Introduction
Data center regulations and telecom law compliance in Turkey are becoming increasingly important as businesses move their operations to cloud platforms, colocation facilities, edge computing systems, hosting services, disaster recovery sites, content delivery networks, cybersecurity infrastructure and telecom network facilities. Data centers are no longer only technical buildings where servers are stored. They are now critical infrastructure for digital banking, e-commerce, telecommunications, public services, healthcare, fintech, artificial intelligence, online gaming, media platforms, SaaS products, IoT systems, mobile applications and corporate data processing.
From a legal perspective, a data center in Turkey may be subject to several different regulatory regimes at the same time. These may include telecommunications law, internet law, personal data protection law, cybersecurity rules, energy and facility contracts, construction and zoning requirements, fire safety standards, environmental permits, commercial lease law, service level agreements, tax rules and foreign investment regulations.
The most important point is that Turkey does not regulate every data center through a single standalone “data center license.” Instead, the legal obligations depend on the actual business model. A data center that only provides physical colocation may face different obligations from a company that provides internet access, electronic communications infrastructure, hosting services, cloud platforms, CDN services, managed security, telecom interconnection, data transmission or public internet access.
The main telecom authority is the Information and Communication Technologies Authority, known as BTK. BTK states that Law No. 5809 on Electronic Communications covers regulation, authorization, inspection and reconciliation activities related to electronic communications services, devices and systems. Therefore, a data center operator must carefully determine whether its activities remain purely technical and commercial, or whether they cross into regulated electronic communications services, networks or infrastructure.
Why Data Center Compliance Matters in Turkey
Data center compliance matters because a data center may sit at the intersection of telecom infrastructure, hosting, cloud computing, personal data processing, cybersecurity and critical business continuity. A single data center can host hundreds of websites, enterprise databases, customer portals, payment systems, mobile application backends, telecom switching equipment, content delivery nodes, IoT platforms and disaster recovery systems.
If a data center suffers a cyberattack, power failure, cooling failure, unauthorized access incident, customer data leak or regulatory breach, the consequences may be severe. Customers may face business interruption, data loss, regulatory investigations, consumer claims and financial losses. The data center operator may face contractual liability, KVKK-related exposure, BTK scrutiny, Law No. 5651 obligations, reputational harm and commercial disputes.
For foreign investors, data center compliance is also a due diligence issue. A data center acquisition or lease in Turkey should not be reviewed only from a real estate or corporate perspective. The buyer or tenant should examine telecom authorization, hosting status, personal data roles, cybersecurity controls, service level commitments, energy redundancy, insurance, customer contracts, subcontractor arrangements, cross-border data transfers and regulatory correspondence.
Data Center or Telecom Operator? The Key Legal Classification
The first legal question is whether the data center operator is merely providing space, power, cooling and physical security, or whether it is also providing electronic communications services, networks or infrastructure.
BTK’s official guidance states that functions defined under Law No. 5809 may be carried out by obtaining authorization from the Authority. These include electronic communications, electronic communications infrastructure, operation of electronic communications infrastructure, electronic communications service and electronic communications network. BTK defines electronic communications broadly as the transmission, sending and reception of signs, symbols, sound, images and data through transmission systems, and defines electronic communications infrastructure to include network elements, hardware, software, terminals, lines and related facilities through which electronic communications are carried out.
This broad framework is important for data centers. A data center that only rents racks, cages or private suites may not automatically become a telecom operator. However, if the data center provides connectivity, operates transmission systems, offers internet access, manages network infrastructure, sells IP transit, provides dark fiber, operates switching equipment, offers interconnection services or makes electronic communications infrastructure available to third parties, BTK authorization analysis becomes necessary.
The legal classification must be based on actual activity, not marketing language. A company may call itself a “cloud infrastructure provider,” “managed hosting company,” “carrier-neutral data center,” “edge computing platform,” “colocation provider” or “connectivity hub.” These descriptions do not decide the legal status. The real question is what the company provides to customers.
