Data Feudalism in Turkey: SaaS Lock-In, Marketplace Exit and Business Records (2026)

Short answer: Data feudalism describes how digital providers can create economic dependence by controlling access to records, users and technical infrastructure. Turkish law does not create a separate offence with that name. An international company should assess its SaaS contract, Law No. 6698, relevant consumer law and competition rules according to the actual dispute.

Have a general question about this article? Ask anonymously

This original English article is written for international businesses with suppliers or customers in Turkey, not as a literal translation of a Turkish-language piece.

Legal summary

A commercial problem, not a separate legal offence

Data feudalism is a metaphor for the economic dependency that develops when a platform controls access to a customer’s information, contacts, transactions and accumulated digital history. In Turkey it is not the name of a statutory offence or an independent lawsuit. An international company may legitimately choose one software provider for efficiency, but it should understand what happens to its records if the provider closes an account or changes the technical conditions. The resulting dispute can involve contractual duties, personal-data protection, intellectual property and, in some circumstances, competition law. These questions must be separated. A promise to return all company files may arise from the contract, while a natural person’s right to information about processing follows Law No. 6698. Referring to “platform servitude” does not establish either claim. Counsel should start with the agreement, the files held by the provider, the reason access stopped and the evidence showing the actual consequences.

Why overseas companies become dependent on a Turkish provider

A foreign-owned company may run its Turkish customer service, logistics scheduling and accounting through a local SaaS provider. Over time that platform can become the only searchable record of orders, warranty issues and communications. Staff may not know which information can be exported, or the provider may offer only an incomplete file format. Dependencies may also arise from unique account identifiers, integrated payment tools and connections to subcontractors. None of these characteristics is automatically prohibited. The commercial risk becomes serious when a service is interrupted and the business cannot demonstrate which contractual delivery obligation applies. A well-prepared agreement should therefore state what files will be returned, in which format, at what cost and during what period after termination. An international client should not confuse having paid a subscription with a guaranteed right to every part of a provider’s proprietary infrastructure. The entitlement depends on the agreement and applicable law.

An example from a Mersin import-export business

Consider an overseas trading company that imports equipment through Mersin and works with a Turkish logistics software provider. The system contains delivery documents, customs communications, records of vehicle arrival and phone numbers for individual employees. A payment dispute causes suspension of access. The company can no longer identify which shipments are delayed. The legal analysis should separate the alleged failure to pay, the provider’s suspension right, the agreement’s data-access provisions and the need to preserve commercial evidence. The employee contact details also raise personal-data duties. The trading company’s desire to export all records must not be assumed to justify unrestricted transfer of every person’s information to a new foreign contractor. The best first steps are to preserve the agreement, payment records, messages about the suspension and a list of indispensable files. A lawyer can then identify precise claims instead of characterising every service interruption as a data-protection violation.

Contractual performance and Article 112 of the Turkish Code of Obligations

The Turkish Code of Obligations contains general rules on performance, non-performance and responsibility. Article 112 addresses the debtor’s liability where an obligation is not performed properly, subject to the applicable conditions. Whether a SaaS provider has failed to perform cannot be decided without reading the contract, the agreed service level, termination clauses and any legally relevant excuses. A service may have been suspended pursuant to a valid contractual mechanism, or the provider may have refused a specific agreed export despite payment and timely request. Those are different factual cases. The client should specify the obligation, the actual breach and the resulting loss. An asserted amount of business interruption damages is not automatically recoverable simply because it is large. Evidence about orders, alternative arrangements, correspondence and causation becomes essential. Contract analysis should not be replaced by an imprecise claim that “the customer owns the platform’s data.”

Article 11 KVKK gives individuals defined rights

Law No. 6698 Article 11 lets a natural person learn whether their personal data are processed, request information about that processing, learn its purpose and recipients, correct inaccurate records and request deletion or destruction when Article 7 permits. These rights do not provide a corporation with an unrestricted entitlement to export an entire commercial database. A customer relationship management file may contain both business information and identifiable customer or employee records. A company seeking its commercial documents should identify its contractual right and also protect the individuals whose data are included. Conversely, the service provider cannot dismiss a valid individual’s access request merely by saying that the relevant information is held in a commercial application. The correct procedure depends on who is making the request and what material is being requested. A private individual’s application under Article 13 differs from a merchant’s formal demand to restore access to paid software.

A crucial difference from GDPR data portability

Article 20 of the European Union’s General Data Protection Regulation provides a defined data-portability right in specified circumstances. Turkish Law No. 6698 Article 11 does not establish an identical, general right with the same wording and technical conditions. This matters for businesses that have copied European policy documents into their Turkish operations. A provider may voluntarily offer an export function, or a contract may require it, but that practical ability should not be presented as an unconditional entitlement under Article 11. The GDPR may apply to certain cross-border operations under its own conditions, and that assessment is separate. An overseas company operating in Turkey should map which individual data-subject rights apply and which commercial rights arise from its SaaS agreement. Treating them as interchangeable may lead to demands that a Turkish authority cannot address, while more precise contractual claims are overlooked.

