In most cases, the answer is yes. Turkey's Personal Data Protection Law (Law No. 6698, known as the KVKK) requires a company established outside Turkey to appoint a local representative and register with the Data Controllers' Registry (VERBIS) when it processes the personal data of people located in Turkey.
The obligation surprises many foreign companies because it is broader than the equivalent rule they already know from the European Union. This guide explains who is caught, the single most important difference from the GDPR, and what the consequences of inaction are.
The test: are you a foreign controller processing data in Turkey?
Two conditions bring you within the rule. First, your company is a data controller established outside Turkey. Second, you process the personal data of individuals located in Turkey. Processing is a wide concept: it covers collecting, storing, using, or transferring data. If both conditions are met, the obligation applies.
In practice, you very likely need a representative if you:
- Sell products or services to customers in Turkey, whether online or offline.
- Operate a website, application, or SaaS platform that people in Turkey use.
- Employ, recruit, or monitor staff or contractors in Turkey.
- Run marketing, analytics, or advertising that reaches individuals in Turkey.
- Already appoint a representative in the European Union under GDPR Article 27, since a comparable trigger usually exists for Turkey.
The point that catches companies out: unlike the GDPR, Turkey sets no size or volume threshold for foreign controllers. There is no small-scale exemption. The employee-count and balance-sheet thresholds that reduce the registration burden apply only to controllers established in Turkey. A foreign controller must appoint a representative and register regardless of its size, turnover, or the amount of data it processes.
What the representative actually does
The representative is your official point of presence in Turkey. It is the party the Turkish Personal Data Protection Authority contacts, and the party through which data subjects in Turkey can reach you. The mandate includes:
- Completing and maintaining your VERBIS registration.
- Receiving correspondence from the Authority on your behalf.
- Receiving and helping you handle requests from data subjects.
- Supporting you when a data breach must be notified.
The representative must be a Turkish legal entity, or a Turkish citizen resident in Turkey. You appoint it through a board resolution or authorised-signatory decision, which is signed, notarised in your home country, and apostilled before it is sent to Turkey.
Representative or contact person?
Turkish law also uses the term "contact person" (irtibat kişisi). The two are not the same. The contact person is a communication point used within the VERBIS system, while the representative is the party a foreign controller appoints to stand for it under the Law. We make sure your appointment is structured correctly for your situation.
What happens if you do not appoint one
Failure to register with VERBIS can attract significant administrative fines, which the Authority revalues each year in line with the statutory revaluation rate. The Authority has also conducted large enforcement sweeps against controllers that failed to register. Beyond the fine itself, an unregistered foreign controller has no orderly way to receive and answer requests from the Authority or from data subjects, which compounds the risk if a complaint or investigation arises.
Because we are a law firm rather than a software vendor, we do more than register you. If the Authority makes contact or a matter escalates, you are already speaking to counsel who can advise on your liability and defend your position.
Still unsure?
The safest course is a short conversation. Tell us what your company does and where your users, customers, or staff sit, and we will tell you plainly whether the obligation applies and what it would cost to meet it.
Find out where you stand
A 20-minute call, and a clear fixed-fee quote if you need one.