviews remain useful. Both ",[43,87,90],{"href":88,"rel":89,"target":49},"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002Fen\u002FTXT\u002F?uri=CELEX:02016R0679-20160504",[47,48],"GDPR"," and ",[43,93,96],{"href":94,"rel":95,"target":49},"https:\u002F\u002Fwww.kvkk.gov.tr\u002FIcerik\u002F6649\u002FPersonal-Data-Protection-Law",[47,48],"the current KVKK"," require limited, purpose-specific processing and measures to protect personal data. A second law need not mean a second set of systems.",[18,99,100],{},"For the sales-office example, keep one record of the CRM’s data fields, users, providers and retention periods. Add the Turkish legal assessment to it rather than asking another team to reconstruct the same facts.",[18,102,103],{},"Several familiar-looking requirements still need checking:",[105,106,107,120],"table",{},[108,109,110],"thead",{},[111,112,113,117],"tr",{},[114,115,116],"th",{},"Existing work",[114,118,119],{},"What needs Turkish review",[121,122,123,132,140,148],"tbody",{},[111,124,125,129],{},[126,127,128],"td",{},"Reasons for collecting and using each data field",[126,130,131],{},"Whether the use meets a KVKK processing condition, including the special conditions for sensitive data",[111,133,134,137],{},[126,135,136],{},"Privacy notices",[126,138,139],{},"The correct controller, purposes, recipients, collection method, legal grounds and rights under KVKK",[111,141,142,145],{},[126,143,144],{},"Access and deletion request handling",[126,146,147],{},"The applicable rights, identity checks, response requirements and deadlines",[111,149,150,153],{},[126,151,152],{},"Vendor contracts and data-flow records",[126,154,155],{},"Turkish transfer requirements, actual recipients and onward access",[18,157,158,159,162,163,166],{},"For example, KVKK generally requires a response to an individual’s request as soon as possible and within ",[21,160,161],{},"30 days",". GDPR’s general period is ",[21,164,165],{},"one month",", with extensions in certain circumstances. Do not import that extension into your Turkish procedure. One request queue can support both, provided it tracks the correct requirements.",[18,168,169],{},"A translated GDPR notice also needs a content review. Turkish rules require the controller to explain how and why it collects data, who may receive it and what rights the person has. Giving that information and obtaining consent are separate tasks. Adding an “I agree” box does not establish that either has been done properly.",[18,171,172],{},"Use current comparisons: Türkiye changed its sensitive-data and international-transfer rules in 2024. Older summaries can send your team in the wrong direction.",[32,174,176],{"id":175},"why-might-a-turkish-customer-need-a-different-contract","Why might a Turkish customer need a different contract?",[18,178,179],{},"Suppose a Turkish customer wants to put its contact records into your CRM hosted in Germany. Those records would leave Türkiye. Your GDPR processing agreement describes the service, but it does not automatically provide a transfer mechanism accepted under Turkish law. EU standard contractual clauses are not a substitute for the Turkish standard contracts either.",[18,181,182],{},"The customer may therefore need your signatures, information about subcontractors and commitments covering access, security and onward transfers. The practical question is whether the service can honour those commitments.",[18,184,185,186,190],{},"The ",[43,187,189],{"href":188},"\u002Fturkey-kvkk-data-contracts-foreign-providers","contract requirements for foreign providers serving Turkish customers"," are covered separately. Here, the business implication is timing: review the arrangement before promising a launch date or accepting the data.",[18,192,193],{},"Transfers also need checking in the other direction. If your European company sends personal data to a separate Turkish company, assess the GDPR transfer requirements as well. Completing one country’s paperwork does not complete the other’s.",[32,195,197],{"id":196},"do-we-need-verbi̇s-registration-or-a-turkish-representative","Do we need VERBİS registration or a Turkish representative?",[18,199,200],{},"VERBİS is Türkiye’s Data Controllers’ Registry. It is not a certification of compliance, and it is not the same as keeping your own GDPR records of processing.",[18,202,185,203,208],{},[43,204,207],{"href":205,"rel":206,"target":49},"https:\u002F\u002Fwww.kvkk.gov.tr\u002FIcerik\u002F5442\u002FVERI-SORUMLULARI-SICILI-HAKKINDA-YONETMELIK",[47,48],"registry regulation"," requires non-resident controllers that must register to do so through a representative in Türkiye. That representative handles specified communications and registry work. A data protection officer appointed under GDPR does not automatically fulfil that