BTK Authorization and Data Center Services
BTK defines authorization as the registration of companies with the Authority for providing electronic communications services and/or networks, or the granting of specific rights and obligations peculiar to electronic communications services after registration. BTK also states that authorization aims to increase competition, establish a secure environment, encourage domestic and foreign investment, ensure efficient use of national resources, provide quality services and protect consumers.
A data center may need BTK authorization if it provides regulated electronic communications services. Examples may include internet service provision, data transmission services, infrastructure operation, wholesale connectivity, fiber network operation, satellite connectivity services, virtual mobile network-related infrastructure, or other electronic communications services.
A data center that connects customers to multiple telecom operators may not necessarily need authorization merely because it allows cross-connects. However, if it itself sells connectivity or operates electronic communications infrastructure for customers, the risk changes. Carrier-neutral facilities should therefore distinguish between passive colocation and active telecom service provision.
BTK authorization also has corporate requirements. BTK’s CEVHER guidance states that applicants must meet conditions concerning shareholder and management eligibility, paid-in capital and application documentation. The same guidance states that paid-in capital must be TRY 2,500,000 for OKTH authorization and TRY 10,000,000 for other authorizations under BTK Board Decision dated 10 March 2026 and numbered 2026/DK-YED/71.
For data center businesses, this means that adding telecom connectivity services to the business model may create significant regulatory and capital consequences.
Colocation Services and Legal Risks
Colocation is one of the most common data center services. In a colocation model, customers place their own servers or network equipment in the data center and receive power, cooling, physical security, rack space and connectivity options.
Colocation usually creates contractual, operational and data protection questions. The data center operator may not control the customer’s data or applications, but it may control access to the physical environment. It may also provide remote hands services, physical installation, cabling, equipment replacement, monitoring or managed security services. These services may create legal responsibility if performed negligently.
Colocation contracts should clearly define:
The space or rack provided.
Power capacity and redundancy.
Cooling standards.
Access control.
Remote hands services.
Customer equipment responsibility.
Cross-connect procedures.
Maintenance windows.
Service level commitments.
Liability for outage.
Physical security obligations.
Insurance.
Termination and equipment removal.
Regulatory cooperation.
Data protection roles.
A weak colocation contract may create serious disputes after a power failure, overheating incident, unauthorized access, equipment damage, customer default or emergency shutdown.
Hosting Provider Obligations under Law No. 5651
Data centers may also be relevant under Law No. 5651 if they provide hosting services. A physical colocation provider may not always be the legal hosting provider for customer content, especially if the customer independently controls the servers and content. However, a data center or cloud company that provides web hosting, managed hosting, virtual servers, cloud servers, platform hosting or content hosting may fall within hosting provider obligations.
Law No. 5651 is the central Turkish internet law regulating content providers, hosting providers, access providers and public internet use providers. BTK’s public pages also include a “Hosting Notification” access point, showing that hosting provider status is treated as a specific internet compliance category.
Legal translations of Law No. 5651 state that hosting providers must keep traffic information relating to the services they provide for a period not less than one year and not more than two years, as determined by regulation, and must ensure the accuracy, integrity and privacy of such information.
Hosting providers are generally not required to proactively monitor all hosted content. However, they must take action when legally notified under the relevant legal procedures. This distinction matters for data center and cloud companies. A provider should not conduct arbitrary surveillance of customer content, but it must have a lawful notice-handling and content-removal process.
Access Provider Risk for Data Centers
Some data centers may also be classified as access providers if they provide users or customers with internet access. This may occur in public internet access facilities, managed connectivity environments, Wi-Fi-based facilities, ISP-integrated data centers or enterprise network services.
Access provider status brings additional legal obligations. These may include access-blocking compliance, traffic data retention, cooperation with competent authorities and technical implementation procedures. If the data center only hosts equipment and all connectivity is provided directly by licensed telecom operators, the access provider analysis may be different. However, if the data center itself provides internet access or network access, Law No. 5651 and BTK rules must be reviewed.
