Data Controller
Representative (Turkey)
Mandatory local representation for foreign companies processing data in Turkey. Appoint our elite Turkish data protection attorneys to serve as your "Veri Sorumlusu Temsilcisi," ensuring absolute compliance with the strict mandates of the KVKK Board.
The Extraterritorial Anchor of Turkish Privacy Law
The Personal Data Protection Law No. 6698 (KVKK) establishes strict territorial requirements. To ensure that the fundamental rights of Turkish citizens are protected, and to guarantee that the Personal Data Protection Authority (KVKK Kurumu) has a jurisdictional anchor for enforcement, foreign entities cannot operate in a legal vacuum.
If your organization is domiciled outside the Republic of Turkey but processes the personal data of individuals residing in Turkey (e.g., e-commerce, SaaS, ad-tech, or multinational HR), you are legally required to appoint a Data Controller Representative (Veri Sorumlusu Temsilcisi). This is not a nominal role; it requires a formal, notarized corporate resolution and acts as the singular legal conduit between your global operations and the Turkish regulatory authorities.
The Crucial Link to VERBİS
The appointment of a representative is inextricably linked to the Data Controllers Registry (VERBİS). Under Turkish law, foreign data controllers must register their data processing inventories in VERBİS before they commence processing. However, a foreign entity cannot access the VERBİS portal directly. The designated Data Controller Representative is the only entity legally authorized to log into VERBİS, submit the data inventory, and maintain the registry on behalf of the foreign controller.
Statutory Framework & Board Decisions
Relevant Turkish Legislation
- Regulation on the Data Controllers Registry, Article 11:
"Data controllers who are not resident in Turkey shall appoint a data controller representative... The representative must be a legal person established in Turkey or a Turkish citizen resident in Turkey." - KVKK Law No. 6698, Article 16:
Dictates the obligation to register with the Data Controllers Registry prior to processing personal data. - KVKK Law No. 6698, Article 18 (Misdemeanours):
Failure to fulfill the obligation to register with and provide notification to the Data Controllers Registry is subject to administrative fines. These fines are updated annually via the Revaluation Rate (Yeniden Değerleme Oranı) and can reach millions of TRY. - Landmark Board Decisions:
The KVKK Board has consistently fined foreign gaming, social media, and e-commerce platforms maximum penalties for failing to appoint a representative and bypassing VERBİS obligations.
Our Formal Appointment Procedure
As senior Turkish data protection attorneys, we execute a meticulous, legally unassailable onboarding process to establish your compliance in Turkey.
Board Resolution & Apostille
We provide you with the exact bilingual corporate resolution required by Turkish law. You execute this, have it notarized and Apostilled in your home jurisdiction, and send it to our Istanbul offices.
Translation & Notarization in Turkey
We manage the sworn translation of your documents into Turkish and secure the final local notarization required by the KVKK Authority.
Authority Notification & VERBİS Access
We formally submit our designation to the Personal Data Protection Board and obtain the access credentials required to manage your VERBİS inventory.
Privacy Notice (Aydınlatma Metni) Updates
We provide the specific Turkish legal clauses required for your public-facing privacy notices, officially listing our law firm as your local proxy.
Operating in Turkey Without Representation?
Foreign data controllers are a primary target for the KVKK Board. Failure to appoint a representative blocks your VERBİS registration, guaranteeing maximum administrative fines.
Initiate Appointment ProcessRisks of Informality & Non-Compliance
Many foreign organizations attempt to bypass this rule by listing a generic email address for Turkish users or assuming their EU GDPR Representative covers Turkey. The KVKK Board has shown zero tolerance for these assumptions. When a Turkish citizen lodges a complaint (Şikayet) with the Board, the Board's first action is to query VERBİS to find the representative. If none exists, an investigation is launched immediately.
By appointing an elite Turkish legal team, you do not just tick a compliance box; you establish a formidable defensive perimeter against vexatious complaints and aggressive regulatory audits.
Frequently Asked Questions
Expert answers regarding KVKK Representative obligations.
Who must appoint a Data Controller Representative in Turkey?
Under the Regulation on the Data Controllers Registry, any legal or natural person acting as a data controller who is NOT resident/established in Turkey, but processes personal data of individuals in Turkey, must appoint a Data Controller Representative (Veri Sorumlusu Temsilcisi) before processing begins.
Is this the same as the VERBİS Contact Person (İrtibat Kişisi)?
No. A Contact Person (İrtibat Kişisi) is appointed by companies established IN Turkey. Foreign companies MUST appoint a Data Controller Representative. The Representative must be a legal entity established in Turkey or a Turkish citizen residing in Turkey.
What are the liabilities of the Data Controller Representative?
The Representative acts as the primary liaison with the Personal Data Protection Authority (KVKK Kurumu). They receive notifications, facilitate data subject requests, and manage VERBİS registration. While substantive liability remains with the foreign controller, the representative is the jurisdictional anchor for enforcement.
What are the administrative fines for failing to appoint a representative?
Failing to appoint a representative results in the inability to register with VERBİS. Under Article 18 of the KVKK, failure to fulfill the registry obligation carries administrative fines that are re-evaluated annually, currently reaching millions of Turkish Liras. Furthermore, the Board may prohibit your data processing activities in Turkey entirely.
How is the representative appointed legally?
The appointment requires a formally notarized and apostilled (or consular-legalized) Board Resolution or Power of Attorney from the foreign company, specifically detailing the mandate to act as the Data Controller Representative in Turkey. This document must then be officially translated into Turkish.
Does appointing a representative trigger tax residency in Turkey?
Appointing a Data Controller Representative under the KVKK does not inherently create a permanent establishment or trigger corporate tax residency in Turkey. It is a strictly regulatory mandate for data protection compliance.
How do data subjects contact the representative?
The contact details (address, KEP email, or secure portal) of the Representative must be explicitly stated in the foreign controller's Privacy Notice (Aydınlatma Metni) targeting Turkish users.
Can our EU GDPR Representative cover Turkey?
Absolutely not. Turkey is not an EU member state and operates under its sovereign law (KVKK No. 6698). The representative must be domiciled in the Republic of Turkey.
Establish Your Legal Shield in Turkey
Mandate our 30+ year experienced attorneys to represent your global enterprise before the Turkish Data Protection Authority.
Book a Legal ConsultationDisclaimer: This content is for informational purposes only and does not constitute legal advice or create an attorney-client relationship. Turkish data protection regulations (Law No. 6698) and Board precedents are subject to change. Please consult directly with our legal team for tailored counsel.