Under KVKK, the difference between the cloud and your own server is less about where personal data physically sits and more about who processes it, who accesses it, and where it is transferred. Turkey's Personal Data Protection Law No. 6698 treats the company that decides the purposes and means of processing as the data controller, whichever server it chooses. That is where the accounting manager's question comes from: what changes if payroll and customer data sit in the cloud, and what changes if they sit on our own server. This article is general information, not legal advice; consult your legal adviser about your own situation. The current text of the law is published in Turkey's official legislation database, and the Board's decisions and guides on the Personal Data Protection Authority website.
01.Does KVKK require data localisation?
As a general rule KVKK does not require data to be kept in Turkey or on the company's own server; it does make the transfer of personal data abroad subject to separate conditions.
Data localisation means keeping data within the borders of a given country. KVKK's focus lies elsewhere: on what legal ground data is processed, whether the person has been informed, how the data is protected, and to whom it is transferred. If the cloud provider's servers are abroad, the data may count as transferred to that country, and that transfer is subject to the law's separate conditions. With the amendment that took effect in 2024, transfers abroad moved to a tiered order: first an adequacy decision by the Board; if there is none, appropriate safeguards such as standard contracts or binding corporate rules; and if those are missing too, limited incidental cases. Explicit consent can now serve as a basis only at this last tier.
Example scenario: Picture a furniture maker in Kayseri. It is not in a specially regulated sector such as banking or payment services. For it, the real question is not "cloud or own server" but "where is the provider's server, and who can see the data". In some sectors, separate regulations may require data to be kept in the country; check the rules specific to your sector separately.
That is why data localisation is not a decision criterion on its own. Data held on a server in Turkey that anyone can access may carry more risk than well-protected data elsewhere. Location is only one part of protection.
02.In the cloud, who is the controller and who is the processor?
Your company, which decides the purposes and means of processing, is the data controller; the cloud provider delivering the service is usually the processor acting on your behalf.
Moving data to the cloud does not hand responsibility to the provider. When the accounting manager uploads payroll to a cloud HR tool, the payroll is still the company's responsibility. When there is a leak, the employee asks the employer first.
The law holds the data controller jointly responsible with the party processing data on its behalf for security measures; to draw the line of that shared responsibility, a written agreement with the processor is recommended. Such an agreement states for what purpose and with which security measures the provider processes the data, and what happens to the data when the contract ends. Without it, where responsibility starts and ends stays unclear.
How the data comes back when you want to change provider is also a matter for this agreement; otherwise the data may stay with a provider whose contract has ended.
You should also ask whether the cloud software uses other sub-processors. The application may sit with one firm, the backup with another, and email sending with yet another; every stop the data passes through should be visible in the contract.
03.Does your own server reduce responsibility?
On your own server, KVKK responsibility stays the same size and changes hands: the cross-border transfer question may get simpler, but every security measure passes to your own team.
| Topic | Cloud | Own server |
|---|---|---|
| Data controller | Your company; the provider is usually the processor acting on your behalf | Your company |
| Transfer abroad | If the server is abroad, the data may count as transferred and falls under separate conditions | If the data does not leave the country, this question can get simpler |
| Security measures | You share responsibility with the processor; a written agreement draws the line | All of them move to your own team |
| First question to ask | Which country holds the data, who can access it, how is it handed back when the contract ends? | Who sees which record, is access logged, where is the backup kept? |
The law expects the data controller to take technical and administrative measures to ensure an appropriate level of security. On your own server all of these measures are yours: who sees which record, whether access is logged, where the backup goes, and when patches are applied.
Example scenario: Picture a construction firm's office. The server is in a cabinet under the stairs, and the backup is on an external disk in the same cabinet. Everyone can see the staff files because permissions have never been defined. The data never leaves the country, yet nobody could call it protected.
The real advantage of your own server is visible control: you see directly who enters the server and where the backup sits. That advantage only works if the measures are written down and checked regularly. So the first job of a company moving to its own server is writing the permission table: which role sees which record, who can export, and who can delete.
04.Which questions should you ask the provider?
The key questions for a cloud provider: which country and whose infrastructure the data sits on, where the backup goes, who has access, whether access is logged, and how the data is handed back when the contract ends.
- Which country and whose infrastructure do the database and files sit on?
- If the data is abroad, what is the transfer based on, for example a standard contract?
- Where does the backup go, is it encrypted, and has a restore been tested?
- In what cases can the provider's staff access the data, and is that access logged?
- Are the data processing agreement and the privacy notice ready at setup?
- If the contract ends, in what format and how is the data handed back?
- If there is a breach, how and when will you be told?
The last question looks minor, but it is not. The law requires the data controller to notify the Personal Data Protection Board and the people affected when a breach occurs. If the provider tells you late, you cannot meet that duty in time, so how you are notified should be written into the contract. Ask the list at the buying stage, not after the contract is signed. Ask for the answers in writing; a verbal assurance is not a document you can show in an inspection or in response to a request.
05.Where are notices, consent, and data subject requests handled?
Whatever the hosting, people are informed, explicit consent is obtained where required, and a data subject's request is answered and logged.
Informing means telling people which data is processed, for what purpose, and to whom it may be transferred. Explicit consent is not needed for every kind of processing; if another legal ground in the law applies, consent may not be required. The duty to register with the Data Controllers' Registry (VERBİS) also depends on the company's situation, not on where the data is hosted, and exemptions exist.
