A data processing agreement is the contract you sign with a supplier that handles personal data on your behalf and under your instructions, such as a payroll bureau, cloud provider or call centre. It sets out the purpose, security measures, onward recipients and what happens when the service ends. Under Turkish law, you share liability for that supplier's security.
More people hold your personal data than you think
Picture a typical mid-sized company in Türkiye. Payroll is run by an outside accountancy firm, the CRM is a SaaS product, email sits in the cloud, website forms live on an agency's server and the security contractor keeps the visitor log. Each of these suppliers processes employee, customer or visitor data for you.
In most firms the legal basis for these relationships is either a general service contract or a single line saying "the parties shall comply with KVKK". Nobody has written down where the data is stored, who can access it, whether the work is subcontracted or whether the data is deleted when the contract ends. Those are exactly the questions an auditor or a breach investigation asks first.
Controller or processor? Getting the roles right
Türkiye's Personal Data Protection Law No. 6698, known as KVKK, follows a model close to the EU's GDPR and defines two roles. The data controller decides why and how personal data is processed; the data processor processes it on the controller's behalf, based on the authority the controller grants. The test is the real relationship, not the job title: a supplier that processes data only on your instructions and for your purposes is a processor.
Article 12 of the law makes the controller jointly liable with anyone processing data on its behalf for taking the required technical and organisational measures. Outsourcing the work does not outsource the responsibility. The contract is the one concrete tool that shows how that shared duty is divided and how you will oversee the supplier.
Roles are most often confused in the following cases:
| Supplier | Typical role | What to watch |
|---|---|---|
| Payroll or accountancy bureau | Usually a processor | May hold special category data (health reports, union membership) |
| Cloud email and file service | Processor | Server location and sub-processors |
| Bespoke software developer | Processor (if it has access) | Live data used in test environments |
| Call centre, outsourced sales | Processor | Retention period for recordings |
| Bank, social security, tax office | Separate controller | No processor contract; you need a legal basis for the transfer |
| Courier company | Usually a separate controller | Also processes data for its own purposes |
Roles are settled during the data inventory step of KVKK compliance. Every "recipient group" row in that inventory should link either to a processor agreement or to a separate legal basis for the disclosure.
The cost of supplier relationships without a contract
Sharing with third parties is the second most common subject of complaints to the Turkish regulator. According to the KVKK 2025 Annual Activity Report, 2,838 complaints in 2025 (22%) concerned data controllers unlawfully sharing personal data with third parties, second only to unlawful processing (52%).
Breaches involving a third party rose by 60% year on year to reach 48% of all breaches, and only 23% of third-party organisations fully remediated missing or weak multi-factor authentication on their cloud accounts. (Verizon 2026 Data Breach Investigations Report)
If the supplier is abroad, the burden grows. The KVKK announcement on standard contract notifications confirms that standard contracts used for transfers abroad must be notified to the authority within five business days of signature. We cover that duty in our cross-border data transfer guide; the point here is that a standard contract supplements the processor agreement rather than replacing it.
10 clauses every data processing agreement in Turkey should contain
KVKK does not supply a template, but the security duties in Article 12 and the rights of data subjects shape the content. For companies serving EU clients, Article 28 of the GDPR already lists the minimum terms, and one document can satisfy both regimes. In practice, an agreement without these ten clauses is incomplete:
- Subject, purpose and duration. Which service, which groups of people (employees, customers, visitors), which categories of data and for how long.
- Processing only on documented instructions. The supplier may not use the data for its own purposes, including product development, marketing or training AI models, and must tell you if it spots processing outside your instructions.
- Confidentiality. Supplier staff with access are bound by confidentiality, and access is limited to those who need it.
- Technical and organisational measures. Encryption, access control, multi-factor authentication, logging, backup and vulnerability management are spelled out. "Appropriate measures" on its own is not enough. Our SME cyber security checklist is a useful reference for the baseline measures.
- Sub-processors. Handing work to another firm, such as a hosting provider, requires your prior written approval; a current sub-processor list sits in an annex and changes are notified in advance.