role.",[18,210,211],{},"First establish which company is the controller for the processing concerned. Then check the applicable registration rules and any exemption. Do not assume that every European supplier must register, or that an exemption available to a small Turkish business also applies to an overseas controller. An exemption from registration does not remove the underlying data-protection duties.",[32,213,215],{"id":214},"what-should-change-before-you-start-operating","What should change before you start operating?",[18,217,218],{},"For the planned Turkish office, begin with the customer and employee records it will create. Identify the company deciding how each is used, check where the systems and support staff are located, and establish the Turkish requirements for those activities.",[18,220,221],{},"Then turn any gaps into specific work: revise the notice, adjust the request deadline, restrict a support team’s access, complete the transfer arrangement or address registration. Assign an owner to each change and verify that it works before the process goes live. Sector-specific rules may add requirements, particularly in healthcare and finance.",[18,223,224],{},"Demonstrating how access, deletion and supplier oversight work can also help answer procurement questions. It does not guarantee a sale or justify a blanket “compliant everywhere” claim.",[18,226,227],{},"Your GDPR work gives you a stronger starting point. A useful KVKK review should identify what the Turkish operation adds to it—and ensure those changes are reflected in the systems, contracts and daily practices used to handle the data.",{"title":229,"searchDepth":230,"depth":230,"links":231},"",2,[232,233,234,235,236],{"id":34,"depth":230,"text":35},{"id":81,"depth":230,"text":82},{"id":175,"depth":230,"text":176},{"id":196,"depth":230,"text":197},{"id":214,"depth":230,"text":215},[238],"business",null,"2026-09-24","Already GDPR compliant? Learn when Turkey’s KVKK may apply to your European business, what existing controls can cover and which Turkish requirements need a separate review.",{"aiUse":243,"aiNote":244},"ai-assisted","Evren Bal defined the audience, central argument and business perspective. AI assisted with primary-source research, English drafting and the shared cover illustration.",false,"md","\u002Fimages\u002Fhero\u002Fgdpr-kvkk-business-records.avif","A laptop displaying customer records sits beside a navy law book with EU stars and a red law book with a white Turkish crescent and star.","Analysis","en",{},true,6,{"title":10,"description":241},"does-turkey-kvkk-apply-european-companies",[257,258,259,260,261],"kvkk","gdpr","data-protection","international-business","compliance","kvkk-european-business-applicability","post","U5QNRhVMv7c5koTHxtH4Mev2aAu34iMWl9IO8LJ3Ats",{"en":266,"de":267},{"path":4,"title":10},{"path":6,"title":268},"Gilt die türkische KVKK auch für europäische Unternehmen?",{"prev":270,"next":273,"others":276,"lucky":396,"readingTime":253},{"path":271,"title":272},"\u002Fai-knowledge-management-from-documents-to-better-decisions","Why Searching Company Knowledge with AI Is Not Enough",{"path":274,"title":275},"\u002Fhow-employee-built-ai-systems-become-organizational-memory","How Employee-Built AI Systems Become Organizational Memory",[277,280,283,286,289,292,295,298,301,304,307,310,312,315,318,321,324,327,330,333,336,339,342,345,348,351,354,357,360,363,366,369,372,375,378,381,384,387,390,393],{"path":278,"title":279},"\u002Fthe-end-of-coding-or-a-new-renaissance-the-invisible-crisis-of-ai","The End of Coding or a New Renaissance? The Invisible Crisis of AI",{"path":281,"title":282},"\u002Fsensitive-ai-data-processing-location","Where Should Sensitive AI Data Be Processed?",{"path":284,"title":285},"\u002Fseptember-2026-what-i-wrote","September 2026: What I Wrote, and Why",{"path":287,"title":288},"\u002Fcio-cto-it-director-difference","CIO, CTO, and IT Director: What the Title Misses",{"path":290,"title":291},"\u002Fai-editorial-disclosure","What an AI Disclosure Tells Readers About the Author’s Contribution",{"path":293,"title":294},"\u002Feu-ai-act-after-risk-classification","EU AI Act: What Should You Do Once You Know the Risk Level?",{"path":296,"title":297},"\u002Fwhat-makes-an-ai-system-specific-to-your-business","What Makes an AI System Specific to Your Business?",{"path":299,"title":300},"\u002Fai-visibility-scores-precision-validity","Do AI Visibility Tests Represent Real Customers?",{"path":302,"title":303},"\u002Fhow-much-does-the-eu-ai-act-affect-companies-outside-the-eu","How Much Does the EU AI Act Affect Companies Outside the EU?",{"path":305,"title":306},"\u002Fwho-captures-ai-productivity-gains","Who Captures the Productivity Gains from AI?",{"path":308,"title":309},"\u002Fdoes-enterprise-ai-really-need-fine-tuning","Does