Setting Up a Data Center in Turkey

1. Regulatory Landscape (Legislation Map)

Setting up and operating a data center (DC) in Turkey is governed not by a single "Data Center Law," but by regulations from multiple authorities — BTK (Information and Communication Technologies Authority), KVKK (Personal Data Protection Authority), and the Ministry of Industry and Technology.

A) Infrastructure & Licensing (BTK)

• Electronic Communications Law No. 5809: If a DC only provides "housing" (co-location) services, a full operator license from BTK may not be required. However, offering internet access or managed network services mandates an Internet Service Provider (ISP) authorization.
• Law No. 5651 (Hosting Provider): DCs are legally classified as "Hosting Providers." They must file a Hosting Provider Notification with BTK (free but mandatory) and retain traffic logs for a minimum of 2 years.
• Authorization Regulation for the Electronic Communications Sector: Early 2024 rulings by the Council of State (Danıştay) have clarified the boundaries of BTK's authority in this domain.

B) Data Security & Localization (KVKK)

• Personal Data Protection Law No. 6698: The biggest commercial opportunity for DCs is "Data Localization." Under Article 9 of KVKK, transferring Turkish citizens' personal data abroad is subject to very strict conditions.
• Board Decisions (2022/249, 2020/559): The KVKK Board considers data stored in offshore cloud systems (AWS, Azure, etc.) as "cross-border data transfer" and imposes heavy fines on companies lacking adequate commitments or consent. This is driving companies toward in-country DCs.

C) Physical & Cybersecurity Standards

• Presidential Circular 2019/12 (Information and Communication Security Measures): Public institutions and companies providing critical infrastructure services are required to store their data within Turkey in secure DCs.
• Information and Communication Security Guide: DCs, especially those serving the public sector, are expected to comply with the criteria for physical security, HVAC, and network isolation outlined in this guide.

---

2. Recent Developments & Changes (2024–2025)

• KVKK Article 9 Revision (2024): The 8th Judicial Reform Package aligned KVKK's cross-border data transfer regime with the EU-GDPR. The era of "Standard Contractual Clauses" and "Adequacy Decisions" has begun. However, the need for local DCs remains a strategic priority.
• Investment Incentives: Data center investments have been classified as "Priority Investments" by the Ministry of Industry and Technology. This means: Even if the investment is in Istanbul, it can benefit from 5th Region incentives — tax reductions, social security premium support, and interest subsidies.

---

3. Judicial Trends & Critical Rulings (Risk Analysis)

Council of State (Danıştay) IDDK Decision 2024/183

The court ruled that certain additional obligations imposed on operators through BTK's authorization regulation were contrary to the principle of legality.

• Risk: DCs' right to litigate has been strengthened against BTK's potential administrative overreach.
• Opportunity: Predictability for DC operators has increased. BTK's uncontrolled interference with all data traffic is now subject to judicial review.

---

4. Gaps & Regulatory Arbitrage Opportunities

1. Absence of Cloud Computing Legislation: Turkey has no law specifically governing cloud computing. Service providers are squeezed between ISP and Hosting Provider definitions. This gap offers room for contractual freedom and flexible business models — a regulatory arbitrage play.
2. Energy Efficiency & Incentives: DCs are energy-intensive. There is no fully established incentive mechanism for DCs that obtain a Green Energy Certificate (YEK-G). This area is an "opportunity window" for ESG-focused funds.
3. Legal Islands (Digital Free Zones): Establishing a DC within Technology Development Zones (Technoparks) provides corporate tax exemption.

---

5. Opportunity Assessment (Preliminary Analysis)

Summary: Setting up a data center in Turkey is currently in a "Safe Passage" window. Regulatory pressure (KVKK) is not a barrier — it's the strongest Unique Selling Point for local operators in the market.