Who this service is for
We work with foreign businesses whose product or revenue touches Türkiye through technology rather than a physical store. That includes:
- Software vendors and SaaS providers licensing to Turkish customers
- Online marketplaces, app stores and platforms with Turkish users or sellers
- Cloud, hosting and infrastructure providers with data flowing to or from Türkiye
- Fintech, crypto and payment businesses serving Turkish consumers
- AI developers and deployers whose systems process Turkish personal data or decisions
- Hardware, IoT and connected-device makers selling into the Turkish market
You do not need a Turkish entity to be caught by these rules. Many obligations follow the user or the data, not the company's address. If Turkish residents can buy from you or upload data to you, Turkish law may already apply to you.
The Turkish legal framework for technology, AI and cybersecurity
There is no single "tech code" in Türkiye. Your obligations come from several statutes working together, and the right answer usually sits at the intersection of more than one:
- Cybersecurity Law No. 7545 — the cybersecurity framework, the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and the Cybersecurity Board.
- E-Commerce Law No. 6563 (amended by Law No. 7416) — duties for intermediary and electronic-commerce service providers, ETBİS registration and the e-commerce licence regime.
- KVKK No. 6698 — personal-data processing and cross-border transfers, overseen by the KVKK Board.
- Turkish Code of Obligations No. 6098 (TBK) — the contract-law backbone for licensing, development and service agreements.
- Turkish Commercial Code No. 6102 (TTK) — company duties, unfair competition and commercial-record rules.
- Sector regulation — banking, payments, capital markets, telecoms and consumer rules layered on top where they apply.
IT, software and SaaS contracts we draft and negotiate
Contracts are where most cross-border tech risk is won or lost. We draft, review and negotiate the agreements that sit under your Turkish business, with clauses that hold up under Turkish law and survive a Turkish court if it ever comes to that:
- Software licences, subscription and SaaS terms, and end-user agreements
- Software development, integration and maintenance contracts, with clear acceptance and IP-assignment terms
- Cloud, hosting and data-processing agreements, including KVKK-compliant processor clauses
- Service-level agreements (SLAs), uptime commitments and remedies for failure
- Reseller, distribution, agency and partner agreements for the Turkish market
- Technology transfer, escrow and white-label arrangements
We pay close attention to governing-law and dispute-resolution clauses, limitation of liability, and how IP and confidentiality are protected. For the wider drafting work that sits beside these, see our commercial and technology contracts service, and for protecting your code and brand, our software IP, trademark and licensing protection work.
E-commerce and online platform compliance (Law No. 6563)
The E-Commerce Law No. 6563, substantially reshaped by Law No. 7416, divides online businesses into intermediary service providers (the platform) and electronic-commerce service providers (the seller), and gives each a set of duties. As your transaction volume grows, the obligations escalate in tiers.
- ETBİS registration with the Ministry of Trade for businesses inside the regime.
- Transparency and information duties — clear pricing, seller identity, complaint handling and contract terms.
- An e-commerce licence regime for larger platforms, with conditions tied to size.
- Tiered obligations that increase with net transaction volume and number of transactions, covering advertising spend caps, data-sharing, own-brand restrictions and more.
Platform-market and antitrust questions often arrive in the same conversation, especially for marketplaces with market power. Those are covered in our competition and platform-market rules service. For payment and crypto platforms, see our guide on the crypto and fintech platform regulation in Türkiye.
Data protection and cross-border data transfers (KVKK No. 6698)
Almost every technology business processes personal data, and the moment that data leaves Türkiye, Article 9 of the KVKK applies. The transfer rules were rewritten by Law No. 7499 (in force from 1 June 2024), moving away from the old explicit-consent-and-authorisation default toward a structured, GDPR-style set of mechanisms.
You can transfer personal data abroad on one of three bases:
- An adequacy decision covering the destination country, sector or organisation.
- Appropriate safeguards — standard contractual clauses (SCCs), binding corporate rules (BCRs), or comparable undertakings.
- Derogations for specific, limited situations.
For groups already aligned to European rules, KVKK and GDPR overlap but are not identical, and assuming they are the same causes real problems. Our guide on GDPR and KVKK alignment for cross-border data walks through where they diverge.
