Introduction
Cloud communication services under Turkish telecommunications law have become a critical issue for technology companies, telecom operators, SaaS providers, call center platforms, VoIP service providers, messaging applications, video conferencing platforms, SMS API providers, CPaaS companies, UCaaS providers, online meeting tools, cloud PBX providers and foreign digital platforms targeting users in Turkey.
The concept of “cloud communication” does not refer to a single legal category. It may include many different services such as cloud-based voice calls, VoIP, video meetings, instant messaging, SMS APIs, call center software, cloud PBX, SIP trunking, virtual numbers, customer support platforms, in-app chat, authentication messages, automated calls, conferencing tools, business messaging, WebRTC-based communication, AI call assistants and communication APIs integrated into mobile applications.
From a commercial perspective, these services are often marketed as software, SaaS, CPaaS or digital platform products. From a legal perspective, however, some of them may fall within the scope of Turkish electronic communications regulation. The key question is whether the service merely provides software functionality or whether it provides an electronic communications service, network, infrastructure, access, transmission, numbering, voice routing, SMS delivery or communication between users.
The main statute is Law No. 5809 on Electronic Communications. BTK states that Law No. 5809 covers regulation, authorization, inspection and reconciliation activities related to electronic communications services, devices and systems. BTK is the main authority regulating and supervising the telecommunications sector in Turkey.
Therefore, cloud communication companies should not assume that they are outside telecom regulation simply because their product is delivered through the cloud. The legal classification depends on the substance of the service, the technical architecture, the customer relationship, the use of numbers, the involvement of public telecom networks, the processing of communication data and the role of the provider in transmitting communications.
What Are Cloud Communication Services?
Cloud communication services allow individuals, businesses or platforms to communicate through internet-based and cloud-hosted infrastructure. These services may be offered directly to end users, embedded into applications or provided to enterprises as a technical layer.
Common examples include:
Cloud PBX systems.
VoIP services.
SIP trunking.
Video conferencing platforms.
Business messaging tools.
SMS API services.
Two-factor authentication messages.
Customer support call platforms.
Call center as a service.
Communications Platform as a Service.
Unified Communications as a Service.
WebRTC communication tools.
Virtual numbers.
Automated voice calls.
In-app messaging.
Online meeting and webinar tools.
AI-powered call routing.
Cloud recording and transcription.
Omnichannel customer communication platforms.
These services may involve different legal roles. A company that only provides software for internal business communication may face different obligations from a company that routes voice calls to the public telephone network. A platform that sends transactional SMS through authorized operators may face different obligations from a company that provides SMS services directly under its own brand. A video meeting platform that only enables app-to-app communication may be analyzed differently from a cloud PBX provider that assigns numbers, manages call routing and integrates with public telecom networks.
The most important legal step is to separate the software layer from the electronic communications layer.
Why Turkish Telecom Law Matters for Cloud Communication Providers
Cloud communication providers should care about Turkish telecom law because the boundary between software services and regulated communication services is increasingly blurred. A product may be sold as a SaaS tool, but if it transmits voice, messages or data between users, uses numbers, provides call routing, enables SMS delivery, operates communication infrastructure or resells connectivity, Turkish telecom law may become relevant.
BTK’s official authorization materials define authorization as registration of companies before BTK for providing electronic communications services or networks, or granting specific rights and obligations connected with such services. BTK also states that authorization aims to create competition, establish a secure sectoral environment, encourage domestic and foreign investment, ensure efficient use of resources, protect consumers and ensure service quality.
A cloud communication provider may therefore need to ask several questions before launching in Turkey:
Does the service provide voice, SMS, video or messaging between users?
Does the provider control transmission or routing?
Does the service connect with public telephone networks?
Does the provider assign numbers or virtual numbers?
Does it use Turkish numbering resources?
Does it provide SMS delivery through telecom networks?
Does it resell electronic communications services?
Does it act as an OTT communication provider?
Does it process communication metadata or traffic data?
Does it provide customer-facing communication services in Turkey?
If the answer to any of these questions is yes, a telecom licensing and compliance analysis should be conducted.
BTK Authorization Risk
The most important regulatory risk for cloud communication services is unauthorized electronic communications activity. BTK’s services subject to authorization page states that functions defined under Law No. 5809, including electronic communications, electronic communications infrastructure, infrastructure operation, electronic communications service and electronic communications network, may be carried out by obtaining authorization from BTK. It defines electronic communications broadly as the transmission, sending and reception of signs, symbols, sounds, images and data that can be converted into electrical signals through various transmission systems.
