Intra-group agreements and personal data transfers for Turkish subsidiaries

In short

• A written, signed contract is what the tax office, banks and courts expect to see, even though most contracts are valid in any form. Where the parent is the sole shareholder of the Turkish subsidiary, writing is a condition of validity (except for day-to-day, insignificant and ordinary transactions).
• Foreign currency: certain contracts between Turkish residents are subject to limits on pricing in foreign currency (Decision No. 32). A contract between the Turkish subsidiary and its Dutch, Belgian or German parent is not between two residents; a contract between two Turkish entities of the same group is, and some specific exceptions may apply.
• The Turkish Commercial Code requires a parent to compensate a loss it causes its subsidiary within the same financial year.
• Personal data: sending personal data from Türkiye to the group parent is a "transfer abroad" under the Personal Data Protection Law (KVKK, Law No. 6698). Since 1 June 2024 a signed standard contract must be notified to the Turkish authority within five working days.
• Tax: transfer pricing and thin capitalisation are tax limits; a Turkish certified public accountant (mali müşavir) should review prices and loan terms.

Which intra-group contracts does a Turkish subsidiary usually need?

For the related question of which obligations the company carries every year, see Running a foreign-owned company in Türkiye.

Does an intra-group contract have to be in writing?

As a rule, the Turkish Code of Obligations (Law No. 6098) leaves the form of a contract to the parties. Only some contracts, such as suretyship or the sale of land, need a prescribed form.

In practice, a written contract signed before performance starts matters for proof (the accountant, tax inspector, bank and court will ask for it) and for authority (a lawyer in Türkiye can check that the signatory can bind the company, using the signature circular, imza sirküleri, and the trade registry (ticaret sicili) records). Informal arrangements are hard to defend later.

For single-shareholder companies, writing is a condition of validity. Where the parent is the sole shareholder of the Turkish subsidiary, contracts between them must be in writing, except for day-to-day, insignificant and ordinary transactions. Here writing is required for the validity of the contract (Turkish Commercial Code Art. 371(6) for a single-shareholder joint-stock company; Art. 629(2) for a single-shareholder limited company). The Code describes the exempt transactions as "day-to-day, insignificant and ordinary transactions according to market conditions".

Can intra-group contracts be priced in euros?

Decision No. 32 on the Protection of the Value of the Turkish Currency was amended in September 2018. Since then, there are limits on agreeing prices in foreign currency, or indexed to foreign currency, in certain contracts between residents of Türkiye. The restriction does not cover every contract; it depends on the type of contract and on the exceptions. The Ministry of Treasury and Finance sets the exceptions in an implementing communiqué (Communiqué No. 2008-32/34). For example, Art. 8(9) of the Communiqué allows foreign-currency pricing in sales of movables other than vehicles.

What this means for a group:

• The subsidiary is a Turkish resident. A service or loan contract with its Dutch, Belgian or German parent is with a non-resident, so the restriction does not apply in the same way.
• A contract between the subsidiary and another Turkish group company is between residents. Depending on the type of contract, a euro price may be invalid unless an exception applies.
• Art. 8(19) of the Communiqué contains a special exception: foreign-currency pricing is allowed in employment and service contracts where the employer or service recipient is a Turkish company in which foreign persons hold, directly or indirectly, at least 50% of the shares or control. This exception may also apply to a service contract between a foreign-controlled Turkish subsidiary and another Turkish company of the same group, but its conditions must be checked in the specific case.
• The exceptions change from time to time, so check them before signing.

What does the Turkish Commercial Code say about parent and subsidiary?

The Turkish Commercial Code (Law No. 6102, Art. 195 and following) regulates groups of companies. The key rule is in Art. 202. A controlling company (hâkim şirket) may not use its control to cause its subsidiary a loss. This includes steering the subsidiary into transfers of business, assets, staff, receivables or debts, or into measures that reduce or move its profit.

If a loss is caused, it must be compensated during the same financial year, or the subsidiary must be given an equal-value claim, with the manner and timing of compensation stated, by the end of that year. If not, each shareholder of the subsidiary can claim damages from the parent and from the board members involved.

