Turkey

Law 6698 has no single article saying it reaches companies with no office in Turkey. Europe's General Data Protection Regulation has one. Turkey does not. The reach is built from the rules on the public data register instead. Those rules define a company's representative as a legal person resident in Turkey, or a citizen of the Republic of Turkey. They set 1 October 2018 as the start date for registration by companies resident abroad, and 31 December 2021 as the deadline. No staff number or balance-sheet threshold is attached to that group. The Board's breach decision points the same way. A company based abroad must report to the Board where the breach affects people in Turkey who use its goods or services. There is a size exemption. It covers businesses with fewer than 50 employees and an annual balance sheet under 100 million lira. Handling sensitive data must not be their main business. It comes from Board Decision 2018/87, as amended by Decision 2023/1154. On its face it applies to everyone. But the registration timetable still lists companies resident abroad as a separate group, with no threshold.

The general law works in three steps. Step one: has anyone officially decided that the destination country, an industry inside it, or an international organisation protects data well enough? Step two, if not: have the parties put in place one of the approved safeguards listed in the law? Step three, if neither: does one of a short, closed list of one-off exceptions apply? Step one is currently empty. The Authority's own page says plainly that no such decision has been made. Industry rules on top, strongest first. Payment and electronic money institutions: systems, backups and data in Turkey, and cloud only from a named approved list. Banks: the Banking Regulation and Supervision Agency's information systems regulation is the rule that controls this. Public bodies and critical infrastructure: the 2019 information and communication security circular, and the guide issued under it. The Cybersecurity Directorate now oversees both. Telecoms: the Information and Communication Technologies Authority regulates subscriber, traffic and location data separately. Health: Ministry of Health rules and the central health data system. Insurance: the support services and internal systems regulations. The support services one was amended on 23 July 2026.

THE ROUTES. (1) Standard contract. Four versions exist. Which one you use depends on whether each side decides how the data is used, or just handles it for someone else. Board Decision 2024/959 of 4 June 2024 adopted them. You must tell the Authority within five working days of the last signature. That can be on paper or through registered electronic mail. Failing to tell them is itself a fineable offence. Filing is not a formality. In 2025 the Authority received 2,497 standard contracts. It opened 70 investigations of its own off the back of them, finished 21, and fined 3 organisations a total of 150,000 lira. (2) Company-wide rules. The Board approves them once. After that the group transfers data without asking again. Application forms and guides are published. (3) Written undertaking plus Board permission. In 2025, 90 undertakings were submitted and 89 were decided. 13 were allowed and 76 were refused. Treat this route as a last resort. (4) One-off exceptions. These include the person's informed explicit consent, contract necessity, an overriding public interest, and legal claims. The law and the regulation both say these are for occasional, irregular transfers, not routine flows.

We rate enforcement as active rather than aggressive. The volume is high, but individual fines are modest by European standards. And the biggest single block of penalties is for failing to register, not for mishandling data. The 2025 numbers come from the Authority's own annual report. 876 organisations were fined. Of those, 140 came from complaints and tip-offs, 142 from breach reports and 594 from register failures. Fines totalled 352,510,494 lira. Of that, 216,860,000 lira was register-related. 328 new breach files were opened in 2025, and 32 of them were against companies based outside Turkey. The Authority also asked 42 public bodies to discipline the staff responsible. Its output in 2026 continues. Binding principle decisions came in February, May and July 2026. A compliance guide for public bodies came in July 2026. Named breach announcements were still being published in August 2026. On the security side, Presidential Decree No 177 of 8 January 2025 created the Cybersecurity Directorate. Law No 7545 of 19 March 2025 gave it powers. By 2026 the national cyber incident response centre's services had moved onto the Directorate's site.

MAXIMUM. The Regulation on Deletion, Destruction or Anonymisation of Personal Data applies to any organisation that must register. You must have a written policy on keeping and destroying personal data. You must erase, destroy or anonymise data at the first scheduled destruction run after the duty to delete arose. So the gap between destruction runs is the real deadline. You set that gap yourself, in your own policy. There is no single national number. MINIMUM. General Turkish commercial and tax law makes you keep business records for a number of years. Industry regulators impose their own record-keeping periods on banks, payment institutions, insurers and telecoms operators. WHICH RULE WINS. Where the two collide, the keeping duty in the specific law wins and you must keep the data. But you must then lock it down. You may use it only for the purpose that justified keeping it. We did not verify the individual commercial and tax periods against a government source. Treat those numbers as unconfirmed.

DEADLINE ONE. Board Decision 2019/10 of 24 January 2019 reads the law's phrase 'as soon as possible' as 72 hours from becoming aware. You use the Authority's published breach form. You can supply information in stages if you do not have it all at once. You must tell people directly where you have their contact details. Otherwise use a suitable method, such as a notice on your own website. If a company handling data for you suffers the breach, it must tell you without any delay. A company based abroad must report on the same terms, where the effects hit people in Turkey who use its goods or services. DEADLINE TWO. Cyber incidents go to the Cybersecurity Directorate. Since 2025 it holds the national incident response role. It has taken over the national cyber incident response centre's services. We did not verify a specific number of hours. DEADLINE THREE. Financial regulators run their own incident reporting for banks, payment institutions and electronic money institutions. Overlapping deadlines are where people usually come unstuck. Everyone remembers the 72-hour privacy report. The regulator-specific ones are the ones people miss.

(1) In 2025, 594 of the 876 organisations fined were fined over the public data register. That accounted for 216.86 million lira of the 352.5 million lira total. It works out at roughly 365,000 lira each. The Authority says plainly that it keeps taking action against companies resident abroad, as well as Turkish ones. (2) Written undertakings plus Board permission. 90 submitted, 89 decided, 13 allowed, 76 refused. If your transfer plan depends on this route, assume it fails. (3) Standard contracts must be filed within five working days. In 2025 the Authority turned 70 of the 2,497 filings into its own investigations, and fined three organisations. Filing a faulty or unsigned contract triggers a formal review by law. (4) The representative must be a company established in Turkey, or a Turkish citizen. A regional office in another country will not do. (5) No country, industry or international organisation has been declared safe enough. So a European company cannot rely on Turkey treating the European Union as safe. Separately, Turkish law makes some things criminal offences. Those include unlawfully recording personal data, passing it on, and failing to delete it. Those offences can reach individuals, not only the company. We did not verify the current text of those offences.

DATED. (a) Principle Decision 2026/266, published on 28 February 2026, gave organisations six months to fix loyalty-card checkout processes. Board Decision 2026/1491 of 22 July 2026 pushed that deadline out to 28 February 2027. (b) Principle Decision 2026/1301 of 1 July 2026 governs how public bodies may publish personal data on the internet. A public explainer followed on 27 July 2026, and a compliance guide for public bodies on 28 July 2026. (c) Principle Decision 2026/1095 of 20 May 2026 covers the use of accident victims' personal data. POWERS THAT COULD CHANGE THINGS WITH NO CONSULTATION. The Board can declare a country, an industry within a country, or an international organisation safe enough at any time. It can also suspend or cancel such a decision for the future. It reviews them every four years. The Board can add or remove exemptions from the public register by decision. It did that on 4 September 2025, for very small businesses whose main activity is handling sensitive data. And the central bank has an express power to stop payment institutions sharing data abroad, or to add further limits. It can use that whenever it judges that the payments market is being harmed. More rules under the 2025 Cybersecurity Law are still being issued. Procurement rules came in April 2026.