Enterprise AI Really Need Fine-Tuning?",{"path":188,"title":311},"Turkey’s KVKK: Why Your Turkish Customer Needs Another Data Contract",{"path":313,"title":314},"\u002Fai-tools-are-easier-to-build-transformation-still-takes-work","Building an AI Tool Is Easy. Transforming a Company Is Not.",{"path":316,"title":317},"\u002Fai-transformation-redesign-work-not-cut-roles","AI Transformation Starts with Redesigning Work",{"path":319,"title":320},"\u002Fdo-ai-visibility-tools-really-work","Do AI Visibility Tools Really Work? What They Actually Measure",{"path":322,"title":323},"\u002Fturkeys-first-real-time-mystery-shopping-reporting","Turkey's First Real-Time Mystery Shopping Reporting Platform",{"path":325,"title":326},"\u002Faugust-2026-what-i-wrote","August 2026: What I Wrote, and Why",{"path":328,"title":329},"\u002Faccessing-know-how-is-not-the-same-as-creating-it","Accessing Know-How Is Not the Same as Creating It",{"path":331,"title":332},"\u002Fstart-with-the-business-problem-not-the-ai-model","Start With the Business Problem, Not the AI Model",{"path":334,"title":335},"\u002Fwhen-does-ai-progress-improve-everyday-life","When Does AI Progress Become Progress for People?",{"path":337,"title":338},"\u002Fwhere-should-people-be-in-the-loop-while-ai-does-the-work","Where Should People Be in the Loop While AI Does the Work?",{"path":340,"title":341},"\u002Fwhen-ai-changes-work-training-employees-is-not-enough","When AI Changes Work, Training Employees Is Not Enough",{"path":343,"title":344},"\u002Fhealthcare-ai-chatbot-triage-medical-device","AI in Healthcare: The Difference Between Chatbots, Triage, and Medical Devices",{"path":346,"title":347},"\u002Fthe-cost-of-a-hello-enterprise-ai","The Cost of a Hello: Managing Enterprise AI Use",{"path":349,"title":350},"\u002Fwhy-sales-and-other-departments-keep-clashing","Why Sales and Other Departments Keep Clashing",{"path":352,"title":353},"\u002Fstripe-openrouter-which-model-for-which-job","Stripe’s OpenRouter Deal: Which Model for Which Job?",{"path":355,"title":356},"\u002Ffrom-rules-to-decisions-the-real-time-sales-intelligence-platform-we-built-at-vanity","Medical Tourism Lead Management: How We Moved from Manual Routing to a Real-Time Sales System",{"path":358,"title":359},"\u002Fjune-2026-what-i-wrote","June 2026: What I Wrote, and Why",{"path":361,"title":362},"\u002Fthe-same-ai-does-not-create-the-same-competitive-advantage","The Same AI Does Not Create the Same Competitive Advantage",{"path":364,"title":365},"\u002Fthe-job-ai-wont-take-and-the-five-it-prevents","AI Is Reducing Hiring Without Layoffs",{"path":367,"title":368},"\u002Fvoice-agent-system-deployment-constraints","What to Test Before Investing in a Voice Agent",{"path":370,"title":371},"\u002Fwhen-does-enterprise-ai-need-rag","When Does Enterprise AI Actually Need RAG?",{"path":373,"title":374},"\u002Fhow-to-do-content-pruning-a-real-world-case-study","How to Do Content Pruning: A Real-World Case Study",{"path":376,"title":377},"\u002Fpesintaksit-cash-vs-installments-a-turkish-inflation-aware-payment-comparison-tool","Cash or Installments? – The Story Behind PeşinTaksit",{"path":379,"title":380},"\u002Fai-visibility-illusion-bing-citation-share","What Is AI Citation Share? What Bing's Data Actually Reveals",{"path":382,"title":383},"\u002Ftesting-a-button-treating-an-entire-website-redesign-as-a-sure-thing","Testing a Button, Treating an Entire Website Redesign as a Sure Thing",{"path":385,"title":386},"\u002Fwhy-we-trust-ai-judgments","Why We Trust AI Judgments and What That Fails to Prove",{"path":388,"title":389},"\u002Fan-seo-experiment-in-a-low-competition-serp-with-google-maps-and-openai","Building camiler.org: A Programmatic SEO Experiment with Google Maps and OpenAI",{"path":391,"title":392},"\u002Fhow-llms-identify-experts","What Makes an LLM Recommend Someone as an Expert?",{"path":394,"title":395},"\u002Fprotecting-organizational-memory-during-ai-transformation","Protect Organizational Memory During an AI Transformation",{"path":343,"title":344},[398,402,404,406],{"path":399,"title":400,"date":401},"\u002Fchatbot-data-third-party-ai-provider","What Happens When Chatbot Data Is Sent to a Third-Party AI Provider?","2026-09-05",{"path":188,"title":311,"date":403},"2026-10-05",{"path":302,"title":303,"date":405},"2026-09-07",{"path":281,"title":282,"date":407},"2026-10-03",[409,413,417],{"path":410,"title":411,"date":412},"\u002Ffrom-asking-questions-to-delegating-work","From Asking Questions to Delegating Work: What the Codex Study Shows","2026-09-01",{"path":414,"title":415,"date":416},"\u002Fdont-write-to-be-recommended-by-ai","Getting Your Brand Recommended by AI Is the Wrong Goal. What Is the Right One?","2026-09-10",{"path":394,"title":395,"date":418},"2026-09-11",1791233267715]