The hidden importance of export formats

A clause stating “customer data will be returned” does not necessarily answer whether the return will include attachments, timestamps, unique identifiers, linked records or an intelligible version of the original file structure. A provider may supply a PDF summary where the client needs machine-readable transaction histories. An exit schedule should therefore describe the agreed categories of files, the technical format, the completeness checks and the method of secure delivery. It should also identify who pays for a migration service and whether assistance is required to convert specialist software data. None of this can be inferred reliably from general privacy obligations alone. During procurement the client can ask for a small trial export and verify it in an independent environment. This practical test is often more valuable than a marketing statement promising “full ownership.” An export that cannot be reconciled with original records may leave the business dependent even after nominal data delivery.

Account suspension and the right to be heard

A platform may reserve rights to suspend accounts for unpaid fees, security events or specified breaches of terms. The legal significance of a particular suspension depends on the text of the contract and the circumstances of its exercise. The user’s ability to retrieve documents during a dispute should not be assumed unless an applicable rule or agreement supports it. For consumer relationships, statutory protections may apply; for commercial services, the relevant contractual provisions and general law must be considered. The client should preserve notices of default, the provider’s instructions for appealing and any offered export methods. If an account closure also triggers an exclusively automated adverse result for a natural person, Article 11(1)(g) KVKK may require separate examination. Not every business access restriction, however, is an automated personal decision. Mixing these claims without factual differentiation reduces the clarity of the legal request.

Consumer unfair terms under Law No. 6502 Article 5

Article 5 of Turkey’s Law No. 6502 addresses unfair terms in consumer contracts. A term imposed without individual negotiation that creates an imbalance against the consumer contrary to good faith can be scrutinised under the statutory criteria. But an international merchant contracting for its trading operations is not automatically a consumer in that relationship. Corporate B2B disputes require separate analysis. It would therefore be inaccurate to tell every commercial SaaS customer that all suspension or data-access clauses are void under consumer law. Even in a consumer transaction the result depends on the exact wording, negotiating circumstances and nature of the service. Evidence about which version of the terms was accepted and how changes were notified is important. The distinction illustrates why the label “data feudalism” cannot substitute for the careful classification of the parties.

Dominance, switching costs and Competition Law No. 4054

Digital switching costs can arise from network effects, incompatible data formats and commercial reliance on a platform’s customer reach. These may be economically relevant to market power. Article 6 of Competition Law No. 4054 prohibits abuse of a dominant position, not the existence of a popular or successful business. A meaningful analysis requires a relevant market, the platform’s position and the specific allegedly abusive conduct. A customer’s inability to migrate cheaply does not automatically establish a competition infringement. Nevertheless, restrictive access arrangements or exclusionary practices may warrant review when market conditions and evidence support a concern. If merchants allege that a platform used their confidential sales data to compete with them, that is a different question from the natural person’s request for an incorrect profile to be corrected. Different authorities and remedies apply. The commercial complaint should be documented with real contractual and market facts rather than a speculative allegation.

What if the software provider operates from abroad?

Many Turkish businesses buy customer relationship software from a provider based overseas. If identifiable information is transferred from Turkey abroad, the amended Article 9 of Law No. 6698 should be examined. The updated framework, effective from 1 June 2024, contains adequacy decisions, specified safeguards and limited exceptions. Standard contractual clauses may serve as a safeguard subject to conditions, including a notification duty under Article 9(5) within five business days following execution. A generic provision that “global group companies may access data” does not by itself establish compliance. The business needs to identify actual locations, recipients, subcontractors and technical access routes. A migration from one overseas SaaS vendor to another may itself change the receiving parties or storage regions. Exporting files for commercial convenience does not automatically remove international transfer obligations. The company should document the new processing arrangement before moving the information.

Data security when moving to a new provider

Article 12 KVKK requires necessary technical and administrative safeguards against unlawful processing, access and failures to protect personal data. A migration is a particularly vulnerable moment because multiple systems, employees and subcontractors may temporarily gain access. The business should minimise exports, restrict permissions, use secure channels, verify file integrity and monitor whether temporary copies remain in development environments. Technical success does not alone prove legal compliance. The new provider’s processing purpose, contractual instructions and retention period should be clear. If files include employee and customer information, the client should review whether a person must be informed or another legal condition is relevant. A service agreement should also specify what happens if the migration is cancelled. An unencrypted spreadsheet left in a shared folder creates a risk that is unrelated to the economic merits of a dispute over platform access.

Retention and deletion after termination

Closing a commercial account does not necessarily mean that every related record must disappear immediately. The relevant controller may have continuing lawful retention obligations for particular transaction or legal records. Article 7 KVKK governs deletion, destruction or anonymisation when the reasons for processing cease. The company should distinguish records still justified from information kept only because it is easy to retain. An exit process should include disabling old access rights, documenting the return of agreed business records, identifying remaining lawful copies and specifying when unnecessary information is removed. Backup arrangements should not be ignored. Equally, a provider should not promise complete destruction when an applicable legal requirement necessitates retention of particular records. Clear classification and an audit trail help protect both the business and the individuals concerned. A contractual “data return” clause is strongest when accompanied by a workable end-of-service checklist.

