Short answer: anyone who collects, produces, shares or sells, for commercial purposes, data listed in Türkiye’s National Geographic Data Responsibility Matrix must obtain a permit from the Ministry of Environment, Urbanisation and Climate Change before starting. The rule covers foreign companies too. A company found operating without a permit gets 15 days to apply; if it does not, a Turkish company is fined the highest one-year permit fee and a foreign company twice the one-year permit fee.
What the regulation does
The Geographic Data Permits Regulation, issued by the Ministry of Environment, Urbanisation and Climate Change, was published in the Official Gazette of 14 October 2026 (No. 33400) and entered into force the same day. It is based on Law No. 7221 on Geographic Information Systems and Presidential Decree No. 49 on Geographic Information Systems.
The new text repeals the two regulations published on 10 February 2021, the Geographic Data Permits Regulation and the Geographic Data Licence Regulation, and brings the permit regime under one instrument (Art. 19). Permits and licences already issued under those two regulations remain valid until the end of their term (Provisional Art. 1).
What is geographic data, and which data need a permit?
Geographic data is any information tied to a location: building positions, addresses, roads and transport networks, cadastral records, electricity and natural gas infrastructure, land use. Türkiye’s National Geographic Information System classifies these data into themes and sub-themes.
The permit requirement does not apply to all location data. It covers data listed in the National Geographic Data Responsibility Matrix (Art. 4(1)(g)). The first question is therefore which theme and sub-theme of the Matrix the data your company collects, produces, shares or sells correspond to. The application form asks for exactly that (Art. 8(1)(b)).
Who needs a permit?
Under Article 5, natural persons, private legal entities and foreign natural and legal persons need a permit for commercial activities to collect, produce, share or sell geographic data within scope. Points that matter in practice:
- Branches and agencies: for entities that are branches or agencies within the meaning of the Turkish Commercial Code, the head office obtains a single permit (Art. 5(2)-(3)).
- Services for public bodies: data collection and production for public institutions requires a permit but no fee. If the resulting data are later sold, shared or otherwise commercialised, the fee becomes payable (Art. 5(4)).
- First year of activity: Turkish natural persons and private legal entities receive a fee-free permit for the year in which they first start commercial activity (Art. 5(5), Art. 14(9)). A newly founded startup still needs the permit; only that year’s fee is waived. Foreign companies do not get this exemption.
- Electricity and gas distribution companies: companies holding a distribution licence from the Energy Market Regulatory Authority (EPDK) are exempt from the permit and the fee for their licensed activities, provided they register in the electronic system. If they commercialise the data outside those activities, the permit and fee apply (Art. 5(6)).
Which activities are exempt?
The exemption list in Article 6 is short and narrow:
- address information requested for invoicing,
- a business publishing the addresses and locations of its own head office, branches and agencies on its website or social media accounts.
Do not assume that other location data processing falls outside the regulation. Showing your own branch locations on your website is exempt; a product that compiles third parties’ location data and offers it to your customers needs its own assessment.
How to apply
The application is filed through the Ministry’s electronic system, by an authorised signatory, before the commercial activity starts (Art. 7). The main information and documents required from legal entities (Art. 8(1)):
- a registry certificate obtained from the Central Registry Record System (MERSİS),
- the Matrix theme and sub-theme of the data, and a description of the data,
- the map sheets covered by the work area and, if the area is a military restricted or security zone, the relevant permit,
- a declaration of which of collecting, producing, sharing or selling will be carried out,
- the income or corporate tax return for the last financial period,
- the requested permit term (1 to 5 years),
- the address registered with the National Electronic Notification System (UETS),
- details of the staff and vehicles to be used on the project, and the criminal record certificates of the staff,
- a written declaration that measures are in place for the confidentiality, integrity, availability and security of the data and information systems,
- evidence of qualified staff: for country-wide or multi-province activity, at least one employee holding the GIS Specialist (Level 6) vocational qualification or a GIS degree; for one province or a smaller area, at least one employee holding the GIS Operator (Level 4 or 5) qualification or a GIS degree.
The last item is the one startups most often miss. If no one on the product team holds a GIS qualification, close that gap before applying.
Foreign companies must also upload originals and notarised translations of documents on their commercial activity in their home country, and notarised documents proving their undertakings with the persons or firms that will carry out their activities in Türkiye (Art. 8(3)).
Timeline: if a document is missing, a permit may be granted on condition that it is supplied within one month (Art. 8(4)). The Ministry notifies its decision within 30 days of the application; once an application is approved, the fee must be paid within 15 days or the application lapses (Art. 9(2)-(3)). The Ministry may also ask for additional work, of no more than six months, to bring the data into line with standards (Art. 9(6)).
How the fee is calculated
There is no flat fee for Turkish companies. The fee is the product of the coefficients in the schedules annexed to Law No. 7221, chosen by number of themes, work area, permit term and the net sales in the latest tax return, and the unit coefficient fee (Art. 14(1)). The unit coefficient fee was set at TRY 1,750 for 2024 and is increased every year by the revaluation rate announced under the Tax Procedure Law (Art. 14(5)-(6)). Separate rules set how net sales are determined for banks, leasing, factoring and financing companies, and insurers (Art. 14(2)-(3)).
Foreign natural and legal persons pay a different amount: 1,250 times the unit coefficient fee, multiplied by the term coefficient (Art. 14(7)). Turnover plays no role in that calculation.
If a permit is cancelled, or the company asks for cancellation, the fee is not refunded (Art. 12(2)).
