Regulation
Regulators want systems kept in-country
Turkish financial and public-sector rules require systems that process customer and citizen data to be located in Türkiye. In healthcare and energy, keeping data and recordings in-country eases the compliance burden. These are the provisions that come up most often:
Banks
BDDK (Banking Regulation and Supervision Agency) — Regulation on Banks’ Information Systems and Electronic Banking Services, Art. 25 and Art. 29
Requires primary and secondary systems to be located in Türkiye. Sets conditions on outsourcing and cloud use; for primary and secondary systems, cloud is limited to hardware and software resources dedicated to a single bank.
Payment and e-money institutions
TCMB (Central Bank of the Republic of Türkiye) — Communiqué on the Information Systems of Payment and Electronic Money Institutions, Art. 16/7 and Art. 21
Limits cloud services that process personal data to a private cloud dedicated to the institution or a community cloud approved by the Central Bank. Requires primary and secondary systems and backup centres to be in Türkiye.
Capital markets
SPK (Capital Markets Board) — Communiqué on Information Systems Management (VII-128.10), Art. 27/1
Requires primary and secondary systems to be located in Türkiye.
Public institutions and municipalities
Information and Communication Security Guide (Presidential Circular 2019/12), measures 3.2.7.2 and 4.3.1.1
Critical data must not be stored in cloud services other than the institution’s own systems or providers based in Türkiye under the institution’s control, and it must be guaranteed that such data is not hosted abroad.
Healthcare
KVKK (Turkish Personal Data Protection Law) Art. 6 and Art. 9 (2024 amendment)
Health data is a special category of personal data. Transfers abroad require an adequacy decision or appropriate safeguards, and standard contracts must be notified to the Authority within 5 business days of signing. When data is processed in Türkiye, these transfer steps do not apply.
Electricity distribution
EPDK (Energy Market Regulatory Authority) — call centre procedures and principles under Board Decision No. 9807, Art. 5
Requires distribution companies’ call centres to record calls, to time-stamp records used for reporting, and to keep recordings directly accessible for 1 year and in backup for 5 years.
Xaly.ai on-premise can be deployed in a way that meets the in-country requirements of these provisions: the whole system runs on your server in Türkiye and call data does not leave your organisation.
This summary is for information only; it is not legal advice or a compliance certificate. Compliance is assessed through your organisation’s own process, and the current text of each regulation should be checked against the issuing authority’s publication.