- Data location and transfers abroad. Which country and data centre hold the data; if there is a transfer abroad, its legal basis and who files the standard contract notification.
- Breach notification. The supplier reports any breach to you without delay, within a defined window and with details of its scope. Your own clock with the regulator is running, so this clause belongs in your 72-hour breach response plan.
- Help with data subject requests. When an employee or customer asks for erasure, the supplier helps you meet your statutory deadline.
- Audit rights. The right to request documents, send questionnaires and carry out on-site or remote audits where needed, and to receive independent audit reports.
- Return and deletion at the end. When the relationship ends, the data is returned in the format you choose and every copy, backups included, is destroyed and documented. Periods should match your retention and disposal policy.
In a software project these clauses sit alongside source code and intellectual property terms, which we discuss in software contracts and source code.
Bringing existing suppliers under contract in four steps
Getting a new supplier right from day one is easy; retrofitting agreements with firms you have used for years is harder. We suggest this order:
- Build a supplier list from your inventory. Record every outside firm with access to personal data, the data categories involved and where the data lives. The recipient groups in your VERBIS registration are a good starting list.
- Prioritise by risk. Special category data, large numbers of people, hosting abroad and remote access to your systems mark a supplier as high risk; start with those.
- Send a processor annex and a questionnaire. Rather than reopening the main service contract, a data processing annex plus a short security questionnaire usually gets results faster. We cover questionnaire scope and scoring in our guide to third-party vendor security assessment.
- Verify with evidence and schedule reviews. Ask to see that the measures are real (access lists, encryption settings, backup reports) and set an annual review date.
Measures on paper need technical checks behind them. The ISO 27001 framework offers a ready-made audit language for supplier relationships, and a data loss prevention approach backs up contractual promises on the systems side.
Where processor relationships get missed: software, cloud and integration
A processor relationship does not only arise when you buy a service. Giving a software company a copy of the live database for testing, granting full rights to the team moving your old file server to the cloud, or handing an API key to an integrator connecting two systems all count.
In a cloud move, contract and architecture should be decided together: data location, backup location and the provider's sub-processors are among the first questions when replacing an on-premise file server. The same applies to cloud migration cost, where compliance gaps are among the hardest items to fix later.
AI tools deserve extra care. Whether a service that staff upload documents to uses that data to train its models is a clause 2 question; see our piece on ChatGPT and company data. In data-heavy integrations such as time and attendance to payroll, limiting the fields that move puts the contract's data category definition into practice.
How we handle this at Digital Bridge
A data processing agreement is a legal document, and legal advice comes from your lawyer. Our contribution is to define the technical measures in the contract correctly and make sure your systems actually apply them.
- Discovery and inventory. Through our data protection compliance consultancy we map the suppliers that touch personal data, the data flows and the access routes, and clarify each role as processor or separate controller.
- Technical annex and questionnaire. Drawing on our cyber security consultancy, we turn the security annex and supplier questionnaire into concrete, measurable requirements.
- Cloud and infrastructure decisions. For systems moving to the cloud, our cloud migration and infrastructure consultancy puts data location, backup and sub-processor questions at the start of the project.
- Data minimisation in integrations. In API integration projects we build connections that carry only the fields required and log every access.
For tracking signed agreements and their annexes, our own SmartFiles business file management product is one option: the main contract and its processor annex are linked to each other, the final text goes through a sequential approval such as unit manager, legal and general manager, and the annual review date is added to the document as a reminder. Access to the contract folder is granted per person or department, and activity in it stays in the activity history.
We suggest settling the template with a few high-risk suppliers first, then rolling it out to the rest of the list. The same rule applies to us: where a project requires access to your personal data, that relationship should also rest on a written processor agreement.
Next step
List every supplier with access to personal data on one page and add a column headed "written processor agreement in place?". The empty rows are your priorities. To review the list together, get in touch with our team; related articles are collected in our Cyber Security & Compliance hub.