Evidence collection without creating another privacy violation

In a dispute, preserve the operative contract, agreed export conditions, pricing amendments, account suspension notices, invoices, support correspondence and screenshots identifying inaccessible records. Maintain the original dates and document how the evidence was obtained. Do not publish customer spreadsheets or other individuals’ personal information on social media to demonstrate that the provider is holding files. If sensitive records must be included in a formal claim, appropriate redaction and confidentiality precautions should be considered. To show actual loss from interrupted services, the business may need reliable records of cancelled shipments, missed orders or the cost of reasonable alternatives. The claimant should identify which loss follows from the provider’s alleged contractual failure. Vague forecasts are not equivalent to documented damages. Legal strategy improves when evidence connects a definite obligation, a specific failure and a measurable consequence.

Practical procurement questions before signing

An international company procuring a digital service for its Turkish operation can reduce future dependency by asking direct questions before the agreement is signed. What data categories will the provider store? Can the customer retrieve records in a common machine-readable format? Does the export include attachments and identifiers? How long will access remain possible after lawful termination? Are migration fees fixed or measurable? Where are backups and subcontractors located? What happens when a service is suspended for an invoice dispute? How are personal data requests routed, and who will respond within the Turkish statutory deadline? Are deletion confirmations available? Not every answer has to be the same for all services. The important point is to incorporate the actual commercial requirements into the contract and test them. A business should not discover at the end of a multi-year relationship that its only operational archive is effectively inaccessible.

Legal pathways must remain distinct

A natural person alleging a personal-data violation can consider the Article 13 application to the controller and Article 14 complaint mechanism. A consumer challenging an unfair contractual clause may need to assess Law No. 6502 and the applicable dispute forum. A company seeking contractual performance or compensation must identify the terms and applicable provisions of the law of obligations. A potential competition complaint requires market and conduct evidence under Law No. 4054. These routes do not provide identical remedies, and an administrative complaint is not automatically a claim for commercial losses. The decision must account for the nature of the claimant, the processing or contractual conduct and the evidence available. Overseas parties should also review governing law, jurisdiction and documentary formalities when a foreign entity is involved. The broad phenomenon of data dependency becomes legally manageable once divided into separate questions with separate legal grounds.

A measured approach to future platform dependence

A platform may improve efficiency and reduce costs while also increasing a customer’s dependence on its infrastructure. Neither outcome establishes wrongdoing on its own. The objective for policymakers, businesses and customers is to preserve meaningful legal rights and contractual clarity. For the Turkish operation of an overseas company, that means testing exit procedures, knowing which data rights belong to individuals, checking privacy duties before transfer and maintaining an inventory of critical information. Board decisions should identify the business impact of losing access and the time needed for recovery. The legal department should not advertise a general absolute “ownership of all data” where law and contracts provide more specific entitlements. Accurate categorisation of records, documented negotiations and preserved evidence offer a more reliable basis for dispute resolution than rhetorical descriptions of technological power.

Related legal analysis on our website

• Turkish SaaS provider locks a company out: recovering commercial records
• Data monarchy in Turkey: digital profiles and customer rights
• Turkish legal analysis: Veri Feodalizmi

Official sources

• Turkish authority: rights of the data subject
• Turkish authority: cross-border personal-data transfers
• European Union GDPR (comparison, where applicable)

Frequently asked questions

1. Is data feudalism a crime in Turkey?

No. It is an economic metaphor, not a separately named statutory offence.

2. Can a business force every provider to export its database?

Rights depend on the contract and applicable law; there is no universal unconditional data export entitlement.

3. Does KVKK Article 11 give a company all its commercial records?

No. Article 11 establishes defined rights for natural persons concerning personal data.

4. Is GDPR portability the same as KVKK access?

No. GDPR Article 20 and Turkish KVKK Article 11 are not identical rights.

5. May a SaaS provider suspend an account?

The contract, circumstances, applicable law and specific obligations must be assessed.

6. Do all unfair terms fall under Law No. 6502?

Article 5 primarily concerns consumer contracts; commercial relationships require separate examination.

7. Does platform lock-in prove abuse of dominance?

No. Article 6 requires an analysis of the relevant market, position and conduct.

8. What if the provider is outside Turkey?

Actual international personal-data transfers may be subject to the revised KVKK Article 9.

9. Must all data be deleted after termination?

Deletion depends on Article 7 and any continuing lawful retention requirements.

10. What export details belong in a SaaS contract?

Specify file categories, format, timing, cost, completeness checks and security.

11. How soon must a controller answer an individual?

Article 13 requires a reply as soon as possible, no later than thirty days.

12. Should evidence include customer records?

Only as lawful and necessary; protect third-party personal information and confidentiality.