Data Controller Representative · Law No. 6698 (KVKK)
Your data protection representative in Turkey, provided by a recognised law firm.
Foreign companies that process the personal data of people in Turkey must appoint a local representative and register with VERBIS. We act as your representative, complete the registration, and manage every contact with the Authority — on a clear, published fee.
Do you need one?
If you process the data of people in Turkey, the obligation almost certainly applies to you.
Unlike the GDPR, Turkey's law sets no size threshold for foreign controllers. There is no small-scale exemption. A company established outside Turkey that processes the personal data of people located in Turkey must appoint a representative and register with VERBIS regardless of its size, turnover, or data volume.
The representative must be a Turkish legal entity, or a Turkish citizen resident in Turkey, appointed by a board resolution that is signed, notarised in your home country, and apostilled. We prepare the paperwork, act as that representative, and handle the filing end to end. Read the full guide →
You likely need a representative if you:
- Sell products or services to customers in Turkey
- Run a website, app, or SaaS platform used by people in Turkey
- Employ, recruit, or monitor staff or contractors in Turkey
- Already appoint a representative in the EU under GDPR Article 27
Not sure? A 20-minute call settles it. Ask us.
What we do
The full mandate of a representative, carried by attorneys.
We do not simply forward mail. We hold the mandate and handle every obligation that comes with it.
VERBIS registration
We prepare your Records of Processing Activities in the required format and complete your registration in the Data Controllers' Registry. How it works →
Point of contact for the Authority
We act as your named representative for all correspondence with the Turkish Personal Data Protection Authority.
Data subject requests
We receive and manage requests from data subjects in Turkey and help you respond within the statutory deadline.
Breach notification support
When an incident occurs, we help you notify the Authority within the required window and advise on next steps.
Ongoing regulatory upkeep
We keep your VERBIS entry current and alert you to changes in the law that affect your obligations.
Real legal advice
When a matter escalates, you are already speaking to counsel who can advise on liability and defend your position — not a call centre.
Why a law firm, not a platform
A representative is only as valuable as what it can do when the Authority calls.
Most providers for this service are software vendors. They register you and forward correspondence. When a matter turns serious, that is where their mandate ends — and where ours begins.
| Capability | Compliance-tech platform | IP.TECH |
|---|---|---|
| Completes VERBIS registration | Yes | Yes |
| Acts as your registered representative | Yes | Yes |
| Attorney-client privilege | No | Yes |
| Legal advice on your actual liability | Referred out | In-house |
| Defends you in an enforcement action | No | Yes |
| Independent tier-1 legal recognition | No | Legal 500 · Chambers · GDR 100 |
| Named, credentialed data protection counsel | Faceless | FIP · CIPP/E · CIPM |
We are a local law firm on the ground in Istanbul, not a remote portal. When the Authority makes contact or a matter turns serious, you are already with counsel who can act. See how KVKK compares to the GDPR →
How it works
From first call to registered, in four steps.
Scope & quote
A short call to confirm your processing and give you a fixed fee — no open-ended billing.
Appointment
We prepare the board resolution and power of attorney; you sign, notarise, and apostille.
Registration
We format your records and complete your VERBIS registration with the Authority.
Ongoing representation
We stand as your representative year-round, handling requests, filings, and the Authority.
Pricing
Published fees. No hidden hourly billing.
One annual fee covers your representation. A one-time registration fee in year one covers appointment, apostille coordination, and your VERBIS registration.
Startups
1–50 employees
or $150 / month · + VAT
- Registered representative
- VERBIS registration & upkeep
- Authority correspondence
- Data subject request support at $150 / hour
Growth
50–249 employees
or $500 / month · + VAT
- Registered representative
- VERBIS registration & upkeep
- Authority correspondence
- Data subject request support at $150 / hour
Enterprise
250+ employees
or $750 / month · + VAT
- Comprehensive reporting & DSAR support included
- Dedicated communication channel
- Requests reviewed within 3 business days, with guidance
- Complete management of Authority communications
$2,000 + VAT to appoint us and complete your VERBIS registration (third-party costs capped at $150). Includes a structured VERBIS Notification Template built to integrate with your existing Records of Processing Activities.
Fees are exclusive of VAT. VERBIS registration itself carries no government fee. Multi-year and group engagements are discounted.
Companies that already rely on us as their representative in Turkey
We are able to name these because each appointment is a matter of public record on the Authority's registry. Many further clients we represent are not listed here.
"A representative should be the party you would want beside you if the Authority ever knocks — not a forwarding address."
Explore our free knowledge hub — the full English text of the law, translated Authority decisions, and practical guides — at dataprotectionturkey.com.
Questions
What foreign companies ask us first.
Does my company really need a representative in Turkey?
If your company is established outside Turkey and processes the personal data of people located in Turkey, then yes. Turkey's law contains no size or volume exemption for foreign controllers, so the obligation applies whether you are a startup or a multinational. Our self-check guide walks through the test.
What is VERBIS, and is registration separate from appointing a representative?
VERBIS is the Data Controllers' Registry maintained by the Turkish Personal Data Protection Authority. Foreign controllers register through their representative. The two go together: we act as your representative and complete the registration on your behalf. See our VERBIS registration guide.
How is this different from my EU GDPR Article 27 representative?
The role is similar in spirit, but it is a separate legal requirement under a separate law, and Turkey has no equivalent of the Article 27 small-scale exemption. An EU representative does not satisfy the Turkish obligation. We explain the differences in KVKK vs GDPR.
What are the penalties for not appointing a representative?
Failure to register can attract significant administrative fines, which the Authority revalues each year, and the Authority has pursued large enforcement sweeps against unregistered controllers. We will give you the current figures on a call.
How long does it take to get registered?
Once your signed, notarised, and apostilled appointment documents reach us, registration is typically completed quickly. The main variable is the time your side needs to notarise and apostille the paperwork, which we guide you through.
Can you also advise us if a data subject complains or a breach occurs?
Yes. Because we are a law firm, we can move straight from representation into advice and, if needed, defence — without handing you off to a third party.
Get started
Request a fixed-fee quote.
Tell us a little about your processing and we will respond within one business day with a clear fee and next steps. No obligation.