Data center operators should clearly allocate access-provider responsibilities in contracts with telecom carriers, customers and managed network service providers. If responsibility is unclear, disputes may arise when an official request, access-blocking order, cyber incident or traffic data demand is received.
Personal Data Protection and KVKK Compliance
Data centers frequently process or host personal data. Even where the data center operator does not directly determine the purposes of processing, it may act as a data processor on behalf of customers. In some cases, it may act as a data controller for its own processing activities, such as employee records, visitor logs, CCTV footage, access card records, customer contact data, support tickets, invoices, security logs and incident reports.
KVKK imposes important obligations on data controllers and data processors. Article 12 of KVKK requires the data controller to take all necessary technical and organizational measures to provide an appropriate level of security, prevent unlawful processing, prevent unlawful access and ensure the protection of personal data. The law also states that if personal data processing is carried out by another natural or legal person on behalf of the controller, the controller is jointly responsible with that person for taking security measures.
KVKK guidance also emphasizes that data controllers and processors must not disclose personal data contrary to law or use it for purposes other than the original processing purpose, and that this obligation continues even after the end of office or employment.
For data centers, this means that access control, visitor management, CCTV, biometric access systems, support access, remote hands services, customer portals, backup systems and log management should all be designed with KVKK in mind.
Data Center as Data Processor
In many cloud and hosting models, the data center acts as a data processor. The customer determines the purposes and means of processing, while the data center stores, secures or processes data on behalf of the customer.
This processor role must be regulated contractually. The contract should specify:
Processing subject matter.
Duration of processing.
Categories of data.
Customer instructions.
Confidentiality obligations.
Technical and organizational measures.
Subprocessor use.
Audit rights.
Breach notification.
Data return and deletion.
International transfer rules.
Assistance with data subject requests.
Security incident cooperation.
If the customer is subject to strict sectoral regulation, such as banking, fintech, healthcare, insurance, telecom or public-sector rules, the data center contract may need additional provisions. For example, disaster recovery, audit access, data localization, incident notification and regulator access clauses may become essential.
Data Breach Notification and Incident Response
A data center must be prepared for security incidents. Data breaches may involve unauthorized access to customer servers, ransomware, compromised credentials, exposed backups, misconfigured cloud storage, stolen disks, unauthorized physical access, insider threats, network intrusion, DDoS attacks or data exfiltration.
KVKK guidance states that if processed personal data is obtained by others unlawfully, the controller must notify the data subject and the Personal Data Protection Board within the shortest time. The Board has interpreted this period as no later than 72 hours after becoming aware of the breach.
The Board’s breach notification decision also states that controllers should document breaches, including facts, effects and measures taken, and that if personal data held by a data processor is obtained unlawfully, the processor must notify the controller without delay. It also states that if a breach by a foreign controller affects data subjects residing in Türkiye and those data subjects benefit from products and services provided in Türkiye, the Board must be notified under the same principles.
For data centers, this requires a clear incident response plan. The plan should identify who detects incidents, who classifies them, who informs customers, who preserves evidence, who contacts regulators, who manages public communication and who verifies remediation.
Cybersecurity Obligations
Cybersecurity is central to data center regulation. Even if a data center is not directly licensed as a telecom operator, it may host critical systems and must maintain robust technical and organizational security. If the data center is also an authorized electronic communications operator, BTK network and information security rules may apply more directly.
BTK states that under the Network and Information Security Regulation in the electronic communications sector, operators are required to take measures against cyberattacks, establish Corporate CSIRT structures where applicable, coordinate with the Sectoral CSIRT and USOM, and take measures against DoS/DDoS attacks, malware propagation and similar cyberattacks.
Data centers should implement:
Physical security zones.
Multi-factor access control.
Visitor logging.
CCTV monitoring.
Network segmentation.
DDoS mitigation.
Firewalls and intrusion detection.
Secure remote access.
Patch management.
Backup and recovery procedures.
Encryption.
Asset management.
Vulnerability scanning.
Incident response playbooks.
Privileged access management.
Employee background controls.
Supplier security review.
Cybersecurity must be treated as a legal and contractual obligation, not merely an IT preference.
