REP27 · Article 27 · Turkey
KVKK · VERBIS · Article 27 GDPR
Turkey has its own data protection law, its own registry and its own idea of a representative, and none of it satisfies the Union. At the same time the customs union removes tariffs on most industrial goods, which leads exporters to assume they are treated as insiders. For data protection and product safety they are not: a Turkish company that sells to consumers in the Union is a third-country company, and it needs someone established inside the Union to answer for it.
KVKKVERBISArticle 27Article 16 GPSRCustoms unionIstanbulİzmir
Both involve a registry entry and a representative, which is exactly why they get confused. One is filed with the Turkish authority and governs processing in Turkey; the other is a private written designation with an entity established in the Union, published in your privacy notice.
| Business | Article 27 GDPR | Article 16 GPSR |
|---|---|---|
| Textile exporter selling on Amazon.de under its own brand | Yes | Yes |
| Furniture maker shipping direct to EU consumers from Bursa | Yes | Yes |
| Software house serving EU clients as a processor | Yes, processors designate too | No |
| Manufacturer selling FOB to an EU importer only | Usually no | No, the importer is the operator |
| Hotel group marketing to EU travellers online | Yes | No |
| Jewellery seller on Etsy shipping to Germany | Yes | Yes |
The fourth row is the honest exemption: if a European importer buys from you and places the goods on the market under its own name, that importer carries the product obligations. Everything else on this list ends with a designation.
KVKK governs processing connected to Turkey. The GDPR reaches you because your customers are in the Union, wherever your servers and staff are.
VERBIS is a public registry of controllers. The GDPR has no equivalent registry: the record of processing activities is held by you and by your representative, and produced on request.
A Turkish local representative answers to the Turkish authority. An Article 27 representative answers to European supervisory authorities and to data subjects.
Turkey does not hold an adequacy decision from the Commission. That affects transfers and contract terms, and does not change the duty to designate.
Company details from the Ticaret Sicil registration, a signatory able to bind the company, and a short description of what you process and for whom.
Europe Services, SE in Prague, active since 2018, covering data subjects in all 27 Member States and the EEA.
Article 13(1)(a) wording in Turkish and in the languages of your European markets, ready to paste.
Held by the representative and made available to authorities, which is the part first-time clients have never prepared.
The Article 16 responsible person, named on the label and in the marketplace fields, on the same invoice and the same renewal date.
Beyond the law, there is procurement. European retailers and distributors have standardised the questions, and a supplier who answers them quickly wins the shelf.
| Question | What they want to see | Where it comes from |
|---|---|---|
| Who is your EU representative? | A signed designation and a verifiable certificate | Article 27 GDPR |
| Who is named on the product? | An EU-established operator on the label | Article 16 GPSR |
| Where is your technical file? | Held and producible within days | Product legislation |
| How do you handle a recall? | A written procedure and a contact point | Market surveillance rules |
| Who answers a consumer in German? | A desk that operates in the market languages | Practice, not text |
These five answers are what separates a supplier that is asked for a quote from one that is asked for a container. Two of them we provide directly and the other three we tell you how to prepare.
If a European importer does, most obligations sit with them. If you do, they sit with you. Everything else follows from this line.
Marketplace fields, which means the Article 16 responsible person. Listings come back the same day.
The Article 27 designation and the privacy notice paragraph, because that is where the fines live.
Country by country, through a specialised EPR provider. Not us, and we say so before you ask.
Designations lapse quietly. One invoice and one expiry keeps them from drifting apart.
The legal analysis turns on one question: who is established in the Union and who decides. These are the structures we meet and the answer for each.
| Structure | Who designates | Note |
|---|---|---|
| Turkish company selling direct to EU consumers | The Turkish company | The standard case, both regimes apply |
| Turkish company with a European sales office | Depends on who is the controller | If the EU entity decides purposes and means, Article 27 does not apply to it |
| Turkish manufacturer, EU importer buys FOB | The importer, for products | Data duties may still reach you if you market to consumers directly |
| Group with a Dutch or German holding | The operating entity that sells | Holding structures do not create establishment for the seller |
| Turkish marketplace seller on EU platforms | The seller | Platforms enforce this before any authority does |
Signed by Europe Services, SE, dated and countersigned, with a certificate carrying a verification code your European clients can check.
The record of processing activities, held and produced to authorities on request. Almost no first-time client arrives with one.
Every enquiry from a data subject or an authority, with dates, answers and what was forwarded to you.
Declaration of conformity and technical documentation kept available for ten years.
No. VERBIS is a Turkish registry filed with the Turkish authority. Article 27 requires a written designation with an entity established in the Union, published in your privacy notice.
No. It removes tariffs on most industrial goods. Establishment in the Union is what Article 27 and Article 16 turn on, and a customs union does not create it.
No. That concerns transfers of personal data and contract terms. It has never affected the duty to designate a representative.
Not for the Union. A Turkish representative answers to the Turkish authority; European supervisory authorities need a contact point established inside the Union.
Yes. A Turkish software house or agency processing on behalf of EU clients designates on the same terms as a controller.
Often not. If the EU importer places the goods on the market under its own name, it carries the product obligations, and Article 3(2) may not reach you for data either.
One where your data subjects are. Within that group the choice is yours; ours is the Czech Republic, which covers all 27 and the EEA from a single mandate.
If you ship physical consumer goods to the Union, yes. It is a separate regulation, and it is the one that blocks marketplace listings first.
From €290 a year for the Article 27 representative alone, €890 for the plan covering both roles.
The designation is issued in English, with the privacy notice paragraph supplied in Turkish and in your market languages. Requests are answered in eight languages.
If the European entity is the controller and is established in the Union, Article 27 does not apply to it. Analyse who decides purposes and means before assuming either way.
Through the representative, in addition to or instead of you. Requests are logged and forwarded the same working day.
No. Article 27(5) keeps proceedings possible against the controller or processor directly. Anyone promising otherwise is selling something the regulation does not allow.
Then the Union is not reached and Article 27 does not apply. It applies when you offer goods or services to people in the Union or monitor their behaviour.
Within 24 hours of a completed form: signed designation, certificate with a verification code, and the wording for your privacy notice.
Yes, at the switch price. The new designation is signed, the notice updated the same day, and the old arrangement terminated afterwards so there is no gap.
Related: the Article 27 test in four questions · what the EEA adds
Europe Services, SE in Prague as your Article 27 representative across all 27 Member States and the EEA, with a verifiable certificate and the privacy notice wording in Turkish.
See the plans