This broad definition may capture certain cloud communication services depending on their structure. For example, a cloud PBX provider that offers business calling services through public telecom networks may require a different analysis from a pure collaboration software provider. A CPaaS provider that enables SMS, voice or number-based communication may require review under electronic communications authorization rules. A VoIP provider offering calling to Turkish numbers or from Turkish users may require detailed regulatory classification.
The safest approach is not to ask whether the service is “cloud-based.” The correct question is whether the service provides electronic communications in legal terms.
CEVHER Application Process and Corporate Conditions
Where BTK authorization is required, applications are conducted through BTK’s CEVHER System. BTK’s CEVHER guidance states that initial authorization, additional authorization, authorization renewal, adequacy control and operator information update processes are carried out through this system.
The same guidance is important for cloud communication providers because it shows that authorization may require a properly structured Turkish company. BTK’s guidance refers to corporate form, articles of association, shareholder and management eligibility and paid-in capital requirements. Under BTK Board Decision dated 10 March 2026 and numbered 2026/DK-YED/71, paid-in capital is stated as TRY 2,500,000 for OKTH authorization and TRY 10,000,000 for other authorizations.
This creates a practical issue for foreign CPaaS, VoIP or cloud communication platforms. A foreign company may not be able to provide regulated services in Turkey merely through a website, app store distribution or remote cloud infrastructure if Turkish telecom authorization is required. A Turkish corporate structure, local application, CEVHER documentation and regulatory compliance program may be necessary depending on the service.
OTT Communication Services
Cloud communication services often overlap with OTT, or “over-the-top,” communication services. OTT services are generally provided over existing internet access without the service provider itself necessarily owning the underlying access network. Examples may include app-based calls, messaging, video calls and communication platforms.
Turkish law has increasingly addressed OTT services. Legal commentary on Law No. 5809 amendments notes that BTK was granted authority to regulate OTT services, take measures against unauthorized OTT service provision and, depending on the circumstances, require OTT providers to operate through authorized structures in Turkey. BTK’s own market analysis documents also refer to OTT services and unmanaged VoIP services as alternatives affecting traditional call markets.
For cloud communication providers, this means that app-based communication services, enterprise messaging applications, internet-based calling and video tools should not be treated automatically as unregulated software. The provider should examine whether the service is merely a closed app-to-app communication feature or whether it offers communication services in a way that may trigger BTK authority.
The legal analysis becomes more sensitive if the provider offers paid communication services, connects users with the public telephone network, uses numbers, provides business communication to Turkish enterprises, markets the service in Turkey or has a significant Turkish user base.
VoIP Services under Turkish Law
VoIP is one of the most common cloud communication models. VoIP allows voice communication over internet protocol rather than traditional circuit-switched telephone networks. In practice, VoIP services may range from internal business communication software to public telephone network replacement services.
The legal classification depends on the technical and commercial model. A closed enterprise voice tool used only within a company may be different from a VoIP provider offering Turkish numbers, outbound calling, inbound calling, SIP trunking or cloud PBX services connected to public networks.
A VoIP provider should review:
Whether the service connects to public switched telephone networks.
Whether Turkish numbers are used.
Whether users can call ordinary phone numbers.
Whether ordinary phone numbers can call users.
Whether the provider controls routing.
Whether the provider issues invoices for communication services.
Whether the service is bundled with call center or customer support products.
Whether traffic data or call detail records are processed.
Whether calls are recorded, transcribed or analyzed.
If the service is closer to a public voice communication service than a pure software product, BTK authorization, numbering, interconnection, consumer and data protection issues may arise.
SMS API and Business Messaging Services
SMS API services are widely used for authentication, marketing, order updates, banking notifications, delivery alerts, appointment reminders and customer communication. A company may use an SMS API provider to send messages through one or more telecom operators.
The legal analysis depends on the provider’s role. If the provider is merely a software interface connecting business customers to authorized telecom operators, its role may be different from a provider selling electronic communications services under its own responsibility. If it routes SMS traffic, contracts directly with customers, controls sender IDs, manages message delivery, processes message content or provides commercial electronic communication services, additional legal issues arise.
Business messaging also intersects with electronic commerce and marketing consent rules. Transactional messages, authentication codes and service notifications should be distinguished from promotional messages. A company should not use SMS verification or service messages to obtain bundled marketing consent or to send advertisements without a valid legal basis.
