If you build software for the Turkish market, you have heard the line: "KVKK means your data has to stay in Turkey." Hosting vendors use it to sell fear; lawyers answer "it depends" and the conversation ends.
The truth sits between the two — and is more interesting than either. This piece covers what Law No. 6698 (KVKK) actually says about data location, the cross-border transfer rules that took effect in 2024, and which problems Turkey-based hosting genuinely eliminates. We are engineers, not lawyers — this is a verified map for infrastructure decisions, not legal advice.
First, the Myth: KVKK Does Not Say "Keep It in Turkey"
No article of KVKK imposes a general residency requirement on personal data. The law regulates how data is processed and transferred, not where the server physically sits. An app hosted on AWS Frankfurt is not automatically illegal.
The nuance: hosting abroad is not illegal — it is procedural. Article 9 ties cross-border transfers to specific legal safeguards, and those safeguards are not free.
The 2024 Overhaul: New Transfer Rules
Amendments effective in 2024 rewrote Article 9. Cross-border transfer now requires one of three bases:
1. Adequacy decision
If the Board declares a country's protection "adequate", transfers there are free. The catch: for most countries — including the US — no adequacy decision exists. This route is closed in practice.
2. Appropriate safeguards — where most companies land
- Standard contract: One of KVKK's four templates (controller→controller, controller→processor, processor→controller, processor→processor), signed without a single edit. Signatures must satisfy Turkish contract law, the Turkish text prevails, and the contract must be notified to the Authority within 5 business days (physically, via KEP, or through the online notification module opened in late 2024). No approval needed — but miss the deadline and the contract counts for nothing.
- Binding corporate rules (BCR): Intra-group ruleset — requires Board approval and can take months.
- Undertaking: Written commitment from the recipient — again Board approval.
3. Narrow exceptions — not what they used to be
Under the old regime, "I have explicit consent" sufficed. Post-2024 exceptions are tied to strict necessity: contract formation/performance, vital interests, public interest — narrow, case-by-case grounds. Routine hosting transfers cannot lean on exceptions.
Where Residency Is De Facto Mandatory
The general rule is location-neutral, but some sectors make Turkey residency effectively required:
- Payment systems (Law 6493): Payment and e-money institutions must keep primary and secondary systems in Turkey — your standby server cannot be abroad either.
- Public sector and tenders: Many public procurement specs explicitly demand in-country hosting.
- Health and regulated verticals: Sectoral rules and Board decisions can turn residency into a de facto requirement for specific data types.
If your customer base sits in one of these, "should I host in Turkey" is not a preference — it is a requirement.
Four Real Advantages Even When Not Mandatory
1. The standard-contract machinery disappears on the hosting leg
Per foreign data processor: find the right template, sign unmodified, attach authorization documents, notify within 5 business days, re-notify on every change. When data stays in Turkey, this entire mechanism never comes up for the hosting layer. No transfer, no safeguard hunt.
2. Foreign government access risk drops to zero
The US CLOUD Act can compel American companies to hand over data regardless of where it is stored. Your data in AWS Frankfurt is still under a US company's control. The risk may be low — it is not zero. With a Turkey-based provider under Turkish jurisdiction, the question simply dissolves.
3. Latency
If your users are in Turkey, every request round-tripping to Frankfurt adds 60-90 ms. When the database travels the same path, page loads compound. Not a legal issue — a product quality issue.
4. Legal language and reachability
During an incident, discussing your DPA, subprocessor list and support channel in your own legal language matters. Getting an answer to "where are my backups" in Turkish the same day beats an English ticket thread that takes three.
Six Questions to Ask Any Provider
"Is your server in Turkey?" is not enough. The commonly missed points:
- Where is the primary region? — Demand a precise answer; "Europe" is not one.
- Where are backups and replicas? — The most skipped question. Data in Istanbul, backups in Frankfurt means the transfer already happened.
- From which country does support access my data? — A support engineer in another jurisdiction reading your logs can itself count as a transfer.
- Is there a subprocessor list? — CDN, logging, error tracking — third parties are transfer parties too.
- Do you offer a DPA, under which law? — Ask for KVKK-compatible DPA text.
- What happens when data is deleted? — How long do deleted records live in backups? KVKK's destruction rules cover this too.
Where Skyversal Stands — No Exaggeration
Our infrastructure runs in Turkey; your projects, databases and backups stay on systems inside Turkish borders. On the hosting leg, cross-border transfer simply never arises — so the standard-contract burden is never born for it. Dollar pricing and cross-border legal risk leave the equation the same way; details in our local PaaS comparison.
Honesty clause: hosting data in Turkey does not by itself make you KVKK compliant. If your app processes personal data, disclosure obligations, VERBİS registration, consent management and security measures remain yours. We close the infrastructure side of the equation; the application side is yours. See our security approach and pricing.
FAQ
Does KVKK force data to be stored in Turkey?
No — the general rule regulates cross-border transfers rather than mandating residency. But payment systems (Law 6493), some public tenders and sector-specific rules make Turkey hosting de facto mandatory.
What do I need if I host abroad?
In most cases, sign KVKK's standard contract with the provider and notify the Authority within 5 business days. Alternatives — binding corporate rules or a Board-approved undertaking — can take months.
Can I modify the standard contract?
No. The Authority's template must be used without a single edit; a modified contract counts as no safeguard. If executed bilingually, the Turkish text prevails and both signatures must appear on the Turkish column.
Is my hosting company the controller or processor?
Your hosting provider is typically a data processor; you — the app operator — are the data controller and carry the legal responsibility. Provider choice does not remove responsibility; it makes it auditable.
This article is not legal advice; consult a KVKK specialist for concrete compliance decisions.