Term, changes, suspension and cancellation
The permit is granted for 1 to 5 years, as requested and approved, and starts on the date the application is approved (Art. 10(1)). If the data, the work area or the term stated in the permit changes, a new application is required (Art. 10(2)).
The permit is suspended for breach of the permit contract, incomplete or incorrect information, or failure to record changes in staff qualifications, among other grounds, and the company has 60 days to cure (Art. 11). Failure to cure within that period, a finding contrary to national security, or failure to submit the activity status and metadata records 15 days before the permit expires are grounds for cancellation (Art. 12).
Reporting and data sharing with the Ministry
The permit holder has two recurring duties (Art. 13):
- file an activity report in the Ministry’s electronic system every 12 months,
- record the metadata (descriptive information) of the permitted data every 12 months, in line with the Metadata Definition Document.
In addition, before and after disasters and emergencies, the permit holder must share, at the Ministry’s request and free of charge, all geographic data it has worked on, with metadata, through OGC web service standards (WMS, WFS, WCS, WMTS, CSW and similar). If service-based sharing is technically impossible, it must give reasons. The sharing continues after the permit expires.
This duty shapes product architecture. A company that cannot expose its data through standard services may need significant engineering work to answer a request during a disaster.
The data protection angle
The regulation places on the Ministry the duty to protect personal data, confidentiality and security for the geographic data and metadata shared with it, and refers expressly to Law No. 6698 on the Protection of Personal Data (KVKK) and Cybersecurity Law No. 7545 (Art. 13(7)).
Companies have work to do as well. Location data linked to a person, such as address-matched personal information, vehicle locations or individual movement data, are personal data. Sharing them with the Ministry is a transfer under the KVKK. The likely legal basis is compliance with a legal obligation of the controller, but privacy notices and VERBİS records should be updated to reflect the transfer. The security declaration in the application (Art. 8(1)(ğ)) only means something if the technical and organisational measures behind it are real. See our KVKK compliance guide.
Administrative sanctions
Article 15 works step by step:
- If the Ministry finds unpermitted activity, it gives 15 days from notification to apply.
- A Turkish company that does not apply in time is fined the highest one-year permit fee for the year of the finding; a foreign company is fined twice the one-year permit fee.
- The fine may be paid, or challenged before the Ministry, within one month of notification; paying in time earns a 25% reduction.
- A company whose objection is rejected may apply to the competent administrative court within 30 days; the court’s decision is final.
- Unpaid final fines are collected by the tax office under Law No. 6183.
Paying the fine does not remove the permit obligation. If no application is made within 60 days of the fine being assessed, the next application is charged double the permit fee (Art. 15(6)-(7)).
A point for investments and acquisitions
The permit cannot be transferred to third parties (Art. 16(3)). A change of trade name or shareholders must be notified to the Ministry within 15 days, and the Ministry decides whether the permit continues or is cancelled (Art. 10(3), 16(1)).
The permit therefore belongs on the due diligence list when investing in or acquiring a company that works with geographic data. Because continuity after a share transfer depends on the Ministry’s decision, a buyer should cover the notification duty and the continuation of the permit in the share purchase agreement, as a post-closing covenant or a specific indemnity. See Mergers and Acquisitions.
Checklist for startups
- List the location data your product uses and map each item to a Matrix theme.
- Decide which of collecting, producing, sharing and selling your activity involves. If you only show your own branch addresses, you are exempt.
- Check that at least one team member holds a GIS qualification or degree.
- If you are newly incorporated, apply before you start so you can use the fee-free first year.
- Plan the infrastructure to serve your data through OGC-standard services.
- Update privacy notices and your VERBİS record to cover transfers to the Ministry.
- If you are a foreign company, notarise the undertaking with the local partner that will carry out your activities in Türkiye. See our International Desk.
- Put the 12-month activity report and metadata dates, and the final notice date 15 days before expiry, in the calendar.
Frequently asked questions
Is a permit obtained under the old regulations still valid?
Yes. Permits and licences issued under the two 2021 regulations remain valid until the end of their term.
We are a foreign SaaS company with no Turkish entity. Are we covered?
The regulation expressly covers legal entities not established in Türkiye. If you carry out commercial activity in Türkiye with data in scope, you need a permit, and the fee and fine are calculated differently from those for Turkish companies.
If we pay the fine, do we still need a permit?
Yes. The fine does not remove the obligation, and if you do not apply within 60 days the permit fee doubles.
How long is a permit valid?
Between 1 and 5 years; the applicant requests the term and the Ministry approves it.
Sources. Geographic Data Permits Regulation, Official Gazette 14.10.2026, No. 33400; Law No. 7221 on Geographic Information Systems and Amendments to Certain Laws; Law No. 6698 on the Protection of Personal Data.
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Hybrid Working Is Now in the Regulation: Article 9(2) of the Remote Working Regulation and What Contracts Must Say
September 27, 2026Türkiye's Age Verification Regulation for Social Networks: the e-Devlet Token, Rules for 15 to 17 Year Olds and the Deadlines
October 16, 2026Türkiye Extends Maternity Leave to 24 Weeks and Paternity Leave to 10 Days: What Employers Must Update (Law 7578)
October 15, 2026The EU Data Act for Turkish Companies: Connected Products, Cloud Switching and the September 2026 Design Deadline
October 15, 2026Türkiye Bans Social Media for Under-15s from 1 November 2026: What Platforms Must Change (Law 7578)
October 12, 2026Minimum Capital Deadline of 31 December 2026: What Turkish A.Ş. and Limited Companies Must Do (TCC Provisional Art. 15)
October 6, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →