Part of our KVKK Compliance Guide: Open the guide →
What is a Data Protection Officer (DPO)?
A Data Protection Officer is the person a company designates to monitor its data protection compliance, advise the business and act as the contact point for regulators and data subjects. The role comes from Articles 37 to 39 of the GDPR, which also make it mandatory for public authorities, for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for organisations processing special categories of data or criminal conviction data on a large scale; EU or member state law can add further cases. An ad-tech platform profiling users, a health app and a workforce monitoring tool are all typical mandatory cases. Turkish law has no DPO: under KVKK, registered controllers name a contact person in VERBİS instead, so appointing a GDPR-style DPO in Türkiye is good practice rather than a legal requirement.
The DPO can be an employee or an external provider, may serve a whole group of companies, and must be given independence: no instructions on how to do the job, no dismissal for doing it, and a direct line to the highest level of management. What the GDPR does not require is a lawyer or an engineer specifically; it asks for expert knowledge of data protection law and practice, judged against the sensitivity of the processing.
The Türkiye picture: there is no Turkish DPO
The point most teams miss is that Turkish law has no equivalent institution. The KVKK regime works with different building blocks: registration with VERBİS, a contact person notified through the registry, and for foreign controllers a data controller representative in Türkiye. The contact person is an administrative liaison, not an independent compliance officer, and appointing a GDPR-style DPO in Türkiye is good practice rather than a legal duty. The Turkish authority runs a certification programme under a communiqué of 6 December 2021 whose holders may use the title “veri koruma görevlisi” (data protection officer), but the title is not the GDPR role and creates no statutory duty or power.
| Issue | GDPR DPO | KVKK equivalents |
|---|---|---|
| Legal basis | GDPR Arts. 37-39, mandatory in defined cases | No DPO institution; VERBİS registration and contact person |
| Independence | Protected by statute | Not regulated |
| Foreign companies | EU representative where Art. 27 applies | Data controller representative for foreign controllers |
| Certification | Not required | Voluntary personnel certification scheme |
A Turkish startup selling into the EU therefore often ends up with three hats at once: a DPO if its processing meets the GDPR thresholds, an EU representative if it has no EU establishment, and a VERBİS registration with a contact person at home. The three roles answer to different regulators and cannot be collapsed into one appointment without checking each rulebook.
Whether a Turkish business needs a GDPR DPO, a KVKK contact person, or both, is usually the first question we settle in KVKK and GDPR compliance work.
Does every company processing personal data need a DPO?
No. Outside the public sector, the duty turns on core activities involving large-scale systematic monitoring or large-scale special category data. A SaaS company with ordinary customer data usually sits outside the mandatory zone, though many appoint one voluntarily because enterprise customers ask for it in vendor reviews.
Can the DPO be outsourced or shared?
Yes. The GDPR allows an external DPO under a service contract and a single DPO for a corporate group, provided the person remains reachable from each establishment and genuinely available. What the role cannot survive is a conflict of interest, so the CTO or the head of marketing deciding the purposes of processing cannot double as DPO.
Sources. Regulation (EU) 2016/679 (GDPR) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.