So… uh… hi.
Imagine you’re running a kitchen. Tickets flying, pans screaming, everyone’s half-shouting “behind” and “hot”.
Now imagine someone quietly started sending every single order chit to a printer outside the country. Different city. Different rules.
That’s what cross-border data transfers via SaaS tools feel like under KVKK, the Turkish data protection law. You think you’re just using a friendly cloud tool. The law thinks you might be exporting your whole “menu” of personal data out of Türkiye without permission.
And the inspector – the Data Protection Authority / Board – doesn’t really care that “everyone else does it”. They care:
- What data left the kitchen?
- On what legal basis?
- Did you tell anyone?
- Did you sign the right stuff?
If not, the fines are… loud. And in the worst case, they can basically tell you:
“You’re done sending data out. Close that door. Local only now.”
1. What actually counts as a “cross-border transfer” with SaaS?
In the new regime after the 2024–2025 amendments, Türkiye finally writes it down clearly:
If a controller or processor in Türkiye makes personal data accessible in any way to a controller or processor abroad, that’s a cross-border transfer.
That means:
- Your CRM hosted in the US? Transfer.
- Slack / Teams / project tools storing employee messages on EU or US servers? Transfer.
- HR or payroll SaaS with servers in Ireland? Transfer.
- Even just remote support where an engineer abroad can see live production data? Yep – transfer.
You think you’re just “logging in to a website”. KVKK thinks:
“Data went out. Show me the legal recipe.”
2. The new Article 9 structure: three doors you can use
After June 2024, Article 9 of KVKK works more like GDPR: there’s a three-step structure for transfers abroad:
- First: you need a processing ground under Articles 5–6 KVKK (contract, legitimate interest, legal obligation, etc.).
- Then: one of these must exist:
- Adequacy decision for the destination country (still rare), or
- “Appropriate safeguards” – standard contracts, BCRs, certain agreements, or
- One of the exceptional cases (public interest, vital interest, explicit consent as last resort, etc.).
- Finally: you must respect all extra obligations in the Regulation on Transfer Abroad and the Guidelines – including notification of standard contracts to the Authority.
If you skip one of these doors, you are basically climbing out of the kitchen window with the data.
3. Appropriate safeguards: the “mise en place” for cloud transfers
For SaaS tools, you usually end up here:
“No adequacy decision. We still need to use this tool. So… appropriate safeguards?”
The new framework gives you a few options:
3.1. Standard contracts (SCC-style)
The Board has published standard contracts (controller–controller and controller–processor versions).
If:
- Your Turkish company (data exporter)
- Uses a SaaS provider abroad (data importer)
…you can sign the relevant standard contract that includes:
- categories of data,
- purposes,
- security measures,
- data subject rights,
- audit and suspension clauses.
But – and this is the part everyone “forgets” – you must notify the Authority about that standard contract within the legal period (5 business days) through the official system.
Start transfers before you’ve done the paperwork and lodged the notification?
The Guidelines literally say: that’s unlawful.
3.2. Binding Corporate Rules (BCRs)
If your SaaS provider is part of a big group and you’re inside that group, they can use BCRs – group-wide rules approved by the Board. But:
- These must be submitted and approved by the Authority.
- Transfers based on BCRs before approval are also considered unlawful.
BCRs are like a fine-dining prep list – beautiful, heavy, slow to build, hard to change.
3.3. “Exceptional” transfers
There are exceptional grounds (public interest, vital interests, contract necessity, exercise of rights, etc., plus explicit consent of the data subject).
Using pure explicit consent for daily, bulk SaaS flows is like trying to run a 200-cover dinner service using verbal notes only – technically possible, practically insane. The Guidelines clearly treat these as exceptional, not your main architecture.
4. Fines: when the Board sends the bill
Here’s where the anxiety really spikes.
From 2025 onwards, the Authority has published updated administrative fines for KVKK violations.
For our SaaS context, three are especially painful:
- Failure to fulfil data security obligations (KVKK Art. 12 → Art. 18/b):
- 2025 range: roughly TRY 204,285 – 13,620,402.
- Failure to comply with Board decisions (Art. 15 → Art. 18/c):
- 2025 range: about TRY 340,476 – 13,620,402.
