SaaS Agreement in Turkey: Template, Key Clauses and Local Law (2026)

A SaaS agreement in Turkey is a contract to use software hosted by a provider and reached over the internet for a recurring fee. Turkey has no SaaS-specific statute. A SaaS contract is treated as an atypical (sui generis) contract that blends service, licensing and safekeeping elements, with data protection law doing much of the heavy lifting because the service almost always processes personal data. This guide explains the Turkish legal framework, the clauses a SaaS agreement should carry, and a template skeleton. It is general information, not legal advice. ## What law governs a SaaS agreement in Turkey? There is no single SaaS law. The framework is: - The Turkish Code of Obligations No. 6098 (TBK) for formation, interpretation and performance. A cloud or SaaS contract does not fit neatly into one named contract type; commentators note it carries service and safekeeping features (the safekeeping contract sits in Article 561 of the Code), so it is read as an atypical contract under freedom of contract. Article 27 invalidates terms that breach mandatory law or public order.

• Copyright law (Law No. 5846 on Intellectual and Artistic Works) and the Industrial Property Law for the software and related rights the provider licenses.
• The Law on the Protection of Personal Data No. 6698 (KVKK), which took effect on 7 April 2016. Where the provider processes customer personal data, it typically acts as a data processor under KVKK, and the parties should put the processing and security obligations in writing. KVKK also has a cross-border transfer regime, and the authority has published standard contracts for transfers. The Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu, KVKK) is the supervisory authority. ## Is a SaaS agreement enforceable in Turkey? Yes, as an atypical commercial contract. Two practical points: - Freedom of contract, with Article 27 as the limit. Commercial terms are largely free to agree, but a term breaching mandatory law or public order is invalid; the rest of the contract can survive.
• Data protection is not waivable. The parties can set commercial terms freely but cannot contract out of KVKK duties. Security and processing obligations, and a lawful basis for any cross-border transfer, are compliance requirements, not just drafting choices. ## Key clauses in a Turkish SaaS agreement ### Service description and scope Define the software, the subscription tier, user limits, and what is in and out of scope. ### Service levels (SLA) State uptime targets, support response times, maintenance windows and the remedy for a miss (usually service credits). ### Fees, billing and price changes Set the fee, billing cycle, what triggers an increase and the notice required, and make auto-renewal explicit. ### Data protection (KVKK) Set out the provider's role as processor, the security measures it will apply, breach handling, subprocessor rules, data location and the customer's instruction and audit rights. Address cross-border transfers through a lawful mechanism, using the authority's standard contracts where relevant. ### Security and breach notification Describe security controls, encryption in transit and at rest, and the time within which the provider notifies the customer of a data breach. ### Intellectual property and licence Confirm the provider keeps ownership of the software and grants a non-exclusive, non-transferable right to use it during the term; the customer keeps ownership of its data. ### Confidentiality Protect each side's confidential information with standard carve-outs. ### Liability and indemnities Cap liability, carve out items that should not be capped, and keep the allocation within Article 27 limits. ### Term, termination and exit / data return Set the term, renewal and termination rights, and a structured exit: the customer exports its data in a usable format within a stated window, and the provider deletes it afterwards (aligning with KVKK deletion duties). ### Governing law and disputes Choose Turkish law and a forum. ## Template skeleton ```

1. Parties and definitions
2. The service and scope
3. Service levels and support
4. Fees, billing and price changes
5. Customer data and intellectual property
6. Data protection (KVKK No. 6698) and cross-border transfers
7. Security and breach notification
8. Confidentiality
9. Warranties and disclaimers
10. Liability and indemnities
11. Term, renewal and termination
12. Exit and data return / deletion
13. Governing law (Turkey) and dispute resolution
14. Signatures

- **KVKK is the main compliance driver.** Put the processor obligations and security measures in writing, and handle any cross-border transfer through a lawful mechanism.
- **Cross-border transfers need care.** KVKK has a transfer regime and official standard contracts; data leaving Turkey should rest on a valid basis.
- **Article 27 caps the terms.** Liability and other clauses that breach mandatory law or public order are invalid. ## From the contract to the subscription you actually run Signing the SaaS agreement is one moment; managing it is the rest of the year. Someone must track the renewal date so a price rise does not slip through, hold the provider to the SLA, keep the KVKK processing and transfer terms current as subprocessors change, and find the exit clause fast when a service is cut. Across a stack of SaaS contracts, that work is easy to lose. An AI contract workspace keeps each SaaS agreement, its clause structure, renewal and notice dates and data protection schedule in one place, so you can draft from a template, see where terms are one-sided, edit in plain language, and get a reminder before a deadline. If you want to see drafting, review, tracking and governance in a single workspace, [Adira](https://adiralaw.com) is built around that idea. Deep Turkey-specific jurisdiction coverage is on Adira's roadmap today; India is deepest now. ## FAQ