KVKK Representative for Foreign Companies: Appointment and VERBİS

Identify the controller before starting a registration

Begin with the legal entity that determines the purposes and means of the relevant processing. The business signing customer contracts, an overseas parent, and a local subsidiary may have different roles. A Turkish distributor or group company does not automatically become the foreign controller's formally appointed representative.

Describe the activities connected with Türkiye, the people affected, and how information moves between the entities involved. A foreign company with customer accounts, staff, or a recurring local operation should have a documented assessment of the applicable KVKK duties. Do not import an EU Article 27 conclusion into that assessment; Türkiye has its own legal framework and registration procedure.

Assess VERBİS and the applicable exceptions

The official registry by-law provides for foreign controllers that are subject to registration to register through their representatives before processing begins. Determine whether the controller is in scope and whether a current exemption applies. Review the relevant Board decisions and the facts of the entity being assessed, rather than relying on a threshold summary copied from a different category of business.

Exemption from registration does not automatically remove the other obligations under KVKK. Privacy information, lawful processing, security, rights handling, retention, and transfers still require the appropriate assessment. Keep the registration conclusion and its supporting facts available for review when the business changes.

Representative, contact person, and adviser are different roles

The registry by-law defines a representative for a controller not established in Türkiye as a legal person established in Türkiye or a natural person who is a Turkish citizen, with the specified authority to represent the controller. The contact person is a separate procedural role used for communication with the Authority. Simply naming an employee as a contact does not replace the required representative mandate.

Prepare an appointment decision with the right authority

The by-law addresses a certified copy of the decision appointing the representative. The mandate should cover the relevant registry functions and the receipt and transmission of Authority correspondence and data-subject requests. Confirm who is authorised to sign for the foreign entity and what certification, translation, or other formalities are needed for its documents.

Plan time for obtaining the correct corporate records. A signed commercial proposal is not necessarily the complete appointment documentation. Agree which party prepares, signs, certifies, and submits each item, and establish a secure method of exchanging the documents and account information needed for the process.

Build the information behind the registry entry

The registry information should be based on the controller's processing inventory. Gather purposes, data and data-subject categories, recipient groups, overseas transfers, retention periods, and security measures. Ask the teams that own the processes to confirm the entries; a general website privacy notice may not describe everything the organisation actually does.

Use consistent terminology across the inventory, notices, contracts, and registry submission. If HR describes one retention period and a supplier agreement describes another, resolve the difference before presenting the information as settled. The representative can support the process, but the controller remains responsible for the accuracy and currency of its information.

An illustrative foreign supplier onboarding

Consider a foreign equipment supplier opening recurring sales and after-sales support in Türkiye. It processes business contact details, service tickets, and access information for field visits. Its first task is to identify which entity controls each activity and which Turkish obligations follow, rather than assuming every record belongs to its local distributor.

If the assessment leads to a representative and registration requirement, the supplier organises the appointment decision, inventory, contact arrangements, and submission responsibilities. Separately, it reviews remote access from overseas and the disclosures needed in its privacy information. This example shows the workstreams to coordinate; it is not a finding that every supplier with these features has the same obligations.

Budget for the subscription and the setup fee

Our KVKK Data Controller Representative product has a €1,500 one-time setup fee. For the Growth tier, the annual-billed subscription is €99 per month equivalent, paid as €1,188 per year. The subscription plus setup fee therefore totals €2,688 at the initial annual checkout, before any applicable taxes or separately agreed work.

Confirm the appropriate company-size tier and the processing scope before selecting a package. Translation, certification, additional advisory projects, and work outside the agreed engagement should be discussed explicitly. An advertised representative package should not be read as a promise to complete every KVKK implementation task.

Make the local correspondence route operational

Name the person inside the foreign controller who receives escalations and can obtain the information needed for a response. Agree how local correspondence is logged, translated when necessary, transmitted securely, and tracked against the applicable deadline. Set up cover for holidays and changes in personnel.

Review the registry information when the underlying facts change. The official guidance states that changes to registry records are notified through VERBİS within seven days of the change. Keep a change log so the representative receives updates promptly rather than discovering outdated information during a complaint or authority enquiry.

What to bring to the first discussion

A useful first discussion can begin with an entity chart and a short description of the Turkish operations. Add the registration assessment if one exists, identify the current privacy owner, and flag any processing that has already started or any active correspondence. Be clear about what is known and what still needs to be confirmed.

The next step should identify the appointment and registration work, the supporting documents, internal owners, and the separate compliance questions that need attention. Keep those workstreams connected while allowing each legal question to be assessed under the correct rules.

Frequently asked questions