Cybersecurity obligations and incident response (Law No. 7545)
The Cybersecurity Law No. 7545, published in the Official Gazette on 19 March 2025, is Türkiye's first dedicated cybersecurity statute. It created the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and the Cybersecurity Board, and it gives them broad powers over operators in scope, with particular focus on critical infrastructure.
At framework level, businesses in scope can expect duties around:
- Security measures, audits and inspection by the Cybersecurity Presidency
- Reporting of cybersecurity incidents and vulnerabilities
- Approval requirements for certain transactions and products in the cybersecurity field
- Cooperation duties and record-keeping
Because much of the secondary regulation under Law No. 7545 is still maturing in 2026, the practical scope of some duties continues to take shape. We track those developments and translate them into a concrete plan for your business. For a plain-English overview, read our guide on the Cybersecurity Law No. 7545 explained.
AI governance, risk mapping and compliance
As of mid-2026, Türkiye has no single comprehensive "AI Law" in force. That does not mean AI is unregulated — it means AI is governed through the laws you already have to follow: data protection under the KVKK, consumer-protection rules, intellectual-property law, and sector-specific regulation. A draft AI bill and a national strategy have been in progress, and the position can shift.
For a foreign business deploying AI in Türkiye, the practical work is risk-mapping rather than ticking a single statute:
- Where your AI processes personal data, mapping it to KVKK duties including transparency and automated-decision concerns
- Protecting and licensing the models, datasets and outputs through software IP, trademark and licensing protection
- Consumer and advertising-law exposure where AI touches Turkish end users
- Alignment with the EU AI Act where you also serve the EU market, so one product can satisfy both regimes
We give advisory opinions grounded in the law actually in force, and flag where a pending bill could change the picture. For background, see our guide on navigating AI regulation in Türkiye.
Cross-border mechanics: power of attorney, apostille and remote handling
You do not need to be in Türkiye for us to act. Almost everything in this practice area is handled remotely, with documents moving by courier and secure channels.
- Power of attorney (vekaletname) — you grant authority through a notarised PoA, prepared so it covers the specific filings, registrations and regulator dealings your matter needs.
- Apostille — for countries in the Hague Apostille Convention, a single apostille stamp authenticates your documents for use in Türkiye; non-convention countries use consular legalisation instead.
- Remote onboarding — instructions, KYC, contract review and regulator correspondence are all handled by email and video.
If your strategy points toward a local footprint — a Turkish company, a branch or a liaison office — we can set up a Turkish company or liaison office and structure it for your data, tax and operational needs. Many tech businesses also weigh the incentives at a technology development zone (Teknopark) before deciding where to base R&D.
Disputes, regulatory investigations and sanctions
When something goes wrong, the exposure comes from several regulators at once, each with its own process and penalties. We defend and represent you across:
- KVKK Board investigations into data breaches, unlawful processing and cross-border transfers, including responses to complaints and audits.
- Ministry of Trade enforcement of e-commerce duties under Law No. 6563, including ETBİS and licence issues.
- Cybersecurity Presidency inspections and the administrative and criminal exposure under Law No. 7545.
- Commercial disputes arising from technology contracts — non-payment, defective delivery, IP and confidentiality breaches.
The common thread is speed: regulator deadlines are short, and the quality of your first written response often shapes the whole outcome. We prepare those responses to be accurate and complete, not defensive. Where disputes head to formal proceedings, we work alongside our commercial and technology contracts team on enforcement.
Risks and common mistakes foreign tech businesses make
The same avoidable errors come up again and again with technology clients new to Türkiye:
- Assuming "no Turkish entity" means "no Turkish law." Obligations under the KVKK and Law No. 6563 can follow your Turkish users, not your registered office.
- Treating KVKK as identical to GDPR. The mechanisms and timing differ, and the 5-business-day SCC notification has no GDPR equivalent.
- Copy-pasting a US or EU contract. Mandatory Turkish rules override chosen law on key points, and an untranslated, unadapted contract can be hard to enforce here.
