Outsourcing Software from Turkey: KVKK Transfer Rules, EUR Costs and Overlap

A Turkish company can use an offshore software team, but under KVKK the transfer needs a legal route: since the 2024 amendments, that is usually the Board's standard contract, notified to the Authority within 5 business days of signing. A first web product costs roughly EUR 13,300 to 53,900, about TRY 0.74 to 3.0 million. A Dhaka team shares 6 working hours with Istanbul.

This guide is for founders, CTOs and operations leads in Turkey who are deciding whether to build a web product with an outside team, and who have been told that KVKK (Kişisel Verilerin Korunması Kanunu, Law No. 6698 on the Protection of Personal Data) makes that complicated. It explains what changed in 2024, what a vendor contract needs, and what the work costs. RAITHub is a software studio in Dhaka, Bangladesh. It has no office in Turkey and delivers in English only: specs, calls, code review and documentation are all in English, and it does not work in Turkish. It builds web apps and progressive web apps, not native mobile apps.

What changed in KVKK's cross-border transfer rules in 2024?

This section is general information, not legal advice. Confirm how it applies to you with your adviser and the Personal Data Protection Authority (KVKK).

Before 2024, Article 9 in practice meant one of two things for most companies: the explicit consent of each person, or a Board permission that was slow to obtain. Law No. 7499 rewrote the article, with the amendment dated 2 March 2024 in the Authority's English text of Law No. 6698. The Authority's transfer abroad page gives 1 June 2024 as the start of the new framework, and a provisional article kept the old first paragraph running alongside it until 1 September 2024. The new Article 9 works in three tiers:

Tier	What the amended Article 9 says	Fit for hiring a software vendor abroad
1. Adequacy decision	Transfer is allowed where the Board has issued an adequacy decision for the country, a sector in it, or an international organisation	We found no adequacy decision covering Bangladesh; check the Authority's current announcements
2. Appropriate safeguards	Without adequacy: a public-body agreement with Board approval, binding corporate rules, a standard contract published by the Board, or a written commitment approved by the Board, provided data subjects keep enforceable rights and effective remedies	The standard contract is the practical route for most vendor relationships
3. Incidental transfers	Only in listed cases, such as explicit consent after being told the risks, or where the transfer is needed to perform a contract with the person	Meant for occasional transfers; ask your adviser before relying on it for an ongoing build

In every tier, the law still requires one of the ordinary processing conditions in Articles 5 and 6 to be met. The transfer route is on top of your lawful basis for processing, not instead of it.

Which standard contract applies when you hire an offshore developer?

The Board publishes four templates on its standard contracts page: controller to controller, controller to processor, processor to processor, and processor to controller. When your company decides why and how customer data is used and the vendor only builds and supports the system on your instructions, the relationship usually looks like controller to processor. If your company is itself a processor for a client, for example a Turkish SaaS provider serving other businesses, the processor-to-processor template may be the relevant one. Which role each party plays is a legal judgement, so settle it with your adviser before choosing a template.

Under Article 9(4)(c), the contract has to carry information such as data categories, transfer purposes, recipients, the technical and organisational measures the importer will take, and extra measures for special categories of data. Use the published text as the Board issued it, and ask your adviser what, if anything, may be completed or adjusted.

How does the five-business-day notification work?

Article 9(5), in the Authority's translation, reads: "The standard contract shall be notified to the Authority by the data controller or data processor within five business days following its signature." The Authority runs a standard contract notification portal for these filings, and it states that the parties may specify in the contract which of them will carry out the notification. Missing the notice has a price: Article 18(1)(d), added by Law No. 7499, sets an administrative fine of TRY 50,000 to 1,000,000 for failing to notify. Fine amounts in Turkish law are updated periodically, so check the current figure with your adviser.

The practical risk is ordinary: a contract gets signed on a Thursday before a public holiday, nobody owns the filing, and the window closes. A small piece of code in your contracts or vendor register can flag the deadline:

// Deadline for notifying a KVKK standard contract: five business days after signature.
// Weekends are skipped. Turkish public holidays must be supplied, since religious
// holidays move each year. How the Authority counts the days is for your adviser.
export function notificationDeadline(signedOn: string, holidays: Set<string>): string {
  const d = new Date(signedOn + 'T00:00:00Z')
  let counted = 0
  while (counted < 5) {
    d.setUTCDate(d.getUTCDate() + 1)
    const weekday = d.getUTCDay() // 0 = Sunday, 6 = Saturday
    const iso = d.toISOString().slice(0, 10)
    if (weekday !== 0 && weekday !== 6 && !holidays.has(iso)) counted++
  }
  return d.toISOString().slice(0, 10)
}

notificationDeadline('2027-03-05', new Set()) // signed Friday: '2027-03-12'

Treat the output as a reminder date, not a legal calculation. The safer habit is to file on the day of signing.