Cross-Border Data Transfers and Cloud Infrastructure
Data centers are often part of international cloud structures. A Turkish customer may use a Turkish data center, but support, monitoring, billing, backup, disaster recovery, security analytics or group-level administration may be performed abroad. Likewise, a foreign cloud company may offer services to Turkish customers without physically storing all data in Turkey.
KVKK Article 9 on cross-border transfers was amended by Law No. 7499, and the Personal Data Protection Authority announced English translations of the by-law on procedures and principles for personal data transfers abroad and standard contract texts in 2024.
This is highly relevant for data centers and cloud providers. Cross-border access may qualify as a transfer. Remote support from foreign personnel, backup to foreign regions, centralized monitoring, global ticketing systems, foreign security tools and parent-company access should all be reviewed.
Data center providers should not promise “data is kept in Turkey” unless the entire technical and operational structure supports that promise. If foreign access is possible, the contract and privacy documentation should accurately reflect it.
Data Localization Issues
Data localization is a sensitive topic in Turkey. There is no universal rule requiring all private-sector data to be stored only in Turkey. However, specific sectors, contracts, public procurement requirements, regulatory decisions or customer obligations may require Turkish storage, Turkish support or Turkish-controlled infrastructure.
Telecom-related data localization may arise in specific contexts. For example, legal commentary on BTK’s eSIM-related decisions states that certain eSIM structures, servers, software and equipment must be established by authorized operators or by third parties on their behalf and kept within Turkish borders, with data also kept within Turkey. This example shows that localization analysis must be service-specific.
Data centers should therefore avoid general statements. The correct question is not “Does Turkish law require all data to stay in Turkey?” The correct question is “Does this customer, sector, service, contract or regulatory regime require localization?”
Facility Sharing and Telecom Infrastructure
Some data centers operate as telecom connectivity hubs. They may host carrier points of presence, fiber routes, interconnection equipment, exchange points, CDN nodes and network aggregation facilities. In such cases, facility sharing and passive infrastructure access rules may become relevant.
BTK explains that facility sharing means providing other operators with access, for a fee, to passive infrastructure such as pipes, ducts and poles owned by electronic communications network operators. BTK also emphasizes that sharing existing facilities is important for efficient use of resources and avoiding duplicate investments in next-generation broadband networks.
Data centers involved in fiber access, interconnection or network infrastructure should review how facility sharing, cross-connects, meet-me rooms, dark fiber, duct access and backhaul arrangements are structured. Contracts should clearly define ownership, access rights, maintenance responsibility, outage procedures and regulatory cooperation.
Technical Standards and Equipment Compliance
Data centers rely on routers, switches, servers, antennas, optical equipment, fire suppression systems, UPS systems, generators, cooling systems, network devices and sometimes radio equipment. Where telecom or radio equipment is placed on the market or used in electronic communications services, technical conformity rules may apply.
BTK states that within the scope of Law No. 5809, harmonized European standards and related national standards are updated and published in line with EU standards for electronic communications networks, services and related facilities.
Data center operators should therefore check whether imported or supplied telecom equipment, network devices, wireless systems or radio equipment require conformity documentation. Non-compliant equipment may create market surveillance, safety, interference and contractual risks.
Contracts for Data Center Services
Data center contracts are one of the most important legal tools for risk management. A well-drafted contract should match the technical service model. A colocation contract is different from a managed hosting contract. A cloud services agreement is different from a connectivity agreement. A disaster recovery contract is different from a carrier-neutral meet-me-room agreement.
Key clauses include:
Service description.
Space, rack or cage allocation.
Power capacity.
Cooling requirements.
Redundancy level.
Access procedures.
Remote hands scope.
Maintenance windows.
Service levels.
Uptime commitments.
Credits and liability.
Customer equipment rules.
Network connectivity.
Cross-connects.
Security obligations.
Data protection roles.
Subcontractors.
Incident notification.
Force majeure.
Regulatory cooperation.
Termination.
Exit and data deletion.
Insurance.