- Missing the e-commerce tier change. Growth pushes a platform across a transaction-volume threshold, triggering new duties the business never planned for.
- Ignoring cybersecurity until the secondary rules land. The penalties under Law No. 7545 are already in force, even while detailed regulation matures.
KVKK and GDPR: where they differ for cross-border data
Many of our clients already run GDPR programmes and want to know what extra Türkiye demands. The two regimes share DNA but are not interchangeable.
| Point | EU GDPR | KVKK No. 6698 (Türkiye) |
|---|---|---|
| Cross-border transfer bases | Adequacy, safeguards (SCCs/BCRs), derogations | Adequacy, safeguards (SCCs/BCRs), derogations (since Law No. 7499, in force 1 June 2024) |
| SCC notification | No filing requirement to the authority | Signed SCCs notified to the KVKK Board within 5 business days |
| Registry | No central controller registry | VERBİS data-controllers' registry for controllers in scope |
| Lead regulator | Member-state DPAs / EDPB | KVKK Board (Kişisel Verileri Koruma Kurulu) |
Aligning a GDPR programme to KVKK is usually about closing specific gaps rather than starting over. Our guide on GDPR and KVKK alignment for cross-border data goes deeper on each row.
Why instruct a Turkish technology lawyer
Technology law in Türkiye changes quickly and is written in Turkish, including the secondary regulation that determines how a statute actually bites. A foreign in-house team, however strong, will struggle to track the Cybersecurity Presidency's evolving rules, the KVKK Board's decisions and the Ministry of Trade's e-commerce guidance in real time.
A Turkish technology lawyer gives you three things a translation cannot: the binding text in the original language, the regulator practice behind it, and the standing to file, respond and represent you before Turkish authorities and courts. We combine that with a commercial-first lens, so advice is framed around your deal and your risk appetite, not abstract compliance for its own sake.
How to start
Getting going is straightforward. You tell us what you build and where it touches Türkiye; we tell you which of these statutes apply and what they require; and we agree a scope and a power of attorney so we can act. From there, whether the work is a single contract, a full compliance build or a regulator response, you have a single Turkish-qualified point of contact who handles it remotely. The first step is a consultation, described below.
How we work with you
Initial consultation and scoping
We start with a focused call about your product, where it touches Türkiye and what triggered the need — a contract, a launch, a data flow or a regulator letter. You leave with a clear view of which statutes apply to you and what comes next.
Legal and compliance assessment
We map your activity against Law No. 7545, Law No. 6563, the KVKK and your contracts, and produce a prioritised list of obligations, gaps and risks so you know what is urgent and what can wait.
Engagement, power of attorney and apostille setup
We agree a written scope and fee basis, then arrange a notarised power of attorney with apostille or consular legalisation so we can file, register and deal with regulators on your behalf, without you travelling.
Drafting, filing and remediation
We draft or revise the contracts, prepare ETBİS, KVKK and other filings, notify standard contractual clauses within the required window, and close the compliance gaps the assessment found.
Regulator dealings and incident response
If a regulator opens an inquiry or a security or data incident occurs, we manage the timeline, prepare your written responses and represent you before the KVKK Board, the Ministry of Trade or the Cybersecurity Presidency.
Ongoing compliance and monitoring
Because this area keeps changing, we can keep you updated on new secondary regulation, threshold revaluations and KVKK Board decisions, and adjust your contracts and filings as the rules move.
Frequently asked questions
Does Turkish technology law apply to my company if we have no office in Türkiye?
It can. Obligations under the KVKK and the E-Commerce Law No. 6563 often follow your Turkish users and the data you process, not your registered address. If Turkish residents can buy from you or upload data to you, you may have Turkish duties even with no local entity. A short assessment tells you whether and how you are in scope.
What is the Cybersecurity Law No. 7545 and who does it affect?
Law No. 7545 is Türkiye's first dedicated cybersecurity statute, published in the Official Gazette on 19 March 2025. It created the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and the Cybersecurity Board, and imposes security, reporting and approval duties, with particular focus on critical infrastructure. Much of the detailed secondary regulation is still maturing, so the precise scope for a given business should be confirmed case by case.
