Turkey's Independent GRC Publication · English Edition

Seeing risk
is an art.

Turkish regulation moves fast and is rarely explained in English. The Governance reads it from the inside: data protection, cybersecurity, AI governance, financial crime and resilience, translated into what boards and multinationals operating in Turkey actually need to decide.

Get the Turkey GRC Brief Free · Monthly · In English

On the Turkish agenda now

KVKK · Principle Decision 2026/2035Employer monitoring of corporate email is now bound by proportionality, notice and record-keeping.
Cybersecurity LawObligations are in force; the secondary regulation that defines "how" is still catching up.
National AI Action PlanImplemented by presidential circular. Announcement phase over, execution phase started.
EU spilloverDORA and NIS2 reach Turkish suppliers through contracts, not through Turkish law.

The Turkey GRC Brief

Recent signals from Turkey

A curated English selection from our weekly Turkish edition. Each signal comes with the one thing a board or regional leadership team should take from it. Full analysis is in Turkish.

Data Protection · October 2026

KVKK draws a line on employer access to corporate email

The Turkish Data Protection Authority's Principle Decision 2026/2035 confirms that owning the tool does not grant free access to its content. Monitoring must be proportionate, announced in advance and documented.

So what: technical access is not legal access. Review monitoring policies, employee notices and investigation playbooks before the next internal inquiry, not during it.

Full analysis in Turkish · Issue 16 → AI Governance · October 2026

AI adoption in Turkey has doubled. Accountability has not kept pace.

Corporate AI use has moved from pilots into decision-making faster than ownership, oversight and audit trails have been defined. The bottleneck is no longer the technology.

So what: for every AI system that influences a decision, name an accountable owner and keep evidence of human oversight. That is what regulators and auditors will ask for first.

Full analysis in Turkish · Issue 15 → Cybersecurity · September 2026

The Cybersecurity Law's evidence test: obligations ahead of guidance

Turkey's Cybersecurity Law created duties for a broad set of organisations, while the secondary regulation that specifies controls and reporting is still being written. Companies are expected to comply with rules whose detail is not yet final.

So what: build to a recognised baseline such as ISO 27001 now and document the rationale. When the detailed rules arrive, a defensible record will matter more than a perfect guess.

Full analysis in Turkish · Issue 12 → Regulation · August 2026

Turkey's AI Action Plan is now in force by circular

The national AI Action Plan moved from policy document to implementation through a presidential circular, placing governance at the centre of public and private sector AI use.

So what: start with an inventory. An organisation that cannot list where AI is used cannot govern it, and an inventory is the first artefact any review will request.

Full analysis in Turkish · Issue 11 →

Why The Governance

Read by a practitioner, not a vendor

Independent

Not software marketing, not a consulting firm's report. An independent read, filtered through 15 years of hands-on practice inside regulated organisations.

Inside Turkey

We follow KVKK, BDDK, MASAK, SPK and the Cybersecurity Law in the original Turkish and connect them to EU frameworks such as the AI Act, DORA and NIS2.

Decision-ready

Every signal ends with a "so what". Written for regional CFOs, CISOs, General Counsel, internal audit and board members who need the implication, not the summary.

Our Approach

Governance is the control layer

"AI is a governance and accountability problem, not a technology problem."

The largest risks are rarely technical. They sit in the gaps created by unclear ownership, unevidenced controls and boards that see too late. Our work focuses on those gaps.

Our AI Governance framework is published as an open methodology. Organisations are free to use it, adapt it and test it against their own operations.

AI governance & technology riskPrimary focus
Business continuity & disaster recoveryISO 22301
Information security governanceISO 27001
Data protectionKVKK · GDPR
Financial crime complianceMASAK
Supply chain & third-party riskDORA · NIS2

Advisory

For organisations operating in Turkey

For regulated organisations with operations in Turkey that need a clear view of their exposure and a governance structure that will hold up under scrutiny.

01 · Diagnose

Maturity Assessment

An independent view of where your governance, risk and compliance stands against Turkish requirements and recognised frameworks, with a prioritised gap list.

02 · Build

Framework Design

Policies, control frameworks, risk registers and operating models designed to be used, not filed. AI governance, ISO 27001, ISO 22301 and KVKK programmes.

03 · Oversee

Board Advisory

An ongoing, independent sounding board for boards and audit committees on Turkish regulatory change and emerging risk.

Start a conversation

From the Editor

Ecem Aksut

I have spent more than 15 years in enterprise risk, compliance and technology governance across holding groups, multinationals, banks and technology companies, in Turkey and across Europe. In every one of them I met the same reality.

"The biggest risks are not technical. They hide in the gaps left by management blind spots."

The Governance exists to close that gap. In Turkish every week for Turkish leaders, and in English for everyone who needs to understand governance in Turkey.

ISO 27001 Lead Auditor ISO 22301 Lead Auditor ISO 27701 Lead Auditor CRISC GDPR / KVKK DPO MASAK Compliance Officer

Follow on LinkedIn →

Seeing riskis an art.