Does hosting abroad count as a transfer too?

Often it does, and it is easy to forget. Many Turkish products already run on cloud regions outside Turkey, and email, analytics, error tracking and support tools frequently store data abroad as well. Each of those flows needs its own route under Article 9, separate from the development vendor. Ask your adviser to map them in one pass, so the vendor contract is not the only transfer you have papered.

From an engineering point of view, you can shrink what an offshore team ever sees:

• Production stays in your account. The cloud subscription, database and domain are yours; the vendor deploys through a pipeline you can switch off.
• Fake data outside production. Development and staging run on generated records, so a normal working day involves no real personal data at all.
• Named, logged access for incidents. If someone has to look at production, you approve it for a set time and the access is recorded. Designing a SaaS audit log explains what to capture.
• Deletion and export built in. KVKK gives people rights over their data, so a clean way to find, export and erase one person's records saves manual work later.

Whether this design removes the need for a transfer mechanism in your case is a legal question, not an engineering one. It does reduce the data at stake, which helps whatever the answer is.

What does an offshore web project cost a Turkish company?

Most Turkish buyers of outsourced work compare quotes in euros or dollars, because the lira moves quickly. Rates below are converted at USD 1 = EUR 0.8824 and EUR 1 = TRY 55.55, the rates Wise's USD to EUR and EUR to TRY converters showed on 1 October 2026. Lira figures will drift faster than euro ones.

Benchmark	USD per hour	EUR per hour	TRY per hour (rounded)
Most software companies listed on Clutch	$24 to $49	EUR 21.2 to 43.2	TRY 1,180 to 2,400
South Asia freelancers (Arc.dev 2026)	$22 to $55	EUR 19.4 to 48.5	TRY 1,080 to 2,700
Eastern Europe freelancers (Arc.dev 2026)	$40 to $85	EUR 35.3 to 75.0	TRY 1,960 to 4,170
Western Europe freelancers (Arc.dev 2026)	$70 to $120	EUR 61.8 to 105.9	TRY 3,430 to 5,880

Clutch also puts the average reviewed project at about $132,480, roughly EUR 116,900. For a first release with one core module, three user roles, an admin area, one integration with an accounting or ERP system through its API, and the privacy features KVKK makes sensible, an illustrative model looks like this. It is a way to read quotes, not a quote.

Work item	Hours (model)	At EUR 35/hour	At EUR 70/hour
Discovery and written specification	30 to 50	EUR 1,050 to 1,750	EUR 2,100 to 3,500
Login, roles and organisation accounts	40 to 80	EUR 1,400 to 2,800	EUR 2,800 to 5,600
The core module	120 to 240	EUR 4,200 to 8,400	EUR 8,400 to 16,800
One ERP or accounting integration	40 to 100	EUR 1,400 to 3,500	EUR 2,800 to 7,000
Admin area and reporting	40 to 80	EUR 1,400 to 2,800	EUR 2,800 to 5,600
Privacy features: consent records, export, deletion, audit log	30 to 60	EUR 1,050 to 2,100	EUR 2,100 to 4,200
Automated tests	60 to 120	EUR 2,100 to 4,200	EUR 4,200 to 8,400
Environments, CI/CD and monitoring	20 to 40	EUR 700 to 1,400	EUR 1,400 to 2,800
Total	380 to 770	EUR 13,300 to 26,950	EUR 26,600 to 53,900

At the rates above, EUR 13,300 is about TRY 739,000 and EUR 53,900 about TRY 2.99 million. Not included: Turkish-language copy and translation, legal fees for the KVKK paperwork, third-party subscriptions, and hosting. Whether to buy this as a fixed scope or a monthly team depends on how settled your requirements are; dedicated team vs fixed price sets out the trade-off.

Can an English-only team work for a Turkish business?

If the people who write requirements and review work read and write English comfortably, yes. If your product owner prefers Turkish, or the users' feedback must be triaged in Turkish, an English-only vendor adds a translation step that slows everything down, and you should weigh that honestly. The interface itself can be in Turkish: RAITHub can build the internationalisation, including Turkish dotted and dotless i in search and sorting, but the Turkish text comes from your team or a translator.

