Your group procurement team has shortlisted a Turkish payroll provider. The commercial terms are agreed. Then your Data Protection Officer sends one question before anyone signs. How will Turkish national ID numbers, salaries, bank account details, and sick-leave reports be protected, and on what legal basis does any of that data leave Turkey?
That question is the right one. Under Turkey’s Personal Data Protection Law No. 6698 (KVKK), the employer stays the data controller when payroll is outsourced. The provider processes data on your behalf, and the law makes both of you responsible for security measures.
KVKK payroll outsourcing moves the work to a specialist. It does not move the accountability.
This checklist separates what the law requires from what good practice recommends, and lists the evidence you can ask a provider to produce. Datassist has run Turkish payroll for multinational employers since 1999 under ISO 27001 and ISAE 3402 certification, and these are the questions we expect buyers to put to us.
Table of Contents
- Who Is Responsible for What Under KVKK
- KVKK Rules That Apply to Payroll Outsourcing in 2026
- Payroll Data Security Checklist for Buyers
- Cross-Border Payroll Data Transfers
- Evidence to Request Before You Sign
Who Is Responsible for What Under KVKK
Every KVKK payroll outsourcing contract rests on two roles. The data controller decides why and how personal data is processed. The data processor handles data on the controller’s behalf and under its authorization. In payroll outsourcing, the employer is the controller and the payroll provider is normally the processor.
The roles matter because of Article 12 of the Personal Data Protection Law. The controller must take all necessary technical and organizational measures to prevent unlawful processing and unlawful access. When a processor handles the data, the controller is jointly responsible with the processor for those measures.
The controller must also carry out, or commission, the audits needed to confirm the law is being applied. Both parties have a confidentiality duty that continues after the engagement ends.
Most payroll processing does not rest on employee consent. KVKK allows processing without explicit consent when it is directly needed to perform a contract, such as the employment contract. The same applies when it is needed to meet a legal obligation, such as tax and Social Security Institution (SGK) filings.
You still owe employees a privacy notice under Article 10. It must explain who processes their data, for what purpose, and to whom it may be transferred.
Turkish Labor Law No. 4857 adds an employment-law layer. Article 75 requires the employer to keep a personnel file for each employee and to use information about employees honestly and lawfully. The employer must not disclose information the employee has a legitimate interest in keeping confidential. A payroll outsourcing contract should reflect both the KVKK duties and this confidentiality duty.
Regulation Note: Joint responsibility under Article 12 means a provider’s security failure can still become the employer’s problem. Choosing a processor is itself a compliance decision.
KVKK Rules That Apply to Payroll Outsourcing in 2026
There is no new 2026 statute aimed at payroll outsourcing. The rules a buyer must apply today come from Law No. 6698 as amended by Law No. 7499, which was published in the Official Gazette on March 12, 2024. Its changes to Article 9, the cross-border transfer rule, entered into force on June 1, 2024. The previous transfer rule continued to apply alongside the new one until September 1, 2024.
Three practical changes followed. First, a transfer abroad can rely on a Board adequacy decision for a country, a sector, or an international organization.
Second, where there is no adequacy decision, the parties can use appropriate safeguards, including a standard contract published by the Personal Data Protection Board. The Board adopted the standard contract texts on June 4, 2024 (Decision 2024/959), and a Regulation on transfers abroad followed on July 10, 2024. Third, a signed standard contract must be notified to the Personal Data Protection Authority within five business days.
What is new in 2026 is Board guidance on employee data. Principle Decision 2026/921 of April 29, 2026, published in the Official Gazette on June 2, 2026, addresses biometric data used for attendance tracking. The Board’s view is that processing fingerprint or palm data solely to track working hours does not meet any Article 6 processing condition. Even valid explicit consent would not make it proportionate under Article 4.
Principle Decision 2026/2035 of September 16, 2026 sets out how employers may monitor corporate e-mail and other work communication channels.
Regulation Note: Attendance and overtime records feed directly into payroll. If your time data comes from biometric terminals, review that input with your privacy counsel before it reaches your payroll provider.
