Step-by-step conveyancing and procedure stages

Initial consultation and scoping

We start with a focused call about your product, where it touches Türkiye and what triggered the need — a contract, a launch, a data flow or a regulator letter. You leave with a clear view of which statutes apply to you and what comes next.

Legal and compliance assessment

We map your activity against Law No. 7545, Law No. 6563, the KVKK and your contracts, and produce a prioritised list of obligations, gaps and risks so you know what is urgent and what can wait.

Engagement, power of attorney and apostille setup

We agree a written scope and fee basis, then arrange a notarised power of attorney with apostille or consular legalisation so we can file, register and deal with regulators on your behalf, without you travelling.

Drafting, filing and remediation

We draft or revise the contracts, prepare ETBİS, KVKK and other filings, notify standard contractual clauses within the required window, and close the compliance gaps the assessment found.

Regulator dealings and incident response

If a regulator opens an inquiry or a security or data incident occurs, we manage the timeline, prepare your written responses and represent you before the KVKK Board, the Ministry of Trade or the Cybersecurity Presidency.

Ongoing compliance and monitoring

Because this area keeps changing, we can keep you updated on new secondary regulation, threshold revaluations and KVKK Board decisions, and adjust your contracts and filings as the rules move.

Critical statutory deadlines and calendar windows

Timing that matters

5 business daysSigned standard contractual clauses must be notified to the KVKK Board through the Veri Aktarım Modülü within 5 business days of signing (KVKK No. 6698, Art. 9, as rewritten by Law No. 7499, in force 1 June 2024). Confirm the current notification window before you file.

What to prepare before your first call

Most of the early work is gathering facts, not legal analysis. Having the following ready lets your activity be mapped against Law No. 7545, Law No. 6563, the KVKK and your existing contracts without a second round of questions.

Write down exactly how your product touches Türkiye — Turkish users, Turkish sellers, Turkish-language sales, or data flowing to or from Türkiye — and whether any Turkish entity, branch or liaison office exists.
Collect the contracts already in use with Turkish counterparties: licences, subscription or SaaS terms, development and maintenance agreements, cloud and data-processing agreements, SLAs and any reseller or distribution deals.
Map where Turkish personal data goes: which servers, which group companies, which sub-processors, and which country each one sits in.
Check which basis under Article 9 of the KVKK you are actually relying on — adequacy, standard contractual clauses, binding corporate rules or a derogation — and whether any signed SCCs have been notified to the KVKK Board.
If you run a platform, pull your current net transaction volume and transaction count so your position against the Law No. 6563 tiers can be checked rather than assumed, and confirm whether you are registered on ETBİS.
Have a power of attorney drafted broadly enough to cover ETBİS, KVKK and regulator filings in one document, with an apostille for Hague Convention countries or consular legalisation otherwise — a narrow PoA usually means a second notary trip abroad mid-matter.
Gather any regulator correspondence already received — from the KVKK Board, the Ministry of Trade or the Cybersecurity Presidency — together with its date, since regulator deadlines are short.

Governing statutory provisions under Turkish law

7545~~LAW NO.~~

Cybersecurity Law No. 7545

Türkiye's first dedicated cybersecurity statute, published in the Official Gazette on 19 March 2025; it created the Cybersecurity Presidency (Siber Güvenlik Başkanlığı) and the Cybersecurity Board and imposes security, reporting and approval duties, with particular focus on critical infrastructure.

6563~~LAW NO.~~

E-Commerce Law No. 6563 (as amended by Law No. 7416)

Splits online business into intermediary service providers and electronic-commerce service providers, and sets ETBİS registration, transparency duties, the e-commerce licence regime and obligations that escalate in tiers with net transaction volume.

6698~~LAW NO.~~

Personal Data Protection Law (KVKK) No. 6698 · Art. 9

Governs personal-data processing and cross-border transfers, which since Law No. 7499 (in force 1 June 2024) run on adequacy decisions, appropriate safeguards such as SCCs or BCRs, or derogations, under the supervision of the KVKK Board.

Technology, AI & Cybersecurity Law: Compliance Stages, SaaS Licensing & Incident Defense