The EU buys more from Türkiye than anyone else. According to the European Commission’s trade profile for Türkiye, about 41% of Turkish goods exports went to the EU in 2024, and the share keeps climbing. Nearly every company behind those shipments holds some EU personal data: a buyer’s name in the CRM, a webshop account, a logistics contact, a support ticket. That data puts the exporter inside the GDPR, and a KVKK compliance file won’t answer the questions an EU customer’s procurement team is going to ask.
KVKK and GDPR look alike, and the 2024 amendments brought them closer. They’re still two laws with two regulators, two sets of paperwork and very different fine ceilings. This article walks through the eight places where a KVKK-compliant Turkish exporter falls short of GDPR, covers both directions of data flow, and ends with a roadmap that reflects how long this stuff actually takes.
Why KVKK Compliance Doesn’t Make a Turkish Exporter GDPR-Ready
Law No. 6698 was written to line Türkiye up with the EU’s 1995 Data Protection Directive. It came into force in April 2016, a few weeks before the EU adopted the GDPR. That timing explains most of what follows. KVKK inherited the Directive’s structure and then developed on its own track under the Personal Data Protection Board, while the GDPR added accountability tools, extraterritorial reach and turnover-based fines that the Directive never had.
So a Turkish company can be fully KVKK compliant, registered in VERBİS, privacy notices in place, and still have no records of processing, no DPIA method, no EU representative, and no answer for an EU customer asking which Article 46 mechanism covers the data they’re about to send to Istanbul.
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
When GDPR Applies to a Turkish Company
Article 3(2) of the GDPR catches companies with no EU establishment in two situations: offering goods or services to people in the EU, and monitoring their behavior. The European Data Protection Board’s guidelines on territorial scope treat euro pricing, shipping to EU addresses, EU-language storefronts and EU-targeted marketing as “offering.” Analytics, retargeting pixels and personalization count as “monitoring.”
There’s a third route that’s easy to miss. A Turkish software house or contract manufacturer that processes EU personal data for an EU customer is a processor under Article 28. The customer will want a data processing agreement, security commitments and help meeting its own GDPR obligations, even if the Turkish company never markets to the EU at all.
Important: Selling only B2B to EU companies doesn’t get you out of this. Business contacts are data subjects. The names, emails and phone numbers of a German buyer’s purchasing staff are personal data under both laws, and the exporter is the controller of them.
KVKK vs GDPR at a Glance
| Obligation | KVKK (Law No. 6698, as amended 2024) | GDPR (Regulation (EU) 2016/679) |
|---|---|---|
| Default legal basis | Explicit consent, with listed exceptions including legitimate interest | Six equal lawful bases; consent is one of them |
| Registry | Mandatory VERBİS registration for most controllers | No public registry; internal Article 30 records |
| Impact assessment | No statutory DPIA | Mandatory DPIA for high-risk processing |
| DPO | Not required | Required in defined cases (Article 37) |
| Representative abroad | Foreign controllers appoint a Türkiye representative | Non-EU controllers appoint an EU representative (Article 27) |
| Data portability | Not granted | Granted (Article 20) |
| Breach notice | Board within 72 hours | Supervisory authority within 72 hours |
| Transfers | Adequacy, Turkish standard contracts, BCRs; 5-business-day filing | Adequacy, EU SCCs, BCRs; transfer impact assessment |
| Maximum fine | ₺17,092,242 in 2026 | €20 million or 4% of global turnover |
Gap 1: Lawful Bases and Consent
KVKK’s Article 5 puts explicit consent at the top and lists everything else as an exception. Turkish privacy notices reflect that, and most of them lean on consent for almost everything. The GDPR treats consent as one option among six, and in practice it’s the weakest one for core business processing. Regulators expect contract performance for order fulfillment, legal obligation for tax records, and legitimate interest for fraud prevention and B2B marketing.
Consent also has a cost that exporters don’t always price in. Under Article 7 it has to be as easy to withdraw as it was to give, and once it’s withdrawn the processing has to stop. An exporter that collects EU customer data “with consent” and then keeps invoicing records for ten years has written a contradiction into its own notice.