Payroll Data Security Checklist for Buyers
Payroll data security in KVKK payroll outsourcing depends on a chain that runs from your HR system to the provider, the provider’s tools, the bank, and SGK. The table separates legal requirements from recommended controls, so you can see where KVKK compliance ends and good practice begins.
| Control | Status under KVKK | What to ask the provider for |
|---|---|---|
| Data flow map | Recommended (supports Art. 10 notice and Art. 12 measures) | A diagram of every system, location, and recipient |
| Access rights | Legal duty to prevent unlawful access (Art. 12) | Role list, approval process, and access review log |
| Payroll data processing agreement | Recommended way to evidence joint responsibility (Art. 12) | Signed agreement with instructions, security, and audit terms |
| Sub-processor control | Recommended | Current list plus change-notice and objection terms |
| Retention and destruction | Legal duty to erase when the purpose ends (Art. 7) | Retention schedule and exit return or destruction plan |
| Breach response | Legal duty to notify (Art. 12) | Escalation chain and contact names |
| Vendor evidence | Recommended (supports your audit duty) | Certificates, assurance reports, and test results |
1. Map the Payroll Data Flow
List every data field the provider receives: identity data, salary, bank details, family data for tax and benefits, and leave records. Then list every system and location it passes through. A flow map turns abstract compliance into specific questions.
2. Lock Down Access Rights
Ask who at the provider can see your employees’ data and why. Good practice is role-based access, named approvers, multi-factor authentication, and a periodic access review you can inspect.
3. Sign a Payroll Data Processing Agreement
KVKK does not prescribe a processor contract template. A written payroll data processing agreement is still the clearest way to evidence how the joint responsibility in Article 12 is shared. It should cover processing only on your instructions, confidentiality, security measures, sub-processors, breach notice, audit rights, and return or destruction at exit.
4. Control Sub-Processors
Payroll chains include hosting providers, payslip delivery tools, and support partners. Ask for the current sub-processor list, advance notice of changes, and the right to object.
5. Set Retention and Destruction Rules
Article 7 requires personal data to be erased, destroyed, or anonymized once the reason for processing ends. Payroll records also carry statutory retention periods under tax and social security law. Agree which records the provider keeps, for how long, and how it proves destruction when the contract ends.
6. Agree a Breach Response Chain
Board Decision 2019/10 reads the “shortest time” in Article 12 as 72 hours. The controller must notify the Board within 72 hours of learning of a breach, and inform affected employees within the shortest reasonable time. A processor that suffers a breach must inform the controller without delay. Your contract should name the people on both sides and the hours they are reachable.
Risk: Payroll files often contain special categories of personal data, such as health data in sick-leave reports and disability records, and trade union membership behind dues deductions. KVKK sets stricter processing conditions for this data, so treat it as a separate access tier, not as ordinary payroll data.
7. Ask for Vendor Evidence
Ask for documents an auditor would accept, and check what they actually cover. Datassist’s ISO 27001 and ISAE 3402 certified delivery is the kind of evidence to request, but confirm the scope of any certificate against the services you are buying. A periodic payroll compliance audit can confirm whether controls work in practice.
Cross-Border Payroll Data Transfers
Cross-border payroll data transfers deserve separate attention in any KVKK payroll outsourcing project, because they happen more often than buyers expect. Common triggers are group reporting to headquarters, a global HRIS hosted outside Turkey, offshore support teams, and cloud backups.
Article 9 now works in three steps. If the Board has issued an adequacy decision for the destination, the transfer can proceed on a valid legal basis. If not, the parties need an appropriate safeguard, such as a standard contract, Board-approved binding corporate rules, or a written undertaking approved by the Board. Only where neither exists can a transfer rely on a narrow list of exceptions, and then only if the transfer is incidental.
A group GDPR agreement with EU standard contractual clauses does not replace the KVKK route. The Board publishes four standard contract modules, including controller-to-processor and processor-to-processor versions, and each signed contract must be notified within five business days. Article 9 also requires the same safeguards for onward transfers.
Ask your provider where data is stored and supported, and which transfer route applies to each flow. For groups operating across Turkey and MENA, look for a contractual commitment to comply with each country’s data processing and privacy requirements rather than a blanket localization claim. Our guide to data residency and payroll in MENA covers the Saudi and UAE side.