Can I transfer personal data out of Türkiye to my servers abroad?
Yes, but only on a valid legal basis under Article 9 of the KVKK: an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation. The rules were rewritten by Law No. 7499 in force from 1 June 2024. Where you use standard contractual clauses, they must be notified to the KVKK Board within a short window, so the mechanism needs to be set up correctly before data moves.
How is KVKK different from GDPR?
They share a structure but are not identical. Both allow cross-border transfers via adequacy, safeguards and derogations, but the KVKK requires signed standard contractual clauses to be notified to the Board within 5 business days, which has no GDPR equivalent, and Türkiye runs the VERBİS controllers' registry. Aligning a GDPR programme to the KVKK is usually about closing specific gaps rather than rebuilding from scratch.
Is there an AI law in Türkiye?
As of mid-2026 there is no single comprehensive AI statute in force. AI is governed through existing law — the KVKK, consumer protection, intellectual property and sector regulation — while a draft AI bill and national strategy progress. We advise on AI risk under the rules that currently apply, and flag where a pending bill could change your obligations. If you also serve the EU, the EU AI Act is usually relevant to the same product.
What is ETBİS and do I need to register?
ETBİS is the Ministry of Trade's electronic-commerce information system. Businesses within the E-Commerce Law No. 6563 regime, including many intermediary and electronic-commerce service providers, are required to register. Whether you must register depends on your role and activity, which we assess before you launch in the Turkish market.
What penalties apply under the Cybersecurity Law No. 7545?
Law No. 7545 carries administrative fines reaching into the millions of lira, with higher bands for failing to obtain required transaction approvals, and certain breaches are criminal offences carrying imprisonment alongside judicial fines. Penalties can be aggravated for public officials, repeat offenders and organised groups. Because monetary ceilings can be revalued, the exact current figure should be confirmed before relying on a number.
Can you act for us remotely, without us coming to Türkiye?
Yes. Almost all of this work is handled remotely. You grant us authority through a notarised power of attorney, authenticated with an apostille for Hague Convention countries or consular legalisation otherwise. Onboarding, contract review, filings and regulator correspondence are all handled by email and video.
Do you draft software, SaaS and cloud contracts under Turkish law?
Yes. We draft and negotiate licences, subscription and SaaS terms, development and maintenance agreements, cloud and data-processing agreements, SLAs and reseller or distribution contracts. We focus on governing law, liability limits, IP protection and KVKK-compliant data clauses so the agreements hold up under Turkish law.
My platform is growing — when do extra e-commerce obligations kick in?
The E-Commerce Law No. 6563 sets tiered duties that increase with net transaction volume and number of transactions. The lira thresholds are revalued over time, so a platform can cross a tier as it grows and pick up new duties around advertising spend, data-sharing, own-brand activity and licensing. We monitor your position against the current thresholds so a tier change does not catch you out.
What happens if we suffer a data breach affecting Turkish users?
You may have notification duties to the KVKK Board and to affected individuals, on tight timelines, and a separate cybersecurity-incident dimension may arise under Law No. 7545. The first written response shapes much of the outcome, so we help you assess, document and report the incident correctly and represent you in any investigation that follows.
How does the EU AI Act affect a business operating in Türkiye?
The EU AI Act does not itself bind activity in Türkiye, but it applies if you also place AI systems on the EU market or affect EU users. For businesses serving both markets, we help design one compliance approach that meets EU AI Act expectations and Türkiye's existing AI-relevant rules together, so you are not maintaining two disconnected programmes.
Should we set up a Turkish company or just sell remotely?
It depends on your data flows, tax position, customer expectations and growth plans. Some tech businesses operate purely cross-border; others benefit from a Turkish company, branch or liaison office, and some look at technology development zone incentives for R&D. We assess the trade-offs and, if it makes sense, handle the company formation for you.
How do we get started and what will it cost?
You begin with a consultation where we identify which statutes apply and what you need. We then agree a written scope and a fee basis appropriate to the work, whether that is a single contract, a compliance build or a regulator response, before any substantive work starts. From there you have one Turkish-qualified point of contact handling the matter remotely.
