Contact us
Contact us

Turkey KVKK Data Controller Representative

Turkey's Law No. 6698 (KVKK) does not itself require a foreign data controller to appoint a representative. The duty sits in a separate regulation, and it turns on a registry filing most foreign companies have never heard of: VERBIS.

Book a free intro call See pricing
By Julian Gage Last reviewed: 10 September 2026

Turkey’s Law No. 6698 (KVKK) does not itself require a foreign data controller to appoint a representative. The duty sits in a separate regulation, and it turns on a registry filing most foreign companies have never heard of: VERBIS.

The short answer: if you have to register with VERBIS and you have no establishment in Turkey, the Registry Regulation makes you appoint a representative who is a Turkish legal entity or a Turkish citizen. Because that representative has to be Turkish, we deliver the appointment through a vetted local partner and handle the registration, remaining your single point of contact. We do not pretend an Amsterdam or UK entity can perform this role. It cannot.

What the Turkish requirement is

The Personal Data Protection Law, Law No. 6698 (KVKK), is Turkey’s general data protection statute. It does not contain a representative requirement on its own terms. The representative duty comes from a separate instrument: the Regulation on the Registry of Data Controllers, Veri Sorumluları Sicili Hakkında Yönetmelik, published in the Official Gazette on 30 December 2017 as Official Gazette No. 30286. Articles 4 and 11 of that Regulation require a data controller not established in Turkey, who has to register with VERBIS, to appoint a representative established in Turkey.

VERBİS, the Veri Sorumluları Sicili or Data Controllers’ Registry, is the mechanism the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, KVKK Kurumu) uses to track who processes personal data subject to Turkish law and how. Registration is the trigger for the representative duty, not a separate question: if VERBIS registration applies to you and you are not established in Turkey, the representative requirement follows automatically under Articles 4 and 11.

Who needs it

A company with no establishment in Turkey whose processing brings it within the VERBIS registration duty. Whether that applies to a specific company depends on the Authority’s own registration decisions and exemption thresholds, which are scoping questions rather than something this page can answer in the abstract. A foreign SaaS, e-commerce, or platform business with Turkish users, employees, or business partners is the profile that most often needs the check.

Who can hold the role

The Registry Regulation is specific: the representative must be a legal entity established in Turkey or a Turkish citizen. There is no route for a company established outside Turkey, ours included, to perform the role directly. That single sentence is why this appointment works differently from the EU, UK, and Swiss mandates Engage runs from its own establishments: the Turkish rule ties the role to Turkish establishment or nationality, not merely to a written mandate.

What we do

  • Local representative appointment, coordinated through a vetted Turkish partner who meets the Registry Regulation’s establishment or citizenship requirement.
  • VERBIS registration, filed together with an authenticated copy of your own appointing decision, and kept current as your processing changes.
  • Single point of contact. You deal with Engage throughout; we manage the relationship with the local partner and the filing itself.
  • Coordination with your wider footprint, including an EU or UK Article 27 representative and a DPO, where you need more than one appointment.

How it works

Scoping. We confirm whether VERBIS registration and the representative duty actually apply to you, rather than assume they do because a competitor’s checklist says so.

Appointment. Your appointing decision is prepared, and the Turkish representative is engaged through our local partner.

Registration. The representative files the VERBIS registration, with the appointing decision attached.

Ongoing. The representative acts as the registered contact for the Authority, and we keep the registration current when your processing or your details change.

What it costs

This appointment is scoped per engagement rather than sold as a published flat fee, because the local partner’s own fee and the scope of the VERBIS filing both vary by case. Where it sits inside a wider privacy program, it is scoped alongside the DPO tiers, which start From €1,000 per month for DPO Foundation. See pricing for the published DPO and EU representative figures, and global privacy compliance for how a multi-jurisdiction program is put together.

Why Engage Compliance

We are honest about the boundary, the same way we are on the China and Korea appointments. The Turkish representative has to be a Turkish legal entity or citizen, so we do not claim to hold the role ourselves. We scope whether the duty applies to you, coordinate the vetted local partner who does hold it, manage the VERBIS filing, and stay your single point of contact so you are not left coordinating a foreign registry yourself. Where you also need an EU or UK representative or a DPO, we scope all of it together. Every engagement carries professional indemnity and cyber insurance.

Sources and references

  • Same-business-day response
  • Professional indemnity and cyber insurance
  • Named DPO notified to the supervisory authority
  • Trust Center
Book a free intro call Contact us Start representative sign-up

FAQ

Frequently asked questions

Can Engage also act as our DPO?

Yes. Engage supports both Data Protection Officer work and Article 27 representative work, as two separate products scoped to what you need. See DPO Services.

Does a foreign company need a representative in Turkey under KVKK?

If your company has no establishment in Turkey and you are required to register with VERBIS, the Data Controllers' Registry, then yes. The duty is not in Law No. 6698 itself. It comes from the Regulation on the Registry of Data Controllers (Veri Sorumluları Sicili Hakkında Yönetmelik), Official Gazette 30 December 2017 No. 30286, Articles 4 and 11, which require a foreign data controller registering with VERBIS to appoint a representative in Turkey.

Who can act as our KVKK representative in Turkey?

The Registry Regulation requires the representative to be a legal entity established in Turkey or a Turkish citizen. A company established outside Turkey, including an Amsterdam or UK entity, cannot perform this role directly. That is the whole reason this is a local appointment rather than something Engage can extend from its own EU establishment, the same structural fact that makes the China and Korea appointments local ones too.

What is VERBIS, and do we have to register?

VERBİS, the Veri Sorumluları Sicili or Data Controllers' Registry, is the register the Personal Data Protection Authority (KVKK Kurumu) maintains of data controllers subject to Turkish law. Registration duties and exemptions are set by the Authority's own decisions and can change; whether a specific foreign company must register is a scoping question, not something a general answer can settle for every reader.

What does the representative actually do?

Files and maintains the VERBIS registration on the controller's behalf, and acts as the authenticated point of contact the appointing decision names to the Authority. The appointment is filed together with an authenticated copy of the foreign controller's own decision to appoint, so the paperwork runs both directions: the controller's decision, and the representative's registration of it.

What happens if we do not register or appoint a representative when required?

Failing to register with VERBIS when required, or to notify changes to a registration, carries an administrative fine under KVKK Article 18(1)(c). The Authority revalues the fine band each year, so we confirm the current figure at the point of scoping rather than quote a number that may already be stale by the time you read this.

Is a KVKK representative the same as a GDPR Article 27 EU representative?

No. They answer to different regulators under different statutes, and one appointment does not satisfy the other. A company selling into both the EU and Turkey typically needs both: an EU Article 27 representative and a Turkish KVKK data controller representative. We arrange both, and where you also need a DPO we scope that alongside them.

Can Engage Compliance be our representative in Turkey directly?

No, and we say so plainly rather than let the point sit implied. The representative has to be a Turkish legal entity or a Turkish citizen, so Engage coordinates a qualifying Turkish representative through a vetted local partner and manages the VERBIS registration for you, remaining your single point of contact throughout. This is the same structure we use for China's PIPL representative and Korea's PIPA domestic agent, both of which are local appointments by the same statutory logic.

Related

Hub Non-EU representative and agent services Service China PIPL compliance services Service EU Representative service Guide GDPR and China PIPL Service Global privacy compliance Service DPO Services