A common mistake is using a generic IT services contract for a regulated data center environment. This may leave important issues unresolved, especially in outages, breaches, official requests and customer migration.
Service Level Agreements and Liability
Service Level Agreements are critical in data center contracts. Customers often depend on the data center for business continuity. A financial institution, e-commerce platform or telecom provider may suffer significant losses if the data center fails.
However, data center operators usually seek to limit liability. They may offer service credits rather than full compensation. Whether such limitations are enforceable depends on the contract, customer type, fault level and applicable mandatory rules.
The SLA should define:
Uptime percentage.
Measurement method.
Excluded events.
Scheduled maintenance.
Power availability.
Cooling availability.
Network availability.
Response times.
Remedy periods.
Service credits.
Maximum liability.
Evidence requirements.
A vague SLA may create disputes. For example, if “99.99% uptime” is promised without defining whether it refers to power, cooling, connectivity, customer portal or full service availability, litigation risk increases.
Customer Due Diligence and Sector-Specific Clients
Data center customers may operate in regulated sectors such as banking, payment services, insurance, healthcare, telecom, public procurement, e-commerce or critical infrastructure. These customers may require special contractual protections, audit rights, data localization, incident notification and security certifications.
Before accepting such customers, a data center should understand whether the customer’s regulatory obligations will impose additional duties on the facility. For example, a fintech or telecom customer may require more detailed logs, audit cooperation, redundancy, disaster recovery testing and regulator access.
Customer due diligence is also important for unlawful content, cybercrime and abuse prevention. Hosting providers and data centers may be exposed to abuse if customers host phishing pages, malware, illegal betting sites, counterfeit goods, spam infrastructure or unlawful content. Providers should have acceptable use policies and abuse response procedures.
Foreign Investors and Data Center Projects in Turkey
Foreign investors may enter Turkey’s data center market through greenfield development, acquisition, lease, joint venture, cloud region partnerships, telecom infrastructure projects or managed hosting businesses. Turkey’s strategic location, growing digital economy, young population, e-commerce growth and connectivity demand make the sector attractive.
However, foreign investors should review:
Land and zoning.
Construction permits.
Energy supply.
Grid connection.
Generator permits.
Environmental issues.
Telecom authorization.
Hosting provider obligations.
KVKK compliance.
Cross-border transfers.
Customer contracts.
Cybersecurity systems.
Insurance.
Tax structure.
Employment.
Subcontractors.
Regulatory due diligence should be completed before acquisition or investment. A data center may look commercially attractive but carry hidden risks such as missing hosting notifications, unclear BTK status, weak KVKK contracts, poor breach procedures, unresolved outages, insufficient redundancy, customer disputes or unlawful cross-border access.
Administrative Sanctions and Enforcement Risk
If a data center operates within the electronic communications framework, BTK audit and sanction powers may become relevant. BTK states that operators are monitored under Law No. 5809 for compliance with license conditions, equipment standards, sector legislation and spectrum use, and that sanctions may be imposed on operators that fail to comply. BTK also notes that supervision may be financial, technical, legal and administrative.
Data centers may also face consequences under KVKK if personal data is not protected adequately, under Law No. 5651 if hosting or access provider obligations are breached, and under contract law if service commitments are not met.
Common enforcement risks include:
Unauthorized telecom service provision.
Failure to comply with BTK authorization conditions.
Failure to secure personal data.
Failure to notify data breaches.
Unlawful cross-border data transfers.
Failure to retain required traffic data.
Failure to implement lawful content or access procedures.
Misleading localization claims.
Weak physical security.
Unclear customer data roles.
Non-compliant equipment.
Inadequate incident response.
Practical Compliance Checklist for Data Centers in Turkey
A data center operating in Turkey should follow this checklist:
Classify the service model.
Determine whether the facility provides only colocation or also telecom services.
Check whether BTK authorization is required.
Review hosting provider status under Law No. 5651.
Determine whether access provider obligations apply.
Prepare hosting notification and traffic data procedures where required.
Map personal data processing activities.
Define data controller and data processor roles.