Law No. 7499 closed one part of this gap in 2024. Health and sexual-life data lost their special carve-out and the list of grounds for processing sensitive data got longer, so KVKK Article 6 now tracks GDPR Article 9 fairly closely. An exporter’s KVKK approach to sensitive data can be reused for GDPR with light editing.
Cookies are another point of convergence. The Board’s cookie guidance already asks for opt-in consent for anything beyond strictly necessary cookies, a reject button as visible as the accept one, and no pre-ticked boxes. A banner built to that standard will pass with most EU supervisory authorities too.
Gap 2: Accountability Documentation
KVKK asks controllers to register in VERBİS, the public Data Controllers’ Registry, and to keep a processing inventory behind that registration. The GDPR has no registry. What it has instead is Article 30: an internal record of processing activities that a supervisory authority can demand at any time, covering purposes, data categories, recipients, transfers, retention periods, and security measures.
The VERBİS inventory gets you roughly 70% of the way to an Article 30 record. What’s usually missing is the lawful basis for each purpose (VERBİS doesn’t push for it at the same level of detail), the transfer mechanism per recipient, and the Article 28 processor list.
The bigger gap is the Data Protection Impact Assessment. KVKK has nothing like it. GDPR Article 35 makes a DPIA mandatory before high-risk processing starts, and an EU customer may ask to see one before signing. Building the method takes a few weeks. Retrofitting DPIAs onto processing that’s already live takes longer, and it tends to turn up things nobody wanted to find.
Insider Note: Turkish exporters often treat their VERBİS registration as a credential they can hand to EU customers. EU procurement teams rarely know what VERBİS is. What they’ll ask for is an Article 30 record, a DPA and, where it applies, a DPIA.
Gap 3: The EU Representative
Article 27 says a controller or processor with no EU establishment has to name a representative in one of the member states where its data subjects live. The exemption is narrow: occasional processing, no large-scale sensitive data, and low risk. A webshop with recurring EU orders won’t qualify. Neither will a SaaS product with EU users.
KVKK has the mirror-image rule, which is where the confusion starts. Foreign controllers have to appoint a data controller representative in Türkiye. Turkish exporters know that rule well and sometimes assume it runs the other way. It doesn’t. The EU representative is a separate appointment, normally a paid service, and it has to be named in the privacy notice and reachable by supervisory authorities and data subjects.
Gap 4: Data Subject Rights
KVKK Article 11 covers access, rectification, erasure and objection to automated results, and gives controllers 30 days to respond. The GDPR adds data portability (Article 20), the right to restriction (Article 18) and a fuller right to object (Article 21), with a one-month deadline that can stretch by two more months for complicated requests.
The operational gap is wider than the legal one. A KVKK request process built around Turkish-language applications through the channels in the Communiqué on Data Subject Requests won’t cope with a German customer emailing “Auskunftsersuchen nach Art. 15 DSGVO” to the sales inbox. Exporters need a channel EU data subjects can find, a way to verify who’s asking, and template responses in the languages they sell in.
Gap 5: Cross-Border Transfers in Both Directions
This is where most of the money and most of the risk sits, because the same data flow gets regulated twice.
EU to Türkiye. Türkiye isn’t on the European Commission’s list of adequacy decisions. Every recurring flow from an EU customer or EU subsidiary into a Turkish exporter needs a Chapter V mechanism. In practice, that means the 2021 EU Standard Contractual Clauses plus a transfer impact assessment under the Schrems II ruling. The EU side will bring the SCCs. The Turkish side has to be ready to answer the assessment’s questions about Turkish government access to data and the technical measures in place.
Türkiye to EU. Law No. 7499 rewrote KVKK Article 9 with effect from 1 June 2024, and the old consent-based route expired on 1 September 2024. Transfers now rest on a Board adequacy decision, appropriate safeguards, or a short list of exceptions. The Board hasn’t issued an adequacy decision for the EU, so a Turkish exporter sending customer records to a hosting provider in Ireland or a parent company in the Netherlands needs a Turkish safeguard. The Board’s standard contracts have to be signed without changes and filed with the Authority within five business days of signature.
The result is two contracts for one flow: EU SCCs for the EU-origin data coming in, and a Turkish standard contract, in Turkish, filed with the Personal Data Protection Authority, for the data going out. Miss the filing, and there’s a dedicated penalty for it, a 2026 fine band of roughly ₺90,000 to ₺1.8 million.
Pro Tip: Inventory Transfers
Inventory transfers by direction before you touch any contracts. In a typical exporter setup, the ERP, the email platform, the CRM and the support desk each create at least one Türkiye-to-EU flow and one EU-to-Türkiye flow. Putting them on one sheet, with the KVKK mechanism in one column and the GDPR mechanism in the next, is the most useful hour in the whole program.
Gap 6: Breach Notification
The two regimes match on the headline number and differ on nearly everything underneath. KVKK Board Decision 2019/10 requires notification to the Board within 72 hours of learning of a breach, on the Board’s form, and notice to affected individuals as soon as reasonably possible. GDPR Article 33 runs the same 72-hour clock for the supervisory authority, and Article 34 requires notice to individuals when the breach is likely to cause high risk.
The difference is who. A Turkish exporter with no EU establishment has no lead supervisory authority and no one-stop shop. A breach affecting customers in five member states may need reporting to five authorities, through the EU representative, each with its own form and language. A breach playbook written around a single Board notification needs a second track.
Gap 7: Processor Obligations and Vendor Contracts
Article 28 requires a written contract between every controller and processor with a fixed set of terms: documented instructions, confidentiality, security measures, sub-processor approval, help with data subject rights and DPIAs, deletion or return at the end of the service, and audit rights. KVKK’s Article 12 makes controllers and processors jointly responsible for security but doesn’t prescribe contract content in anything like that detail.
An exporter’s Turkish vendor contracts, drafted to KVKK, will usually fail an EU customer’s DPA review on sub-processor flow-down and audit rights. The customer’s DPA will also require the exporter to push the same terms down to its own suppliers, including Turkish hosting, payroll, and logistics providers that have never seen an Article 28 clause.
Gap 8: Penalties and Enforcement Exposure
The top KVKK fine in 2026, for data-security failures including unlawful transfers, is a little over ₺17 million. GDPR Article 83 caps fines at €20 million or 4% of worldwide annual turnover, whichever is higher. For a mid-sized exporter the GDPR ceiling is an order of magnitude higher, and it’s calculated on group turnover rather than Turkish turnover.
Enforcement against non-EU companies is real, but it’s usually indirect. Supervisory authorities can order the EU representative to act, or order EU customers to suspend transfers. In the cases that matter commercially, the customer’s own DPO simply blocks the contract. The most common “fine” a Turkish exporter pays for a GDPR gap is a lost tender.
Where the Gap Bites Hardest for Turkish Exporters
E-commerce and marketplace sellers run straight into Article 3(2). EU-facing storefronts, retargeting, and marketplace integrations create controller obligations, an Article 27 requirement, and transfer flows on every order.
SaaS and software exporters are usually processors for EU customers. The blocking item is nearly always the DPA package: Article 28 terms, a sub-processor list, EU SCCs for support access from Türkiye, and a security questionnaire. Expert support on security questionnaires shortens that cycle a lot.
Manufacturers and B2B suppliers underestimate their exposure because the data volume is small. It is small. But a supplier portal, a quality-incident tracker and a sales CRM still hold EU personal data, and big EU buyers now run supplier privacy assessments alongside their ISO 27001 checks.
Logistics and tourism operators handle the most sensitive flows: passport copies, itineraries and home addresses of EU individuals, often shared with subcontractors on both sides of the border. Each of those hand-offs, and every overseas server or affiliate that receives the data, is a regulated transfer under both laws.
A Roadmap to Close the KVKK to GDPR Gap
Map EU data flows and confirm applicability. List every system that holds EU personal data, who the data subjects are, and whether the company is controller or processor for each. Most exporters get through this in one to two weeks.
Run a KVKK-to-GDPR gap assessment. Start from the VERBİS inventory and test it against Articles 27, 28, 30, 33 to 35 and Chapter V. Two to three weeks, and it produces the remediation list that everything else hangs off.
