Data Processing Agreement in Turkey: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in Turkey is the contract that governs how a data processor handles personal data on behalf of a data controller. It is the main instrument for showing that processing meets the Law on the Protection of Personal Data No. 6698 (KVKK). Turkey does not use the exact wording of the EU GDPR, but it uses the same controller and processor structure and the same written-instruction logic. This guide explains the Turkish legal framework, the clauses a DPA should carry, and a template skeleton. It is general information, not legal advice. ## What law governs a data processing agreement in Turkey? The framework is: - The Law on the Protection of Personal Data No. 6698 (KVKK), which took effect on 7 April 2016 and sets the duties of the data controller (veri sorumlusu) and data processor (veri isleyen). The processor acts on the controller's instructions and shares responsibility for data security.

• The secondary regulations and Board decisions of the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu). The Authority is the supervisory body and publishes guidance, decisions and standard forms.
• The 2024 cross-border transfer reform. Law No. 7499 amended KVKK in March 2024 and rebuilt the transfer regime around three routes: an adequacy decision, appropriate safeguards (including a standard contract the Board announces), or limited incidental cases. The Board's transfer regulation was published in the Official Gazette on 10 July 2024. A standard contract used for a transfer must be notified to the Board within five business days of signing. ## Is a data processing agreement required in Turkey? In practice yes, whenever a controller lets another party process personal data for it. KVKK makes the controller and the processor jointly responsible for data security, so the duties have to be set in writing to be workable and to show compliance. Data protection duties cannot be contracted out of; the parties can agree commercial terms but not waive KVKK obligations. ## Key clauses in a Turkish data processing agreement ### Roles and subject matter Name the controller and the processor, and describe the processing: its purpose, duration, the categories of data and data subjects. ### Processing only on instructions State that the processor acts only on the controller's documented instructions and flags any instruction it believes breaches KVKK. ### Security measures Set the technical and organisational measures, including encryption in transit and at rest, access controls and staff confidentiality, reflecting the shared security duty under KVKK. ### Breach notification Set the time within which the processor notifies the controller of a personal data breach so the controller can meet its own reporting duties to the Authority and data subjects. ### Subprocessors Require prior approval of subprocessors and flow-down of the same obligations. ### Cross-border transfers Address any transfer abroad through a lawful route under the reformed regime: an adequacy decision, the Board's standard contract (notified within five business days), or another appropriate safeguard. ### Data subject rights and assistance Require the processor to help the controller answer data subject requests and meet Authority demands. ### Audit and records Give the controller audit rights and require the processor to keep records of processing. ### Return and deletion Require the processor to return or delete the data at the end of the service, aligning with KVKK deletion duties. ## Template skeleton ```

1. Parties and definitions
2. Subject matter and duration of processing
3. Roles: controller and processor
4. Processing only on documented instructions
5. Security measures
6. Personal data breach notification
7. Subprocessors
8. Cross-border transfers (KVKK reformed regime)
9. Data subject rights and assistance
10. Audit and records
11. Return and deletion of data
12. Liability and term
13. Governing law (Turkey) and dispute resolution
14. Signatures

- **Security is a shared duty.** KVKK makes both sides responsible for data security, so the measures clause is not optional boilerplate.
- **Cross-border transfers changed in 2024.** Use one of the three lawful routes and remember the five business day notification for a standard contract.
- **Check the Board's current adequacy list.** Whether any country has an adequacy decision changes over time, so confirm against the Authority before relying on that route. ## Common mistakes to avoid - Copying an EU GDPR DPA word for word without mapping it to KVKK roles and the reformed transfer regime.
- Transferring data abroad on explicit consent alone after the reform, instead of an approved safeguard.
- Missing the five business day notification for a standard contract used for a transfer.
- Leaving subprocessor approval and deletion duties vague. ## From the schedule to the processing you actually run Signing the DPA is one moment; keeping it true is continuous. Subprocessors change, transfer routes get amended, and breach timelines have to be met. Across many vendor DPAs, tracking which version is current and which transfer basis applies is easy to lose. An AI contract workspace keeps each DPA, its security and transfer schedules, its subprocessor list and its review dates in one place, so you can draft from a template, see where terms are weak, edit in plain language and get a reminder before a deadline. If you want to see drafting, review, tracking and governance in a single workspace, [Adira](https://adiralaw.com) is built around that idea. Deep Turkey-specific jurisdiction coverage is on Adira's roadmap today; India is deepest now. ## FAQ