SMS API contracts should define:
Whether the provider is a telecom operator, intermediary or software provider.
Which authorized operators transmit messages.
Who is responsible for consent.
Who manages opt-out requests.
Who stores message logs.
Who responds to official requests.
Who is liable for unlawful marketing.
Who handles delivery failures.
Who ensures sender ID compliance.
This is especially important for banks, fintech companies, e-commerce platforms, healthcare providers and foreign platforms sending SMS to Turkish users.
Cloud PBX and Call Center as a Service
Cloud PBX and Call Center as a Service products allow businesses to manage inbound calls, outbound calls, extensions, IVR, call queues, call recording, agent management, analytics and customer communication through cloud infrastructure. These products may be pure software, but they often involve regulated communication elements.
The legal risk increases where the provider offers telephone numbers, call routing, SIP trunks, outbound calling, customer-facing voice communication, call recording and integration with public telecom networks. In such cases, the provider must examine whether it needs BTK authorization or whether the communication layer is provided by an authorized telecom operator.
Call center platforms must also consider privacy and recording rules. Call recordings may contain personal data, customer complaints, financial information, health information, identity data and sensitive business details. If AI transcription or sentiment analysis is used, data processing becomes even more complex.
A cloud call center contract should clearly define:
Who provides the telecom line.
Who is the authorized operator.
Who records calls.
Who stores recordings.
Who controls customer data.
Who handles consent or notification.
Who manages cross-border access.
Who responds to law enforcement requests.
Who is liable for outages.
Who owns call logs and analytics.
Video Conferencing and Online Meeting Platforms
Video conferencing platforms may appear less likely to trigger telecom licensing than voice services connected to telephone networks. However, they still involve communication between users, personal data processing, recording, screen sharing, chat, metadata, cloud storage and sometimes telephone dial-in features.
A video meeting service used only as software may not automatically require telecom authorization. However, dial-in numbers, PSTN integration, paid calling features, enterprise communication bundles and Turkish customer targeting may change the legal analysis.
Video conferencing also creates KVKK risks. Meeting recordings, participant names, e-mail addresses, IP addresses, device information, chat content, voice, image, background details and screen-shared documents may all involve personal data. If meetings are recorded, participants should be informed properly. If recordings are stored abroad, cross-border transfer rules may apply.
Enterprise users should review the platform’s data processing terms, recording settings, administrator access, retention policies, security features and foreign data access.
Law No. 5651 and Hosting/Access Provider Issues
Cloud communication services may also fall under Law No. 5651 depending on their structure. Law No. 5651 regulates the obligations and responsibilities of content providers, hosting providers, access providers and public internet use providers. Official legal sources identify Law No. 5651 as the statute governing internet publications and related actors.
A cloud communication provider may act as a hosting provider if it stores user-generated content, call recordings, chat histories, shared files, voicemails, meeting recordings, customer support tickets or message archives. Legal translations of Law No. 5651 state that hosting providers must retain traffic information for the services they provide for a period not less than one year and not more than two years, as determined by regulation, and ensure the accuracy, integrity and confidentiality of such information.
Law No. 5651 also matters where a cloud communication platform hosts unlawful content, receives takedown requests, stores traffic logs or provides public internet access components. The provider should determine whether it is a content provider, hosting provider, access provider, or merely a software processor.
A platform that stores meeting recordings, chat files or shared media should not ignore hosting and content-related issues. It should have complaint-handling, evidence-preservation and lawful request procedures.
Personal Data Protection and KVKK Compliance
Cloud communication services process large volumes of personal data. This may include names, e-mail addresses, phone numbers, IP addresses, device identifiers, call detail records, message metadata, chat content, voice recordings, video images, meeting files, customer support tickets, authentication logs, payment data and location-related information.
KVKK defines personal data broadly as any information relating to an identified or identifiable natural person. KVKK also requires personal data to be processed lawfully and fairly, accurately, for specified and legitimate purposes, in a relevant and proportionate manner, and only for the period required by law or by the processing purpose.
For cloud communication providers, KVKK compliance should include:
Clear privacy notices.
Data processing inventory.
Data controller and processor role analysis.
Consent mechanisms where required.
Call recording notices.
Data retention policies.
Deletion and anonymization procedures.
Data subject request procedures.
Security controls.
Vendor contracts.
