KVKK and Translation: Practice in Türkiye

When you send an employment contract, an expert report or a personnel file out for translation, what you are doing is not merely placing a service order: you are handing a document containing personal data to another organisation. KVKK does not mention the translation process by name, but that process sits squarely in the middle of the processing activity the law defines.

Contents

This article explains what Personal Data Protection Law No. 6698 means for organisations that buy translation. How are the roles distributed, which documents carry risk, how did transfer abroad change in 2024, and what should you be looking for in your supplier contract?

The aim is not to produce a legal text; it is to put the person managing the translation process in a position to ask the right questions. The subject is less technical than it looks, and largely a matter of habit.

Where does KVKK sit in the translation process?

The law defines personal data as any information relating to an identified or identifiable natural person. The definition is broad: it covers not only names, addresses and identity numbers but also expressions that point to a person indirectly. Most of the documents sent out for translation carry at least one element that fits this definition.

The notion of processing is just as broad. Obtaining, recording, storing, transferring and erasing data each count as processing in their own right. Uploading a document to a translation agency’s portal is a transfer, keeping that document on a server is storage, and writing its sentences into a translation memory is recording. A single translation job generates several processing activities one after another.

For this reason the sentence “we are only having something translated” provides no legal exemption. Translation is a process in which a document containing personal data is handed to another organisation and processed there. How the process is documented matters as much as the process itself.

In practice, translation is one of the processes most often left out when organisations carry out their inventory work. Human resources, accounting and customer relations processes are recorded meticulously, yet the fact that the documents these processes generate go out for translation does not show up as a separate processing activity. And this is precisely where the document leaves the boundaries of the organisation.

Who is the data controller and who is the data processor?

The law defines two basic roles. The data controller is the party that determines the purposes and the means of processing. The data processor is the party that processes data on the controller’s behalf, on the authority the controller grants. In translation this distinction is usually clear: the organisation that sends the document is the controller, and the translation provider is the processor.

The practical consequence of the role is heavy. Most of the obligations – informing data subjects, having a lawful ground for processing, security measures, responding to applications from data subjects – rest with the data controller. Your supplier’s negligence does not release you from responsibility; selecting and auditing the supplier is itself part of your obligation.

In some cases the provider also processes the data for its own purposes. If it is feeding the translation memory into its own general pool, for instance, or using the texts to develop its services, it is no longer acting purely as a processor. Failing to draw that line in the contract is the gap most frequently found in practice.

What data do documents sent for translation contain?

Risk is measured by what a document contains, not by how long it is. The table below summarises the document types that most often go out for translation in organisations and the data categories they carry.

Document type	Typical personal data	Point to watch
Employment contract, personnel file	Name, identity and contact details, salary	Annexes may include a medical report
Discharge summary, medical report	Health data	Special category data; a stricter regime
Court petition, expert report	Details of parties, witnesses and third parties	Obtaining consent may be impossible in practice
Diploma, academic transcript, civil registry record	Identity and education details	Very common in the sworn translation flow
Customer list, system export	Bulk contact data	The impact of a leak would be wide
Product catalogue, marketing copy	Usually none	Low risk; the standard flow is enough

The purpose of the table is to establish a habit of classification. Two questions are enough before a document goes out: does it contain information belonging to a natural person, and does that information count as special category data? If your answer to the second question is yes, the process has to be set up differently.

Classification should not be left to the instincts of whoever is sending the document. The practical answer is a simple labelling system with two or three tiers: open, restricted and confidential. If the channel and the supplier to be used for each tier are written down in advance, there is nothing left to work out at the moment of decision. The process makes the decision, not the individual.

Transfer abroad: the framework that changed on 1 June 2024

Translation processes frequently carry a cross-border element: the server behind a cloud platform, a translator living where the target language is spoken, a partner agency abroad. Article 9 of Law No. 6698, which governs transfer abroad, was amended by Law No. 7499, and the new version came into force on 1 June 2024.

The new provision establishes a tiered structure. The first tier is an adequacy decision: where a country, sector or international organisation announced by the Board is involved, the transfer may rest on that. The second tier is appropriate safeguards; these include the standard contract published by the Board, binding corporate rules and undertakings. The third tier consists of exceptions that operate only in incidental cases.

If you choose the standard contract route, one further procedural obligation arises: the Board has to be notified within five business days of the contract being signed. Skipping this notification weakens the legal basis for the transfer.

The practical result is this: “our servers are in Europe” is not on its own evidence of compliance. Which tier you are relying on has to be demonstrable with documentation.

Under the old practice, the shortest route to a transfer abroad was to obtain explicit consent. In the new framework explicit consent sits on the third rung of the tiered structure: it is among the exceptions provided for incidental transfers, that is, transfers that are not continuous.

