Glossary · Regulation and data
What is a data processing agreement (DPA)?
A data processing agreement (DPA) is the contract between a company and the vendor that processes personal data on its behalf, setting out why, where, and with which safeguards the data is handled. It comes up when buying cloud software, payroll services, or hosting. It puts the shared security duty under KVKK in writing.
Last updated: · Author: Şevket Erer, Co-founder, AI Specialist
Why ask for a data processing agreement?
When a company entrusts customer records to a cloud CRM, payroll data to a service provider, or email to a hosting firm, the data starts being processed on someone else's system. Under KVKK, Turkey's data protection law, a controller whose data is processed by someone else on its behalf is jointly responsible with them for security measures. The agreement puts that shared responsibility in writing.
It is the text you turn to when something goes wrong. Who tells whom about a breach and when, whether data is returned or deleted when the contract ends, and whether subcontractors may be used are all settled in advance.
What does a data processing agreement contain?
A data processing agreement sets out which personal data is processed, for what purpose and for how long, and that the processor acts only on the controller's instructions. It also covers measures such as access control, encryption, backup and access logs, how and how fast a breach is reported, the country where data is kept, and the return or deletion of data when the agreement ends.
- Subject and purpose
Which personal data is processed, for what purpose, and for how long.
- Instructions
That the processor acts only on the controller's instructions.
- Security measures
Technical and organisational measures such as access control, encryption, backups, and access logs.
- Breach notification
How and how quickly the controller is told when a breach is detected.
- Location and transfer
Which country the data is kept in and, if it is transferred abroad, on what basis.
- Termination
Return or deletion of the data when the contract ends, and how that is documented.
An example
A private clinic decides to move patient appointments to cloud software. During the purchase it asks the vendor for a data processing agreement and looks closely at which country the data is kept in, whether backups are encrypted, and how data will be handed back at the end of the contract. Because the answers are written into the agreement, the clinic can show which document covers its obligations.
Which misconceptions about KVKK and data processing are common?
When buying cloud software, two beliefs about KVKK come up often: that data must always stay in Turkey, and that signing the agreement moves all responsibility to the vendor. Each item gives the common belief, what KVKK says, and the mevzuat.gov.tr link; for rules specific to your sector, ask your adviser.
Myth: KVKK always requires data to be kept in Turkey.
Fact: KVKK makes transfers abroad conditional: with a legal basis for processing and an adequacy decision for the destination, data may be transferred; without one, one of the safeguards listed in the Law is required (KVKK Article 9). Some specially regulated sectors may have their own in-country storage rules. KVKK Article 9
Myth: Once a data processing agreement is signed, the vendor carries all security responsibility.
Fact: Even when someone else processes the data, the controller is jointly responsible with them for taking security measures (KVKK Article 12(2)). The agreement writes down that shared duty; it does not remove it. KVKK Article 12
This page is general information, not legal advice; the regulations were last checked on 25 September 2026. Official text: Personal Data Protection Law (mevzuat.gov.tr), Personal Data Protection Authority (kvkk.gov.tr)
How it looks in Corex360
Corex360 runs in two ways: in a company-specific space on Corex360 Cloud or on your own server, and the choice is written into the agreement. Every sign-in, device, and access is logged. Personal data is processed under KVKK (Turkey's personal data protection law).
Terms often confused with it
| Data controller | The controller decides why and how data is processed; usually it is the company buying the software. The agreement records its instructions. |
|---|---|
| Data processor | The processor handles data on the controller's behalf and on its instructions; a cloud software vendor is the typical example. Most obligations in the agreement fall on it. |
Related terms: Data processor, Data controller, VERBİS (Turkey's data controllers registry)
FAQ
Does KVKK make a data processing agreement mandatory?
KVKK does not require a contract under that name. But because the controller shares responsibility for security measures with whoever processes data on its behalf, setting those measures out in a written agreement is common practice. In the European Union, GDPR requires such an agreement explicitly.
In a data processing agreement, is the cloud vendor a data controller?
Usually not. It processes data on its customer's behalf, so it is a processor. For data it handles for its own purposes, such as its customers' billing details, it is a controller.
What happens to the data when a data processing agreement ends?
As the agreement says: the data is returned to the controller, deleted, or both. How deletion will be documented should be in the agreement too.
Related questions
- Do you enter people's own data into VERBİS?
- No. The registry receives purposes, groups of people, data categories, recipient groups, transfers abroad, security measures and the maximum retention period (KVKK Article 16(3)). No customer's name or phone number goes into it.
Was this page useful?