Where the controlling company holds, directly or indirectly, all the shares and voting rights of the subsidiary (full control), Arts. 203 to 206 set a different regime. The controlling company's board may then give instructions on the direction and management of the subsidiary, provided they follow from the group's defined and concrete policies, even if they could cause a loss, and the subsidiary's bodies must follow them (Art. 203). This power has limits: no instruction may be given that clearly exceeds the subsidiary's ability to pay, could endanger its existence or could cause it to lose important assets (Art. 204). Creditor protection continues: if a loss arising from an instruction is not compensated in the same financial year, or an equal-value claim is not granted, creditors who suffer loss can sue the controlling company and the responsible board members for damages (Art. 206). The subsidiary's own board members and managers are not liable to the company or its shareholders for following such instructions (Art. 205).

In a wholly owned subsidiary there is no minority shareholder, so the compensation question takes a different form; but the statutory limits on instructions and the protection of creditors (Art. 206) remain, and a later buyer will review past intra-group dealings. Intra-group prices and fees should therefore be reasoned and documented. Their tax limits (transfer pricing, disguised capital) are for a Turkish certified public accountant or tax adviser.

When is a transfer of personal data to the group parent a "transfer abroad"?

The Turkish Personal Data Protection Law (Law No. 6698, KVKK) applies to personal data of employees, customers and contacts processed in Türkiye. Sending that data to a parent company in another country, or giving a group system abroad access to it, is a transfer abroad under Art. 9.

Art. 9 was replaced by Law No. 7499, effective 1 June 2024. The Regulation on the procedures and principles of transfers abroad followed in the Official Gazette of 10 July 2024. In outline, the order of options is:

1. Adequacy decision (yeterlilik kararı). The Personal Data Protection Board can declare a country, a sector or an international organisation adequate. The transfer then needs only a lawful basis under Arts. 5 or 6. 2. Appropriate safeguards (uygun güvenceler). Without an adequacy decision, a transfer can rely on a lawful basis, effective rights and remedies for the person in the destination country, and one of these safeguards: - standard contract (standart sözleşme), using the Board's texts; - binding corporate rules (bağlayıcı şirket kuralları) for a group engaged in joint economic activity, approved by the Board; - a written undertaking (taahhütname) with adequate protections, with the Board's permission; - an agreement between public bodies, with the Board's permission. 3. Occasional transfers (arızi aktarım). Only if the first two are unavailable, and only if the transfer is occasional, one of the listed exceptions applies, for example explicit consent after being told of the risks, or necessity for a contract with the person.

A group that shares data routinely cannot rely on option 3; the standard contract is the usual route.

Notification deadline. A signed standard contract must be notified to the Authority (Kurum) within five working days of signature (Art. 9(5)). The Authority opened an online Standard Contract Notification Module on 25 October 2024. A new notification is needed if the parties or the content change or the contract ends. Failing to notify can lead to an administrative fine. The Turkish text of the standard contracts governs.

The same safeguards must be kept for onward transfers by the parent.

Does the Turkish subsidiary have to register with VERBİS?

VERBİS is the Data Controllers' Registry (Veri Sorumluları Sicil Bilgi Sistemi). Controllers must register unless exempt. Under Board decision 2018/87 as amended, a controller whose main activity is not processing special-category data is exempt if it has fewer than 50 employees and an annual balance-sheet total below TRY 100 million. Companies that keep balance-sheet accounts must meet both tests. A controller whose main activity is special-category data is exempt only if it has fewer than 10 employees per year and an annual balance-sheet total below TRY 10 million.

Exemption does not remove the other duties (privacy notices, security measures, the transfer rules above). The thresholds changed in 2023 and 2025, so check the Authority's website when deciding. A group with a larger Turkish workforce, such as a hotel or a plant in Antalya, is more likely to be above them.

How does this relate to the GDPR?

The Turkish law is modelled on EU data protection law but is not identical. Data sent from the EU to the Turkish subsidiary falls under the GDPR's transfer rules; data sent from Türkiye to the parent falls under Art. 9 of the KVKK. Both may apply to one group. For a related discussion, see IP, cross-border data transfers and contractual structure in AI and SaaS ventures. The group's data protection officer or counsel in the home country should handle the EU side.