We prepare your Turkish KVKK documents
Our tools stay free and most small operations should just use them. This page is for the case where that is not the answer: a foreign company with a Turkish entity, Turkish employees or Turkish customers, where the documents have to be in Turkish, the legal bases have to be decided, and nobody in the building reads Turkish law. Packages start at €450.
Scope limit, stated up front: this is a documentation and process setup service, not legal advice and not a substitute for a Turkish lawyer. The documents we deliver are drafts and we recommend Turkish counsel reviews them before use. Litigation, disputes and submissions to the Personal Data Protection Board are out of scope. Nobody can guarantee you will not be fined, and we do not.
Why GDPR compliance does not cover this
Three differences do most of the damage, and all three are structural rather than cosmetic.
There is no adequacy decision for anywhere. Turkey has issued none. Since 1 September 2024 explicit consent is no longer available as a routine basis for moving data out of Turkey, so recurring transfers need standard contractual clauses — used exactly as published, with the Turkish text governing, and notified to the Authority within five business days of signature. That filing deadline has no GDPR equivalent, which is precisely why it gets missed. Detail: cross-border transfers and SCCs.
The document architecture itself is regulated. Principle Decision 2026/347 (18 February 2026) requires the privacy notice and the explicit consent text to be separate documents with separate declarations, prohibits asking anyone to "accept" a privacy notice, and treats asking for consent where another legal basis applies as a defect in its own right. A GDPR notice that bundles acknowledgement and consent into one tick-box passes European review and fails here. Detail: Decision 2026/347.
VERBIS is a registry with its own thresholds. There is no GDPR counterpart. The thresholds are alternatives, not cumulative, and companies whose main activity is processing special categories of data are caught regardless of headcount or balance sheet. Detail: VERBIS for foreign companies.
Packages
Essential
€450 excl. VAT
Single Turkish entity, no recurring transfers abroad
Delivery: 5 business days
- Processing inventory, completed from your process map
- Privacy notice (Article 10) in Turkish
- Explicit consent text as a separate document (Decision 2026/347)
- Retention and destruction policy
- VERBIS registration assessment
- English explanatory memo — what each document does and where it is used
- Delivery: editable .docx + PDF
Cross-border
€890 excl. VAT
Data leaves Turkey — parent company, cloud region or shared services
Delivery: 7 business days
- Everything in Essential
- Transfer mapping — every flow leaving Turkey, remote access included
- Standard contractual clauses package, prepared from the Authority's published text
- Turkish governing-text check against your English original
- Five-business-day notification calendar with a named owner
- Cookie and website privacy texts in Turkish
- One revision round
Full
€1,690 excl. VAT
Turkish payroll, several collection points, DSAR obligation
Delivery: 10 business days
- Everything in Cross-border
- Employee, job candidate and CCTV notice variants
- VERBIS registration preparation
- Data breach response plan and the 72-hour notification flow
- Data subject request procedure and Turkish response templates
- Data processor contract addendum for vendors and agencies
- Handover call + three months of email support
How it runs
- Quote. You send the form below. Within one business day you get scope and a firm price in writing. Free and non-binding.
- Discovery. A short questionnaire and one call: what you process, why, where it sits, and what leaves Turkey. No personal data changes hands — we ask for descriptions, not files.
- Drafting. Turkish documents written against your actual activities, each processing purpose matched to a legal basis, plus the English memo.
- Handover. Editable .docx and PDF, with an implementation note saying where each document goes and who owns the recurring obligations.
Payment and invoicing
Invoiced by a registered Turkish sole proprietorship. Payment is by bank transfer; 50% before work starts and 50% on delivery. There is no card payment on this site, so we never ask for card details. Bank details go out in writing with the quote.
Who you are contracting with
- Trading name
- Muhammet Çay — registered sole proprietorship (Türkiye)
- Tax office
- Sultanbeyli
- Address
- Hilal Mah. Nazır Sk. No: 21 İç Kapı No: 4, Sancaktepe / İstanbul
- Phone
- +90 538 054 55 53
- [email protected]
Terms: pre-contract information · distance sales agreement · cancellation and refunds (Turkish). If work has not started, cancellation is free and the full amount is refunded.
Frequently asked questions
We are already GDPR compliant. Isn't that enough?
No, and this is the single most common assumption we correct. Turkey is not an EU member and Law No. 6698 is a separate regime with its own requirements: a VERBIS registry with no GDPR counterpart, a cross-border transfer framework where no adequacy decision exists for any country, and — since Principle Decision 2026/347 — a mandated document architecture for notices and consent. A GDPR-shaped notice translated into Turkish typically fails on structure, not on substance.
Do the documents have to be in Turkish?
The documents that are given to data subjects and to the Authority need to be in Turkish. That is why we deliver Turkish text and a separate English memo explaining what each document does, so your legal team can review the decisions without reading Turkish.
Is this legal advice?
No, and we write that on every deliverable. This is documentation and process setup. The documents we produce are drafts; we recommend Turkish counsel reviews them before you put them into use. Litigation, disputes and submissions to the Board are out of scope and we do not take that work.
How do you price and invoice?
Prices are quoted in euro and invoiced by a registered Turkish sole proprietorship. Payment is by bank transfer; we do not take card payments and never ask for card details. Bank details are sent in writing with the quote. Ask your finance team to confirm the tax treatment on your side before paying — we do not advise on that.
What do you need from us?
A description of what you process and why — not the data itself. Do not send us employee files, customer lists or database extracts; we do not want them and do not need them. A short questionnaire and one call are usually enough.
Can we do this ourselves instead?
Yes, and if your Turkish operation is small you probably should. Our wizard generates the same five core documents free, with no account and no payment. What you buy here is the judgement work: mapping your actual activities, deciding which legal basis each one rests on, and closing the gaps — roughly 20 to 40 hours if you have never done it.
Try the free tools first
The fastest way to find out whether you need this is to run the free wizard — no account, no card, nothing leaves your browser. If the output covers your situation, use it and keep your money. If the gaps are the ones described above, ask for a quote.
Message on WhatsApp