Practice Areas
IT & Technology Law Advisory
Support for technology companies and data controllers on personal data protection and obligations arising from IT contracts.
Last updated: · Prepared by: Av. Barış Kaymaz
IT and technology law is a fast-evolving field spanning personal data protection, internet-related offenses, e-commerce and software and IT contracts, primarily under the Personal Data Protection Law No. 6698 (KVKK), the Internet Law No. 5651, and the E-Commerce Law No. 6563.
Because technology changes rapidly, this field requires continuous attention. Correctly identifying the obligations of data controllers and processors is essential both to avoid administrative sanctions and to maintain user trust.
Personal Data Protection
The KVKK sets out the core principles for the lawful processing, transfer, and storage of personal data. A data controller is the person or entity that determines the purposes and means of processing and is responsible for establishing and managing the data filing system; processing generally requires the data subject's explicit consent, except in statutory exceptions. Data controllers meeting certain thresholds must register with the Data Controllers' Registry (VERBİS), fulfil information obligations, and implement the technical and administrative measures needed to secure the data.
Data Breach Notification
Where personal data is unlawfully obtained by third parties, the data controller must notify the affected individuals and the Personal Data Protection Board as soon as possible, and the Board may publish the notification on its website or by another suitable method. An effective response process after a breach helps both reduce the risk of administrative fines and minimise harm to affected individuals, with documentation of the breach's scope, the data categories affected, and the measures taken playing a critical role.
E-Commerce and Electronic Contracts
Law No. 6563 and its implementing regulations set out the information obligations of e-commerce service providers, the conditions for sending commercial electronic messages, and the procedure for forming electronic contracts; prior recipient consent is generally required for commercial electronic messages, and sending them without consent risks an administrative fine. The validity of electronic contracts depends on the parties' matching declarations of intent being properly expressed electronically, and distance-selling contracts must also observe the additional information and withdrawal-right obligations under consumer law.
Cybercrime
Articles 243 et seq. of the Turkish Penal Code criminalise unlawful access to an information system, obstructing or disrupting it, destroying or altering data, and misusing bank or credit cards, offences whose investigation requires specialised technical knowledge for gathering and examining digital evidence. Unlawfully recording, obtaining, or disclosing personal data is separately criminalised under Article 135 et seq. of the Penal Code, and these acts can trigger criminal liability independent of the administrative sanctions available under the KVKK.
IT Contracts
Drafting IT contracts such as software development, licensing, cloud services, and data processing agreements requires clearly addressing the transfer or licensing of intellectual property rights, service level commitments (SLAs), confidentiality and data-processing terms, and limitations of liability. Clearly defining the data processor–data controller relationship between the parties in the contract is also important for KVKK compliance.
Services in This Area
- Managing data protection compliance processes and drafting privacy notices
- Advising on data controller registry filings and data inventory processes
- Managing data breach notification procedures
- Handling complaints and defenses before the Data Protection Authority
- Drafting e-commerce and distance sales agreements
- Drafting software license, cloud services and data processing agreements
- Representing clients in cybercrime complaints and defense proceedings