- Failure to fulfil the standard contract notification obligation for cross-border transfers (Art. 9/5):
- 2025 range: around TRY 71,965 – 1,439,300.
That last one is very specific:
“You used the Board’s standard contract but didn’t notify us properly? Here is a fine just for that.”
So even if your SaaS vendor is safe and your contract is beautifully drafted, if you forget one administrative step, the bill hits anyway.
5. Forced localization risk: when the inspector shuts down your supply chain
Money is one thing. But the real nightmare isn’t the fine. It’s when the Authority looks at your cross-border SaaS flows and says:
“No more.”
Under KVKK, the Board can decide to stop the processing of personal data or the transfer of personal data abroad if there is unlawful processing and a risk of difficult or impossible damage.
For a modern company glued together by SaaS, that can feel like forced localization overnight:
- Your CRM, ticketing, HR, analytics – suddenly cannot lawfully send data abroad.
- You’re pushed to:
- move to local hosting, or
- build separate on-premise systems in Türkiye, or
- shut down certain tools entirely.
It’s like a health inspector banning all imported ingredients in the middle of service.
You can technically go on cooking – but not with the recipes you built your business on.
6. SaaS reality check: where companies typically break the law without noticing
If you map a Turkish company’s tools, patterns keep repeating:
- Marketing team spins up a US-based e-mail automation tool.
- Sales uses a cloud CRM with all customer phone numbers.
- HR uses an EU-based HR suite for performance reviews and salary data.
- IT invites an external support team abroad to “quickly check” production logs.
None of these people think: “I am now performing a cross-border transfer under Article 9 KVKK and must ensure appropriate safeguards and notification.”
But the Authority does. The Guidelines explicitly say that transfer includes making personal data accessible abroad in any way, not just physically “sending”.
So the risk picture looks like this:
- Shadow SaaS = invisible cross-border transfers;
- No SCC, no BCR, no adequacy = unlawful basis;
- No notification = separate fine;
- Breach or complaint = investigation + potential suspension + big “localize or die” pressure.
7. How to survive this as a Turkish controller using SaaS (without burning the whole kitchen)
If I had to lay it out like a prep list before dinner service:
Step 1 – Inventory your SaaS
- List every tool that can touch customers, leads, employees, vendors.
- Note where the data is stored and who can access it (US, EU, UK, elsewhere).
Step 2 – Decide if KVKK really applies to each flow
- Is the Turkish entity the controller? Almost always yes.
- Is the foreign SaaS a processor or separate controller? Think carefully – it affects which standard contract you use.
Step 3 – Pick the legal route
For each tool, ask:
- What is my Article 5/6 legal ground (contract, legitimate interest, legal obligation…)?
- Is there an adequacy decision? (Probably not yet, so move on.)
- Which appropriate safeguard fits?
- Standard contract with the SaaS provider?
- BCR if you’re in the same group?
- Some special public-sector agreement?
Step 4 – Do the boring but lethal admin
- Sign the correct version of the standard contract.
- File the notification to the Authority on time.
- For BCRs, don’t start using them as your main legal basis before approval.
Step 5 – Have a “what if they suspend us?” plan
Ask yourself the uncomfortable question:
“If tomorrow the Board ordered us to stop transferring data for Tool X, what’s our Plan B?”
- Local alternative?
- Turkish data center region?
- Temporary partial localization (e.g. employees only, customers local)?
Don’t wait for the letter to start thinking about this.
8. Closing: the rookie at the podium
There’s a moment when you’re plating and your hands are shaking, and you know everyone can see it. Talking about cross-border SaaS transfers under KVKK feels similar.
You’re holding:
- a law that changed in 2024,
- a Regulation from mid-2024,
- Guidelines from 2025 with footnotes about standard contracts and BCRs,
- and this very modern truth: almost every real business in Türkiye uses foreign cloud tools somewhere.
The law is not saying “never use SaaS”. It’s saying:
“If you export people’s data with every API call, at least know what you’re doing, pick the right legal door, tell me about your contracts, and be ready if I say stop.”
That’s the tension: between speed and control, between global tools and national rules.
If you can live in that tension – not ignoring it, not panicking, just working it like a tight line of tickets on the pass – you can run a legal-compliant kitchen in the age of cloud everything.
Yanıt yok