Cross-border transfer review.
Breach notification procedures.
Special attention is needed where the provider records calls, transcribes meetings, analyzes voice, uses AI tools, monitors agent performance or stores message content. These activities may go beyond ordinary communication delivery and create additional privacy obligations.
Data Controller and Data Processor Roles
Cloud communication services often create complex controller-processor relationships. In a business call center platform, the enterprise customer may determine why calls are recorded and how customer data is used, while the cloud provider processes the data on behalf of that customer. In that case, the provider may act as a data processor for certain activities.
However, the same provider may also act as a data controller for its own purposes, such as billing, account management, fraud prevention, service analytics, security logs, product improvement, marketing and legal compliance. Therefore, a single provider may be both controller and processor depending on the processing activity.
Contracts should specify:
Processing purposes.
Categories of personal data.
Data subject categories.
Customer instructions.
Provider responsibilities.
Subprocessor use.
Security measures.
Breach notification periods.
Return and deletion of data.
Cross-border transfer mechanisms.
Audit rights.
Assistance with data subject requests.
Without clear contractual allocation, disputes may arise after a data breach, official request, customer complaint or termination.
Cross-Border Data Transfers
Cross-border transfer is one of the most important issues for cloud communication services. Many CPaaS, UCaaS and video platforms use global cloud infrastructure. User data may be stored in foreign data centers, accessed by global support teams, processed by foreign AI tools, routed through international servers or replicated for backup and security purposes.
KVKK’s cross-border transfer framework changed significantly after the 2024 amendments. The Personal Data Protection Authority announced English translations of the by-law on procedures and principles for transfers abroad and standard contract texts in 2024.
Cloud communication providers should therefore review whether Turkish user data is transferred abroad, accessed from abroad or stored in foreign systems. This includes:
Call recordings.
Meeting recordings.
Chat histories.
Voice transcripts.
SMS logs.
Authentication records.
Customer support tickets.
Account data.
Security logs.
Analytics data.
AI training or processing data.
A provider should not promise “data stays in Turkey” unless support, backup, monitoring, analytics and administrator access also support that statement. Cross-border access may still be a transfer risk even where primary storage is local.
Data Breach and Security Obligations
Cloud communication platforms are attractive targets for cyberattacks because they store communication content and metadata. A breach may expose call recordings, meeting files, customer lists, SMS logs, authentication codes, business secrets, personal conversations and support tickets.
KVKK guidance states that data controllers must take all necessary technical and organizational measures to ensure an appropriate level of security, prevent unlawful processing, prevent unlawful access and safeguard personal data. It also states that if personal data is obtained by others unlawfully, the controller must notify the data subject and the Personal Data Protection Board within the shortest time; the Board has interpreted this period as not later than 72 hours after becoming aware of the breach.
Cloud communication providers should implement:
Encryption.
Multi-factor authentication.
Role-based access controls.
Secure APIs.
Logging and monitoring.
DDoS protection.
Penetration testing.
Vulnerability management.
Backup and recovery.
Incident response plans.
Subprocessor security review.
Customer-controlled retention settings.
Administrator activity logs.
Data breaches may also trigger contractual notice duties, BTK scrutiny where the provider is an operator, consumer complaints and reputational damage.
Network and Information Security
If a cloud communication provider is authorized as an electronic communications operator or otherwise falls within BTK network and information security rules, sector-specific cybersecurity obligations may apply. BTK states that Law No. 5809, authorization regulations and operator agreements include obligations on network and information security, and that the Regulation on Network and Information Security in the Electronic Communications Sector sets out procedures and principles operators must follow.
This is relevant for cloud communication providers offering voice, messaging, internet-based communication, virtual network services or telecom-integrated products. Cybersecurity is not merely an IT issue; it may be a regulatory compliance issue.
Providers should maintain audit-ready documentation, including security policies, incident response procedures, network diagrams, access logs, customer notification workflows, vendor reviews and internal training records.
Consumer Protection and Subscription Rules
Cloud communication services may be offered to consumers, small businesses or enterprise customers. Where consumers are involved, Turkish consumer law and electronic communications consumer rules may apply.
Consumer risks include unclear pricing, automatic renewals, hidden fees, poor service quality, failure to cancel subscriptions, misleading “free trial” offers, unclear recording features, unauthorized charges, lack of customer support and unfair limitation of liability.
BTK consumer materials emphasize consumer protection, transparency, subscription agreements, personal data processing, privacy and service quality within the electronic communications framework.