For translation the conclusion is clear. Turning to a specialist abroad once a year for a one-off document may count as incidental. But if you are uploading documents every month to a platform whose servers are abroad, that is a regular and systematic transfer, and explicit consent cannot be your only basis.

Explicit consent brings difficulties of its own. Consent is expected to be given freely, to relate to a specific matter and to rest on prior information; it can also be withdrawn at any time. Where consent is taken from employees, the free-will criterion is open to debate. And obtaining the consent of the witness named in a petition, or of the patient described in a report, is in most cases simply not possible.

So for regular processes the right design is not to collect consent but to build a structure resting on an appropriate safeguard. Consent should be thought of as a route kept in hand for exceptional jobs.

What should you look for in a supplier contract?

The relationship with a data processor cannot be established through a one-sentence confidentiality clause squeezed into the service agreement. At a minimum, the following headings are expected to be set down in writing:

The subject matter, duration and purpose of the processing, and the categories of data covered
Adherence to instructions: the provider processes the data only on your instructions
Notification of any use of subcontractors, made subject to your approval
Ownership of the translation memory and the termbase, and the limits on their use
Whether machine translation engines will be used
Retention period, and destruction or return at the end of the job
Breach notification: timescale, channel and point of contact
The right to audit and how the audit will work

Not all of these clauses appear in off-the-shelf contract templates; they have to be asked for. Which clause a provider objects to tells you more about that provider’s process than the contract itself does.

Beyond the contract there is also the matter of informing data subjects. If the information notices you give to your employees, your customers or applicants say nothing about translation services possibly being used and about data being transferred to a service provider in that context, the process remains incomplete on paper. In most organisations this is a gap that adding a single sentence will close.

The Türkiye context

A large part of the translation market in Türkiye runs through small agencies clustered around notaries and through freelance translators. The documents that circulate in the sworn translation flow – civil registry records, diplomas, powers of attorney, court judgments – almost all contain personal data. Even so, seeing a written data processing agreement in this flow is still the exception.

The second local feature is the communication channel. Documents are frequently sent through messaging apps or personal email accounts. These channels add speed but leave no trail: which document reached whom, and when, cannot be shown afterwards. The accountability the law asks for is precisely this traceability.

The third feature concerns the language itself. Turkish is an agglutinative language; once personal names take inflectional suffixes, separating them from the stem becomes harder. Automatic masking tools tend to miss more in Turkish texts than they do in English. Sending a document out in reliance on anonymisation is a riskier choice in Turkish.

What does this mean for you?

Compliance is not a layer of bureaucracy added on when you buy translation; it is one of the criteria for choosing a supplier. In most organisations the sequence below can be put in place with a few hours’ work:

List the document types that go out for translation and flag those that contain personal data.
Designate a single channel for these documents and take personal email and messaging apps out of use.
Ask your provider in writing about server location, machine translation policy and retention period.
If there is a cross-border element, document which transfer tier you are relying on.
Sign a data processor agreement, and do not skip the subcontractor and destruction clauses.
Once a year, test the process by tracing a delivered job backwards.

On jobs involving personal data we keep machine translation engines switched off by default, run the process within the country and, on request, destroy the documents after delivery. For an arrangement that fits your organisation’s workflow, get in touch; for a per-document price you can use the quotation form. Articles on related subjects are available in the knowledge centre.

This article is for general information only and does not constitute legal advice. For your specific situation, consult your legal adviser.

Frequently asked questions

Is a translation agency a data controller or a data processor?

The typical arrangement is this: the organisation that sends the document for translation is the data controller, and the translation provider is the data processor. This role can change if the provider starts using the data for its own purposes as well. The line has to be drawn clearly in the contract.

Does sending a document to a translator abroad count as a transfer?

Yes. A document reaching a person abroad, or a server located abroad, counts as a transfer. In that case you need a basis that fits the tiered structure in Article 9 of Law No. 6698.

Is obtaining explicit consent enough?

Under the framework that came into force on 1 June 2024, explicit consent is only among the exceptions provided for incidental transfers, that is, transfers that are not continuous. In a process that sends documents abroad on a regular basis it does not count as a basis on its own.

If I use the standard contract, do I have an additional obligation?

Yes. When the standard contract published by the Board is signed, the Board has to be notified within five business days of the date of signature. Skipping the notification weakens the basis for the transfer.

Sources

Pietrzak, P. & Kornacki, M. (2021). Using CAT Tools in Freelance Translation. Routledge, pp. 24–25.
Personal Data Protection Law No. 6698 and the amendments made by Law No. 7499 – mevzuat.gov.tr
Publications of the Personal Data Protection Authority – kvkk.gov.tr