Evidence to Request Before You Sign
A short evidence pack lets your DPO and internal audit test the provider’s claims before signature:
- ISO 27001 certificate with its scope statement and certifying body
- ISAE 3402 report, including the period covered and any exceptions
- Current sub-processor list with locations
- Transfer register showing the Article 9 route for each flow abroad
- Breach response plan and escalation contacts
- Retention and destruction policy for payroll records
- Sample access review showing who can see payroll data
Build these requests into your tender rather than asking after selection. Our payroll RFP and SLA checklist shows where they fit alongside service levels, and the guide Turkey Payroll Outsourcing: Cost, Benefits & Provider Selection covers the wider evaluation.
Expert Take: In our experience, the most telling signal is how quickly a provider answers scope questions with documents. A certificate on its own tells you less.
Frequently Asked Questions
Is a payroll provider a data controller or processor under KVKK?
In KVKK payroll outsourcing, the provider is normally a data processor. It processes employee data on the employer’s behalf and under its instructions. The employer remains the data controller and is jointly responsible with the provider for security measures under Article 12. A provider that uses payroll data for its own purposes would take on controller duties for that activity.
Do we need employee consent to outsource payroll in Turkey?
Usually not. KVKK allows processing without explicit consent when it is needed to perform the employment contract or to meet a legal obligation such as tax and SGK filings. You still owe employees a clear privacy notice that names the purposes and recipients, including the payroll provider.
Is our GDPR data processing agreement enough for KVKK compliance?
Not on its own. A GDPR agreement can cover many of the same controls, but Turkey has its own transfer rules. Transfers abroad without an adequacy decision need a KVKK safeguard, such as a Board standard contract notified within five business days. Review the Turkish workflow with local counsel.
How fast must a payroll data breach be reported in Turkey?
The data controller must notify the Personal Data Protection Board within 72 hours of learning of a breach under Board Decision 2019/10. Affected employees must be informed within the shortest reasonable time. A processor must inform the controller without delay, so your contract should set that escalation path.
Can payroll data be shared with headquarters outside Turkey?
Yes, if the transfer meets Article 9. That means an adequacy decision for the destination, an appropriate safeguard such as a standard contract or binding corporate rules, or, for incidental transfers only, one of the listed exceptions. Map each flow to its route before go-live.
Key Takeaways
- In KVKK payroll outsourcing, the employer stays the data controller and is jointly responsible with the provider for security.
- Most payroll processing relies on contract and legal-obligation grounds, not consent, but employees still need a privacy notice.
- Since June 1, 2024, transfers abroad follow a three-step Article 9 regime, and standard contracts must be notified within five business days.
- Breaches go to the Board within 72 hours, so your payroll data processing agreement needs a fast escalation chain.
- Request a written evidence pack before signature: certificate scope, assurance reports, sub-processor lists, and a transfer register.
KVKK Payroll Outsourcing: What to Do Next
Go back to your DPO’s question. With a flow map, a signed processing agreement, a transfer route for every flow abroad, and an evidence pack you have reviewed, you can answer it in writing. That answer is what makes KVKK payroll outsourcing defensible to internal audit and to your employees.
If your organization is evaluating payroll outsourcing in Turkey, Datassist runs end-to-end Turkish payroll, SGK declarations, tax filings, and payslip delivery for multinational employers. Our delivery is ISO 27001 and ISAE 3402 certified. A named, English-speaking account manager owns your cycle and answers your privacy team’s questions with documents. Discuss payroll requirements with Datassist.
This article is for informational purposes only and does not constitute legal advice. For up-to-date Turkish regulations, consult official sources or contact a qualified advisor.
Related Reading
- Payroll Outsourcing in Turkey: The Complete 2026 Guide – How Turkish payroll outsourcing works, what it covers, and how to choose a provider.
- Payroll Migration Checklist: How to Switch Providers Without Missing Payday – A step-by-step plan for moving payroll data and processes to a new provider.
- Payroll Outsourcing Services for Multinational Companies: Scope, Pricing, and SLAs – What to include in scope and service levels when outsourcing payroll.