Prepare KVKK-compliant contracts.
Review cross-border transfers.
Implement physical and cyber security controls.
Prepare data breach response procedures.
Document access logs and visitor records.
Review customer contracts and SLAs.
Clarify localization commitments.
Review telecom equipment conformity.
Prepare abuse response and takedown procedures.
Check insurance coverage.
Maintain regulatory correspondence records.
Train technical, legal, security and customer support teams.
Conduct periodic audits.
Conclusion
Data center regulations and telecom law compliance in Turkey require a multi-layered legal analysis. There is no single universal data center license that applies to all data center activities. Instead, the legal obligations depend on the service model. A pure colocation facility, managed hosting provider, cloud platform, ISP-linked facility, carrier-neutral interconnection hub, telecom infrastructure operator and disaster recovery site may all face different legal requirements.
The most important legal question is whether the data center provides electronic communications services, networks or infrastructure under Law No. 5809. If it does, BTK authorization, CEVHER procedures, paid-in capital, audit obligations and telecom compliance may become relevant. If the data center provides hosting, Law No. 5651 obligations such as traffic data retention, content-removal procedures and hosting provider compliance should be reviewed. If personal data is processed or stored, KVKK obligations, data security measures, breach notification duties and cross-border transfer rules must be addressed.
Data centers are critical infrastructure for Turkey’s digital economy. They support cloud services, e-commerce, fintech, telecom networks, online platforms, AI systems, IoT, public services and corporate continuity. Because of this role, legal compliance should be built into the design, operation and contract structure of every data center project.
A well-structured data center compliance program should combine telecom classification, hosting law analysis, KVKK documentation, cybersecurity controls, facility risk management, customer contract review, incident response planning and audit readiness. Companies that address these issues before launch or investment will reduce regulatory risk, protect customers and build a stronger legal foundation in Turkey’s digital infrastructure market.
Frequently Asked Questions
Is there a single data center license in Turkey?
No. Turkey does not apply one single universal license to every data center. Legal obligations depend on the service model, including whether the data center provides colocation, hosting, cloud services, internet access, electronic communications infrastructure or telecom services.
Does a data center need BTK authorization?
A data center may need BTK authorization if it provides electronic communications services, electronic communications networks or infrastructure. BTK defines electronic communications and related infrastructure broadly under Law No. 5809.
What is BTK authorization?
BTK authorization is the registration of companies with the Authority for providing electronic communications services or networks, or the granting of specific rights and obligations to those companies.
Can a colocation provider avoid telecom authorization?
A pure colocation provider that only offers space, power, cooling and physical security may not automatically require telecom authorization. However, if it provides connectivity, internet access, data transmission or infrastructure operation, BTK analysis is necessary.
Does Law No. 5651 apply to data centers?
It may apply if the data center or cloud provider acts as a hosting provider, access provider or other internet actor. Hosting providers may be required to retain traffic information and ensure its accuracy, integrity and confidentiality.
Does KVKK apply to data centers?
Yes. Data centers may process personal data as data controllers for their own activities and as data processors for customers. KVKK requires technical and organizational measures to prevent unlawful processing and access.
What should a data center do after a data breach?
The operator should assess whether it is a controller or processor, notify affected customers without delay where it acts as processor, preserve evidence and support regulatory notifications. KVKK guidance interprets the breach notification period for controllers as no later than 72 hours after becoming aware of the breach.
Are cross-border transfers relevant for data centers?
Yes. Foreign remote support, overseas backup, cloud replication, global monitoring and group-company access may create cross-border transfer issues. KVKK Article 9 and the 2024 transfer by-law framework should be reviewed.
Are data localization promises risky?
Yes. A provider should not claim that data is kept in Turkey unless storage, backup, support, monitoring and administrative access structures fully support that statement. Some sector-specific or service-specific rules may require localization.
What is the most important compliance step for data centers in Turkey?
The most important step is correct legal classification. The operator must determine whether it is a colocation provider, hosting provider, access provider, electronic communications operator, cloud processor or a combination of these roles.
No Responses