Establishing a Data Center in Türkiye
KVKK is not a Barrier but an Opportunity
KVKK is not a Barrier but an Opportunity
The Signal
Establishing and operating a data center (VM) in Türkiye is not based on a single “Data Center Law”; It is governed by regulations from multiple authorities such as BTK (Information Technologies and Communication Authority), KVKK (Personal Data Protection Authority) and the Ministry of Industry and Technology.
Why It Matters
Electronic Communications Law No. 5809: If a VM only provides “co-location” services, a full operator license from BTK may not be required. However, if internet access or managed network services are provided, Internet Service Provider (ISP) authorization becomes mandatory. Law No. 5651 (Hosting Service Provider): VMs are legally classified as “Hosting Service Provider”. They are required to make a Hosting Service Provider Notification to BTK (free but mandatory) and keep traffic records for at least 2 years. * Authorization Regulation on the Electronic Communications Sector: The decisions made by the Council of State at the beginning of 2024 clarified the limits of BTK’s authority in this field.
Personal Data Protection Law No. 6698: The biggest commercial opportunity for VMs is “Data Localization”. In accordance with Article 9 of the KVKK, the transfer of personal data of Turkish citizens abroad is subject to very strict conditions. Board Decisions (2022/249, 2020/559): The KVKK Board considers data stored in offshore cloud systems (AWS, Azure, etc.) as “data transfer abroad”; It imposes heavy penalties on companies that do not have sufficient commitment or consent. This situation directs companies to domestic VMs.
Presidential Circular No. 2019/12 (Information and Communication Security Measures): Public institutions and companies providing critical infrastructure services are obliged to store their data in secure VMs within Türkiye. Information and Communication Security Guide: VMs, especially those serving the public sector, are expected to comply with the physical security, HVAC and network isolation criteria specified in this guide.
The Move
KVKK Article 9 Revision (2024): The 8th Judicial Reform Package harmonized the KVKK’s cross-border data transfer regime with the EU-GDPR. The era of “Standard Contract Clauses” and “Qualification Decisions” has begun. However, the need for local VMs remains a strategic priority. Investment Incentives: Data center investments were included in the scope of “Priority Investment” by the Ministry of Industry and Technology. This means that even if the investment is in Istanbul, 5th Region incentives can be benefited from — tax reduction, SSI premium support and interest subsidy.
The court ruled that some additional obligations imposed on operators through BTK’s authorization regulation were contrary to the principle of legality.
Risk: VMs’ right to sue BTK against possible administrative interventions has been strengthened. Opportunity: Increased predictability for VM operators. BTK’s uncontrolled intervention in all data traffic is now subject to judicial review.
Read the Full Analysis
For the full original analysis, read the Ghost version here: https://www.mesutaydin.link/turkiyede-veri-merkezi-kurmak/
This article is for strategic information only. It is not legal, investment, or tax advice.