Cloud communication providers should prepare clear terms on:
Subscription fees.
Usage-based charges.
International call fees.
SMS fees.
Number rental fees.
Recording storage fees.
Cancellation.
Refunds.
Service limitations.
Data retention.
Support response times.
Where the service is enterprise-only, consumer rules may not apply directly, but unfair contract terms, commercial law, data protection and telecom compliance still matter.
Commercial Electronic Communication and Marketing Messages
Cloud communication providers frequently support marketing messages, SMS campaigns, e-mail campaigns, automated calls and push notifications. This creates legal risk because Turkish law distinguishes between service communications and commercial electronic communications.
Providers should require customers to confirm that they have valid consent or another lawful basis for marketing messages. They should offer opt-out tools, suppression lists, sender ID controls, audit logs and abuse prevention measures.
A provider that knowingly supports unlawful bulk messaging, spam, phishing, fraudulent SMS or unauthorized marketing may face contractual, regulatory and reputational risk. SMS API providers should build compliance controls into their platform rather than treating customer misuse as purely the customer’s problem.
Official Requests and Lawful Access Procedures
Cloud communication providers may receive requests from courts, prosecutors, law enforcement authorities, BTK, KVKK or other public authorities. Requests may concern subscriber identity, IP logs, call records, message logs, recordings or content.
Providers should have a formal official request procedure. Employees should not disclose user data through informal e-mails, phone calls or unsupported requests. The procedure should verify:
Requesting authority.
Legal basis.
Scope of request.
Target identifier.
Date range.
Type of data requested.
Confidentiality requirements.
Preservation obligations.
Response deadline.
Internal approval.
All disclosures should be logged. Where the provider is a processor for an enterprise customer, the contract should explain how official requests will be handled and when the customer will be notified.
AI Features in Cloud Communication Services
Many cloud communication platforms now include AI features such as automatic transcription, call summarization, sentiment analysis, keyword detection, chatbot support, voice analytics, meeting summaries, speaker identification and quality scoring.
These features create additional legal risks. AI tools may process voice, text, customer complaints, personal opinions, business secrets and sensitive information. If AI processing occurs outside Turkey or through third-party providers, cross-border transfer and subprocessor issues arise. If AI-generated summaries are inaccurate, they may create business disputes or employment-related problems.
Providers should explain AI features clearly, allow customers to control them, identify subprocessors, define retention periods, avoid using customer content for model training without a valid legal basis and maintain security safeguards.
Contracts for Cloud Communication Services
Contracts are essential for legal risk management. A cloud communication contract should not be a generic SaaS agreement if the service includes voice, SMS, numbers, call recordings, communication metadata or telecom integrations.
Key contract clauses include:
Service scope.
Regulatory status.
Authorized operator involvement.
Numbering responsibility.
SMS delivery responsibility.
Call routing responsibility.
Data controller and processor roles.
Subprocessor list.
Cross-border transfers.
Security measures.
Breach notification.
Retention settings.
Recording responsibility.
Official request handling.
Acceptable use policy.
Anti-spam rules.
Service levels.
Downtime remedies.
Liability limits.
Termination and data export.
Regulatory change clause.
For enterprise customers, service level commitments should be realistic and measurable. For regulated customers such as banks, fintech companies, healthcare providers and telecom operators, additional audit, localization and incident notification clauses may be required.
Foreign Cloud Communication Providers Targeting Turkey
Foreign CPaaS, UCaaS, VoIP and video platforms often provide services globally. If they target Turkish users, provide Turkish-language services, sell to Turkish companies, use Turkish numbers, send SMS to Turkish subscribers, process Turkish user data or integrate with Turkish telecom networks, Turkish law may become relevant.
A foreign provider should review:
Whether BTK authorization is required.
Whether OTT rules apply.
Whether a Turkish company or representative is necessary.
Whether Turkish numbers are used.
Whether local operators are involved.
Whether Law No. 5651 applies.
Whether KVKK applies.
Whether data is transferred abroad.
Whether Turkish consumer law applies.
Whether contracts need Turkish-law clauses.
Whether official request procedures are ready.
Compliance with EU or US law does not automatically satisfy Turkish telecom, internet and data protection requirements.
Practical Compliance Checklist
A cloud communication provider operating in or targeting Turkey should follow this checklist:
Classify the service legally and technically.
Identify whether the service is pure software or electronic communications.