When a customer asks which of their data was kept for an old campaign, and answering means searching several separate systems, the problem is scatter more than hosting. When the data sits on one record, the request is answered from one place too. Which job to start the tidy-up with is the subject of our piece on digitalisation in small businesses.
What a data subject asks for is often simple: which of my data is kept, why, and with whom it was shared. Across scattered systems, answering these questions can turn into a search that takes days.
| What the law asks | What Corex360 has | What stays with you |
|---|---|---|
| Technical and administrative measures for an appropriate level of security (KVKK Art. 12(1)) | Access is role-based; each user sees only the records within their role. Corex360 Security records logins, devices, and access. | Defining roles, closing access for people who leave, carrying out internal checks (Art. 12(3)). |
| The conditions of Art. 9 for transfers abroad | Hosting is a dedicated space in Corex360 Cloud or your own server; the choice is written into the contract. In the cloud, prompts written to X AI go to the AI provider you choose; in an on-premise installation X AI works with a local model. | Setting the legal basis for any transfer and choosing the AI provider accordingly. |
| The data subject's right to request information (Art. 11(1)) | The modules use the same customer record; a person's messages, quotes, and contracts sit on the same card. | Receiving the request, answering it in time, and recording the answer. |
| Registration with the Data Controllers' Registry (Art. 16) | No counterpart; registration is the business's task, not the software's. | Checking exemption status against decisions on kvkk.gov.tr and registering if required. |
06.Where does data live in Corex360?
In Corex360 the choice is yours: a company-specific space on Corex360 Cloud or your own server; the same security layer runs in both cases.
In Corex360 sign-ins, devices, downloads, and permission changes are logged, and access is role-based. Personal data is processed under KVKK (Turkey's personal data protection law). All of these facts are set out on the Corex360 security and KVKK page.
Access is role-based; only those whose role allows it see payroll and personal data. Export formats and how data is handed over when the contract ends should be added to the questions for the vendor. If your corporate policy requires keeping data on your own infrastructure, the details are on the running on your own server page. Bring the questions on where data is kept, who can access it, and how it is handed over to the demo, and we will write down the answers for your situation together.
Ask these questions for both Corex360 Cloud and the own-server option; in both cases the answers should be in writing.
Sources
- Personal Data Protection Authority, Board decisions Last checked
How was this page prepared?
- Written by: Şevket Erer, Co-founder, AI Specialist
- Sources: legislation, official body, and vendor information is taken from the primary sources in the Sources list on this page; each source shows the date it was last checked.
- Product information: sentences about Corex360 rest on the company's product fact records; unconfirmed features are not written.
- Use of AI: the Corex360 team writes the text; AI tools are used for drafting and translation. Publishing principles
- Dates: first published , last updated . Corrections policy
Frequently asked
01Under KVKK, what is the difference between cloud and own server?
The difference is less about the data's physical location and more about who processes it, who accesses it, and where it is transferred. In both cases the company that decides the purposes and means of processing is the data controller. This answer is not legal advice.
02Does KVKK require data to be kept in Turkey?
As a general rule, no; but transferring personal data abroad is subject to separate conditions in the law. In some sectors, such as banking and payment services, separate regulations may require data to be stored in the country.
03Does the cloud provider become the data controller?
Usually not. In most cases the provider is a processor acting on your behalf, and you remain the controller. That is why a written data processing agreement with the provider is recommended.
04How long can personal data be kept?
The law requires personal data to be erased, destroyed, or anonymised once the purpose of processing is gone; the period is set by the relevant legislation and the purpose of processing. This answer is not legal advice.
05How is data transferred to a cloud provider abroad?
Since the amendment that took effect in 2024, transfers abroad follow a tiered order: first an adequacy decision by the Board, and failing that, appropriate safeguards such as standard contracts or binding corporate rules. If neither exists, a transfer is possible only in limited incidental cases, and explicit consent can serve as a basis only at this last tier. This answer is not legal advice.
We listen to your business with a few short questions and prepare a live online demo with your channels.
Related articles
Keep reading.
On-premise CRM runs on the company's own server. Setup and updates then need a named owner, and security does not come by itself with the hardware.
DateRead the article01Business intelligenceWhat is a KPI dashboard? The first screen a manager opens in the morning
A KPI dashboard shows where a company stands against its goals, with thresholds and owners on one screen. Many get ignored over time, for reasons you can avoid.
DateRead the article02Business intelligenceManagement report or decision screen: where the Excel report stops
A management report sums up a period for whoever decides; an Excel report freezes the moment it is made. Excel still does some of those jobs well.
DateRead the article03AssistantWhat an AI assistant in a CRM does, and what it does not
An AI assistant in a CRM reads, summarises, drafts, and follows up; the decision stays with you. Ask about the risk of wrong answers before you choose one.
DateRead the article04AssistantWhat is a rule engine in business processes: reminders, assignment, approval
A rule engine turns work held in memory into a written rule: trigger, condition, action. In a sales office, some work fits a rule and approval stays.
DateRead the article05DocumentsWhat is a document management system? Tying files to the customer record
A document management system stores files, makes them findable, and ties access to permission. A shared folder falls short once files belong to customers.
DateRead the article06DocumentsHow to keep a contract archive (contract repository): signed documents, dates, and access
A contract archive stores the signed contract, annexes, and dates with logged access. Wet and e-signatures, file naming, notice dates, and access.
DateRead the article07DigitalisationBuying business software with KOSGEB digital transformation support: who qualifies, what it asks
KOSGEB digital transformation support covers loan interest for small and medium manufacturers buying software and machinery. Criteria, report, steps, mistakes.
DateRead the article08