Update notices, consents and DPAs. Move EU processing off consent where another basis fits, add the EU representative and transfer disclosures, and adopt an Article 28 DPA template for customers and suppliers.
Appoint the EU representative and build the rights process. Name the representative in the notice, set up an EU-facing request channel, and write response templates in the main sales languages.
Put transfer mechanisms in place for both directions. EU SCCs with a transfer impact assessment for inbound flows. Turkish standard contracts, filed within five business days, for outbound flows. Supplementary technical measures such as data masking aligned to ISO 27001 and GDPR for support access help both assessments.
Run one privacy program that satisfies both regulators. Keep a single record of processing with KVKK and GDPR columns, one breach playbook with two notification tracks, and one DPIA method. ISO 27701 gives you a ready-made structure for this, and it reads well in EU procurement.
For an exporter with a working KVKK program, the full roadmap usually lands somewhere between 8 and 14 weeks. Exporters starting from a bare VERBİS registration should budget four to six months, because the processing inventory has to be rebuilt before anything else can start.
Worth Knowing: Downside of the Dual Regime
The honest downside of the dual regime is recurring cost rather than one-off effort. The EU representative is an annual fee, every new EU customer brings a fresh DPA negotiation, and every new SaaS tool the company adopts triggers both a Turkish filing and a GDPR transfer check. Budget for the maintenance, not just the project.
Can a Single Compliance Program Cover Both KVKK and GDPR?
Yes, and it’s the only sensible way to run it. The two laws now share the same skeleton: principles, lawful bases, rights, breach notification and a three-tier transfer model. Build the program to the GDPR standard, then layer the KVKK-specific mechanics on top: VERBİS registration, the Turkish standard contract filing, Turkish-language notices and the Board’s forms. Going the other way, starting from KVKK and bolting on GDPR clauses, leaves the accountability documentation and the DPIA layer permanently thin.
Axipro builds these dual programs for exporters and SaaS companies selling into the EU, usually on a GRC platform holding one control set mapped to both frameworks. Axipro’s GDPR compliance services page explains how that engagement runs.
Let Axipro help you build a business continuity plan that's practical, compliant, and audit-ready.
Schedule Your Free Assessment Today
Conclusion
KVKK gives Turkish exporters a solid base, and the 2024 amendments removed the worst of the old transfer problem. What’s left sits in eight places: consent-heavy legal bases, missing Article 30 and DPIA documentation, the EU representative, extra data subject rights, two-direction transfer contracts, multi-authority breach notification, Article 28 vendor terms, and a fine ceiling that scales with global turnover. Close those in one program and the next EU due-diligence request turns into a document send instead of a deal risk.
Frequently Asked Questions
Does a Turkish company need to comply with GDPR if it is already KVKK compliant?
Yes, if it offers goods or services to people in the EU, monitors their behavior, or processes EU personal data for an EU customer. KVKK compliance covers the Turkish obligations only. GDPR sits on top, with its own documentation, representative and transfer requirements.
Is Türkiye an adequate country under GDPR?
No. Türkiye isn’t on the European Commission’s Article 45 adequacy list. Personal data sent from the EU to a Turkish company needs EU Standard Contractual Clauses or another Article 46 safeguard, plus a transfer impact assessment.
Do Turkish exporters need an EU representative?
Most do. Article 27 exempts only occasional, low-risk processing without large-scale sensitive data. An exporter with recurring EU customers, a webshop, or EU users on a software product needs to appoint one and name it in its privacy notice.
Did the 2024 KVKK amendments close the gap with GDPR?
Part of it. Law No. 7499 aligned the special-category data rules and rebuilt cross-border transfers around adequacy, standard contracts and binding corporate rules. It didn’t add a DPIA obligation, a DPO requirement, data portability or turnover-based fines, so the gaps in accountability documentation and rights are still there.
How long does it take to close the KVKK to GDPR gap?
Eight to fourteen weeks for an exporter with a working KVKK program and a current VERBİS inventory. Four to six months if the processing inventory has to be rebuilt first. The transfer contracts and the EU representative appointment are the steps that slip most often.