Review BTK authorization requirements.
Assess OTT communication service status.
Check whether numbers, SMS, voice routing or public telecom network integration is involved.
Review CEVHER and local company requirements if authorization is needed.
Determine whether Law No. 5651 applies.
Classify hosting, content and access provider roles.
Prepare KVKK privacy notices and data inventory.
Define controller and processor roles.
Review cross-border data transfers.
Prepare standard contracts or safeguards where required.
Implement call recording notices and settings.
Prepare data breach response procedures.
Secure APIs and administrator accounts.
Create official request handling procedures.
Review SMS marketing compliance.
Prepare acceptable use and anti-abuse policies.
Draft telecom-specific customer contracts.
Maintain audit-ready compliance files.
Monitor BTK and KVKK developments.
Conclusion
Cloud communication services under Turkish telecommunications law require careful classification. A cloud-based product is not automatically outside telecom regulation. CPaaS, UCaaS, VoIP, SMS APIs, cloud PBX, video conferencing, call center platforms and business messaging tools may trigger different legal obligations depending on how they are structured.
The main question is whether the provider merely supplies software or whether it provides electronic communications services, voice routing, messaging transmission, numbering, telecom network access or communication infrastructure. If electronic communications activity is involved, Law No. 5809 and BTK authorization rules must be reviewed. If the provider stores content, logs or user data, Law No. 5651 may also apply. If personal data is processed, KVKK compliance is essential. If communications are recorded, transcribed or analyzed through AI, privacy and data security risks increase.
For foreign providers, the Turkish market should be approached with local legal analysis. Operating from abroad does not eliminate Turkish law risk where Turkish users, Turkish customers, Turkish numbers, Turkish telecom networks or Turkish personal data are involved.
A strong compliance strategy should combine telecom classification, BTK authorization review, data protection documentation, cybersecurity controls, Law No. 5651 analysis, consumer protection, marketing compliance and contract drafting. Companies that address these issues before launch will reduce regulatory risk, protect users and operate more sustainably in Turkey’s digital communications market.
Frequently Asked Questions
Are cloud communication services regulated in Turkey?
They may be regulated depending on the service model. Pure software tools may not require telecom authorization, but services involving voice, SMS, numbers, public telecom network integration, electronic communications transmission or regulated infrastructure should be reviewed under Law No. 5809.
What is the main telecommunications law in Turkey?
The main law is Law No. 5809 on Electronic Communications. BTK states that this law covers regulation, authorization, inspection and reconciliation activities related to electronic communications services, devices and systems.
What is BTK authorization?
BTK authorization is the regulatory registration or permission framework for companies providing electronic communications services or networks. BTK describes authorization as a mechanism intended to ensure competition, investment, efficient resource use, consumer protection and service quality.
Do VoIP services need authorization in Turkey?
VoIP services require legal classification. A closed software tool may be treated differently from a service that offers public calling, Turkish numbers, call routing, SIP trunking or cloud PBX services. BTK authorization may be relevant depending on the model.
Are SMS API providers subject to telecom rules?
They may be, depending on whether they only provide software access to authorized operators or directly provide electronic communications services. SMS APIs also raise marketing consent, data protection, sender ID, anti-spam and message log issues.
Does Law No. 5651 apply to cloud communication platforms?
It may apply if the platform acts as a hosting provider, content provider, access provider or other internet actor. Hosting providers may be required to retain traffic information and protect its accuracy, integrity and confidentiality.
Does KVKK apply to cloud communication services?
Yes. Cloud communication services often process personal data such as names, phone numbers, IP addresses, device identifiers, call logs, messages, recordings, meeting files and customer support records. KVKK processing principles and security obligations apply.
Can cloud communication data be stored abroad?
Cross-border storage or access must comply with KVKK transfer rules. The 2024 transfer framework and standard contract mechanisms should be reviewed before Turkish user data is stored or accessed abroad.
What is the biggest legal risk for cloud communication providers in Turkey?
The biggest risk is misclassification. A provider may describe itself as a SaaS platform while Turkish law may classify parts of the service as electronic communications, OTT communication, hosting, access provision or personal data processing.
What should companies do before launching cloud communication services in Turkey?
They should review BTK authorization, OTT status, Law No. 5651 obligations, KVKK compliance, cross-border data transfers, cybersecurity, call recording, SMS marketing rules, consumer terms and customer contracts before launch.
No Responses