Istanbul is on UTC+3 all year and Dhaka on UTC+6, so with a 9:00 to 18:00 day in both cities the teams overlap for about 6 hours, from 9:00 to 15:00 Istanbul time. The working week is agreed per client. Afternoons in Istanbul after 15:00 are covered by a written handoff, which the Dhaka team reads first thing the next morning.

Point to compare	Team in Turkey	Team in Dhaka
Working language	Turkish and English	English only
Shared hours with Istanbul	Full day	About 6 hours, plus written handoffs
KVKK transfer paperwork for the developer	Not needed for a Turkey-based team	A transfer route, usually a standard contract, and its notification
On-site workshops	Easy	Video only
What drives the total	Scope and change control	Scope, change control and clear written specs

Before choosing any vendor abroad, work through is it safe to hire a software agency in Bangladesh. If you also sell into the EU, outsourcing development under GDPR covers the parallel European rules, and answering a first security questionnaire without SOC 2 helps when your own customers start asking about your vendors.

Why RAITHub for this

• Access control that has shipped. Sundor Skin, a B2B wholesale platform, runs 146 PostgreSQL tables with row-level security, 88 permission codes and 12 staff roles, the pattern that keeps a vendor's view of real data narrow.
• Testing as standard. TheSkinProof, the founder's own marketplace venture rather than a client project, has 750+ automated tests over 217 API endpoints; PropDesk has 1,024.
• Paperwork you can use. RAITHub signs DPAs and standard contracts and follows your controls. It does not claim to meet KVKK on your behalf; that duty stays with you.
• Six shared hours with Istanbul, a working week agreed with you, and a written handoff every day.
• A fixed, written quote after a free 15-minute technical audit, or a dedicated monthly team. You own the code and IP, under an NDA.

When you don't need us

• You want to work in Turkish. RAITHub delivers in English only.
• You would rather avoid a cross-border transfer altogether. A team in Turkey, with hosting in Turkey, keeps the developer out of Article 9.
• You need native iOS or Android apps. RAITHub builds web apps and PWAs only.
• A buyer requires certification. RAITHub is not SOC 2 or ISO 27001 certified.
• You need KVKK advice. Use a Turkish data protection lawyer; RAITHub is not one.
• You need extra developers inside your own team. RAITHub does not do staff augmentation; it delivers a scoped project or a dedicated team.

If your scope is a web product or SaaS platform, start with the SaaS development service or the MVP development service, then book the free 15-minute technical audit. Bring your core workflow, where your data is hosted today, and your adviser's view on the transfer route.

Last reviewed: 1 October 2026. Legal points are general information from the Authority's English text of Law No. 6698 and its website, checked on 1 October 2026; confirm them with your adviser and KVKK. Rates and exchange rates checked the same day.

Frequently asked questions

Can a Turkish company outsource software development abroad under KVKK?

Yes, if the transfer of personal data has a route under the amended Article 9: an adequacy decision, an appropriate safeguard such as the Board's standard contract, or one of the narrow incidental cases. This is general information; confirm your route with your adviser.

What is the deadline for notifying a KVKK standard contract?

Article 9(5) requires the data controller or data processor to notify the standard contract to the Authority within five business days of signing. The parties can agree in the contract which of them files it.

What is the fine for not notifying a standard contract?

Article 18(1)(d), added by Law No. 7499, sets an administrative fine of TRY 50,000 to 1,000,000. Fine amounts are updated periodically, so check the current figure.

Is explicit consent still enough for transfers abroad?

Since the amendments, explicit consent after being informed of the risks is one of the incidental-transfer cases, and the old consent-based rule ran only until 1 September 2024. For an ongoing vendor relationship, advisers usually look to a safeguard such as a standard contract.

How much does outsourced software development cost for a Turkish company?

An illustrative first release comes to 380 to 770 hours, or about EUR 13,300 to 53,900 at EUR 35 to 70 an hour, roughly TRY 0.74 to 3.0 million at the October 2026 rate. Legal fees, translation and hosting are extra.

Does RAITHub work in Turkish?

No. RAITHub delivers in English only. It can build a Turkish-language interface, but the Turkish text comes from your team or a translator.

How many working hours does a Dhaka team share with Istanbul?

About 6 hours, from 9:00 to 15:00 Istanbul time, assuming a 9:00 to 18:00 day in both cities. The working week is agreed per client.