Trust and compliance · 2026-08-13

KVKK standard contracts for cross-border LLM transfers: the operational cost

What happens after the appropriate safeguard is chosen: four standard contract types, the five-business-day notification duty, Board permission for undertakings, and the recurring load in multi-provider AI projects.

The safeguard is chosen: which option is actually open to a public institution

Turkish public institutions procuring a language model service hosted abroad can realistically use only two of the four appropriate safeguards listed in Article 9(4) of Law No. 6698 (KVKK, the Turkish Personal Data Protection Law). Article 9 was rewritten by Law No. 7499 dated 2 March 2024, and the amendment entered into force on 1 June 2024.

Article 9(4) sets the precondition for transfers where no adequacy decision exists: personal data may be transferred abroad only if one of the processing conditions in Articles 5 or 6 is met, the data subject retains the ability to exercise rights and pursue effective remedies in the destination country, and one of the listed appropriate safeguards is provided by the parties.

Two of the four safeguards structurally do not fit the relationship between a public institution and a commercial model vendor. The remaining two, the standard contract and the written undertaking, produce very different operational costs.

(a) Agreement that is not an international treaty: available only between Turkish public institutions or professional organisations with public institution status and foreign public bodies or international organisations, and it additionally requires Board permission.
(b) Binding corporate rules: designed for companies within a group of undertakings engaged in joint economic activity, subject to Board approval. Since an institution and its vendor are not in the same group, this is not a basis in public procurement.
(c) Standard contract: established when the parties sign the text published by the Kişisel Verileri Koruma Kurulu (the Board). No separate Board permission is needed, but notification to the Authority is mandatory.
(ç) Written undertaking (taahhütname): established by signing a text containing provisions ensuring adequate protection and obtaining the Board's permission for the transfer. Transfers cannot begin before permission is granted.

Four standard contract types: which one the institution signs

The Kişisel Verileri Koruma Kurulu adopted four standard contract templates covering different transfer scenarios by Decision No. 2024/959 dated 4 June 2024, and published them on the Authority's website. The texts were announced on 10 July 2024, and the parties must select the single template matching their own situation.

Article 9(4)(c) of Law No. 6698 defines the content of the standard contract as covering data categories, the purposes of the transfer, recipients and recipient groups, the technical and administrative measures to be taken by the data recipient, and the additional measures applied to special categories of personal data.

The choice of template follows from each party's status under the Law. When an institution issues model calls for purposes it determines itself and the vendor processes only on the institution's instructions, the typical scenario is a controller-to-processor transfer.

Parties may only amend optional or alternative clauses; no additions, deletions or changes should be made to the rest of the published text.
If the published text is altered, or if a valid signature of one of the parties is missing, the Board carries out an examination under Article 15 of the Law.
A standard contract may be concluded in a foreign language, but under Article 14(3) of the Regulation the Turkish text prevails. In practice a two-column Turkish and foreign-language text is used.
The contract must be signed by the transfer parties themselves or by persons authorised to represent and sign for them.

The four standard contract templates published by the Board (Decision No. 2024/959 dated 4 June 2024)
Template	Data exporter (Turkey)	Data recipient (abroad)	Typical case for a public institution
SS-1	Data controller	Data controller	The foreign recipient also processes the data for purposes it determines itself
SS-2	Data controller	Data processor	The institution is the controller and the model vendor processes only on its instructions
SS-3	Data processor	Data processor	A contractor acting for the institution transfers data to a foreign vendor
SS-4	Data processor	Data controller	The exporter is a processor and the foreign recipient is a controller in its own right

Five business days: the notification duty, who files it, and what non-compliance means

Signing the standard contract is not sufficient on its own, because the Law imposes a separate notification duty. Article 9(5) of Law No. 6698 provides that the standard contract shall be notified to the Authority by the data controller or data processor within five business days of its signature.

The Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad (Kişisel Verilerin Yurt Dışına Aktarılmasına İlişkin Usul ve Esaslar Hakkında Yönetmelik, Official Gazette 10 July 2024, No. 32598) starts this period from the completion of signatures and allows notification physically, by registered electronic mail (KEP), or by other methods determined by the Board. The Standard Contract Notification Module was established by Board Decision No. 2024/1793 dated 17 October 2024 and announced publicly on 25 October 2024.

The parties may agree in the contract on who files the notification. Where the contract makes no such determination, the Regulation provides that the data exporter files it. Naming the responsible party in the contract therefore clarifies the boundary of responsibility between the institution and its contractor in public procurement.

Article 18(1)(d) of Law No. 6698 provides an administrative fine for failure to comply with this notification duty, a clause added by Law No. 7499 in 2024. The base amounts written into the Law are TRY 50,000 to TRY 1,000,000, increased at the start of each calendar year by the revaluation rate. The range applied for 2026 is TRY 90,308 to TRY 1,806,177, resting on the 25.49 percent revaluation rate set by General Communiqué No. 585 on the Tax Procedure Law, published in the Official Gazette on 27 November 2025.

The distinction that matters for public institutions sits in Article 18(2): the fines under clauses (a), (b), (c) and (ç) apply to the data controller, while the fine under clause (d) applies to data controllers or data processors that are natural persons or private law legal entities. Article 18(4) provides that where the act is committed within a public institution, disciplinary provisions are applied to the civil servants and other public officials concerned upon notification by the Board, and the outcome is reported back to the Board.

The practical consequence is this. If the party obliged to notify on the institution's behalf is a private law legal entity acting as contractor, the administrative fine can be applied directly to that contractor. If the institution itself carries the duty, the outcome is not a fine but a disciplinary process concerning the relevant staff. That distinction turns the allocation of the notification duty in the service contract into a substantive term rather than a technical detail.

A timely and properly formed notification consists of the following documents:

The notification includes the completed and signed final version of the standard contract template matching the nature of the transfer.
Documents evidencing the signatories' authority are attached to the notification.
Notarised translations of foreign-language documents are submitted; official documents issued in states party to the Apostille Convention require an apostille certificate.
If the information provided changes after notification, or if the contract terminates, a further notification must be filed with the Authority.
Changes to sub-processors under SS-2 and SS-3, and changes to onward transfer recipients or recipient groups under SS-1, SS-2 and SS-3, require the annexes to be updated and the change reported to the Authority.

Three providers, how many contracts: the recurring load of cross-border transfers

When a public institution uses three separate model providers hosted abroad, the standard contract load rises in direct proportion to the number of providers. Because a standard contract is concluded between the data exporter and the data recipient, each foreign recipient means a separate contract and a separate notification; a single framework contract cannot cover three vendors.

The table below assumes that each provider is a separate data recipient. The contract counts are derived from the structure set by the Law and the Regulation; they are not a measured statistic and will vary with the institution's own transfer map.

Behind every row of the table sits work that does not appear in it: determining the correct template, completing the annexes, evidencing signature authority, obtaining notarised translations of foreign-language documents, putting the five-business-day deadline on a calendar, and archiving the result. These steps repeat for each contract.

The load is not one-off: it continues after signature through change and termination notifications.
As the number of providers grows, legal review, signature workflow and archiving grow linearly with it.
The desire to widen model choice and the desire to hold compliance load flat collide inside the same project.
This route is lawful and workable; it is not impossible. It does, however, create a permanent process load that requires continuity.

Standard contract and notification load by number of foreign model providers (assumption: each provider is a separate data recipient)
Scenario	Standard contracts required	Notifications to the Authority	Recurring load
One foreign provider	1 contract, using the template matching the transfer type	1 notification within 5 business days of completing signatures	Further notification if the information provided changes or the contract terminates
Three foreign providers	3 separate contracts, potentially of different types	3 separate notifications, each with its own 5-business-day clock	Three annex sets, three sub-processor lists and three termination trails to track
Provider swap: one dropped, one added	1 new contract; the existing one terminates	1 new notification plus a termination notification	Reassessment of the new recipient's technical and administrative measures
New model enabled at the same provider	Annex update if the transfer purpose, data category or recipient group changes	Change notification	Annex review and record update for each new model
Provider updates its sub-processor list	Annex update tied to the sub-processor clause in SS-2 and SS-3	Change notification	Continuous monitoring of provider announcements

The undertaking route: Board permission and no prescribed timeline

Unlike the standard contract, a written undertaking is subject to Board permission, and transfers cannot begin before permission is granted. The Authority's Guide on the Transfer of Personal Data Abroad (KVKK Publication No. 48, January 2025) states this plainly: once the parties have signed the undertaking, they cannot start transferring data on their own initiative while the Board is still assessing it, and doing so would constitute an unlawful transfer.

Neither Law No. 6698 nor the Regulation prescribes a period within which the Board must conclude an undertaking permission application. An institution choosing this route therefore cannot anchor its service start date to a definite deadline.

Past practice gives a sense of volume and approval rate. According to the Authority's own guide, from the entry into force of the Law on 7 April 2016 until 1 June 2024, when Article 34 of Law No. 7499 took effect, 86 undertaking applications were filed with the Board and 10 of them were accepted. Three binding corporate rules applications filed in the same period were not accepted due to procedural and substantive deficiencies.

Article 15 of the Regulation lists the minimum elements of an undertaking; the text must satisfy all of them.
Those minimum elements include the recipient's commitment to accept the jurisdiction of Turkish courts, a point that needs separate negotiation with a vendor operating on standard commercial terms.
The undertaking must contain restrictions on onward transfers and a commitment to return the data with its backups or destroy it entirely upon termination.
The undertaking is governed by Turkish law; even if concluded in several languages, the Turkish text prevails in a dispute.
The permission application is filed by persons authorised to represent and bind the data controller or processor; applications filed through a proxy require the original or a certified copy of the power of attorney.

Where LLMTR reduces this load and where it does not

LLMTR does not remove a public institution's obligations under Law No. 6698. The difference lies in whether a transfer occurs at all: when data is processed on a model hosted within Turkey, there is no transfer abroad, and the transfer regime in Article 9 is not triggered. Template selection, the five-business-day notification and Board permission do not arise in that case.

Choosing a global model changes nothing about this. For that call a transfer abroad does occur, and assessing adequacy decisions, appropriate safeguards or occasional-case grounds remains the institution's own responsibility. LLMTR does not perform that assessment and does not stand in the institution's place. The general principles, processing conditions, transparency and data security duties in Articles 4, 5, 6, 10 and 12 of the Law apply equally in both cases.

On the technical side LLMTR exposes a single OpenAI-compatible /v1 surface. Turkey-hosted models and global provider models are called from the same catalog, and switching models is a change of base URL and model identifier. That means a change in the compliance decision does not force the integration to be rewritten.

Turkey-hosted models include llmtr/gemma-4, llmtr/qwen3-6-35b, llmtr/medgemma-4b, llmtr/trendyol-7b and llmtr/embeddinggemma-300m; data is processed domestically on these models.
When a global model is required the integration stays the same, and usage reports show which call went to which model, which makes it easier to document which transfers actually occurred.
Each unit can hold its own API key, rate limit, spending cap and usage report, so it is clear which unit used which model.
User prompts and model response bodies are not written to the usage and billing database.
Customer API keys are stored as SHA-256 hashes rather than plaintext, and provider API keys are held only in environment variables.
An 8% platform margin applies to credit top-ups; no margin is added to model prices.

Switching models is a single field; the transfer regime, however, changes with the model chosen.

from openai import OpenAI

client = OpenAI(base_url="https://llmtr.com/v1", api_key="LLMTR_API_KEY")

# Turkey-hosted model: data is processed domestically and the
# Article 9 transfer regime is not triggered.
response = client.chat.completions.create(
    model="llmtr/gemma-4",
    messages=[{"role": "user", "content": "Summarise the petition."}]
)

# Global model: the integration is identical, but this call is a
# transfer abroad and the safeguard is the institution's responsibility.
response = client.chat.completions.create(
    model="openai/gpt-5.5",
    messages=[{"role": "user", "content": "Summarise the petition."}]
)

Sources

The legislative references in this article were verified against the primary sources below. Last checked: 13 August 2026.

This content is informational and does not constitute legal advice. The final assessment rests with the institution's compliance and legal units.

Law No. 6698 on the Protection of Personal Data (KVKK), Articles 9 and 18 — mevzuat.gov.tr
Law No. 6698, Provisional Article 3 (transition until 1 September 2024) — mevzuat.gov.tr
Amendment by Law No. 7499, Official Gazette 12 March 2024, No. 32487 — resmigazete.gov.tr
Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, Official Gazette 10 July 2024, No. 32598 — resmigazete.gov.tr
Guide on the Transfer of Personal Data Abroad, KVKK Publication No. 48, January 2025 — kvkk.gov.tr
Public announcement on standard contracts and binding corporate rules documents, Board Decision No. 2024/959 of 4 June 2024 — kvkk.gov.tr
Public announcement on the Standard Contract Notification Module, Board Decision No. 2024/1793 of 17 October 2024 — kvkk.gov.tr
Transfer Abroad information page — kvkk.gov.tr
General Communiqué No. 585 on the Tax Procedure Law (2026 revaluation rate), Official Gazette 27 November 2025 — resmigazete.gov.tr

Preparing a standard contract for a foreign model provider and notifying the Authority

The steps an institution follows when it chooses the standard contract route as its appropriate safeguard. The statutory deadline for notifying the Authority is five business days after signatures are completed.

Establish party status and select the right template. Determine whether the institution and the foreign recipient act as data controller or data processor under the Law, then select only the SS-1, SS-2, SS-3 or SS-4 text published by the Board that matches your scenario.
Complete the text without altering it. Amend only optional or alternative clauses in the template published by the Board. Additions, deletions or changes to the remaining provisions trigger a Board examination under Article 15 of the Law.
Fill in the annexes completely. Set out the categories of personal data transferred, the transfer purposes, recipients and recipient groups, the technical and administrative measures the recipient will apply, and the additional measures for special categories of personal data. The annexes are an integral part of the contract.
Sign with the Turkish text as the governing version. Prepare the contract in Turkish, using a two-column Turkish and foreign-language format where needed. It is signed by the parties themselves or by persons authorised to represent and sign for them; keep the documents evidencing that authority ready.
Notify the Authority within five business days. Within five business days of completing the signatures, file the notification physically, by KEP address, or through the Standard Contract Notification Module. Attach the signed final text, the authority documents and notarised translations of any foreign-language documents.
Set up change and termination tracking. A further notification is required if the information provided changes, if sub-processors or onward transfer recipients are updated, or if the contract terminates. Assign this tracking to a named owner per provider.

Frequently asked questions

How is a KVKK standard contract put in place?

The parties first establish their status under the Law and select the one template among the four published by the Board that matches their scenario. The text is completed by amending only optional or alternative clauses, the annexes are filled in fully, and it is signed by the parties or by persons authorised to sign for them. Notification to the Authority follows within five business days of completing the signatures.

How many standard contract types are there and which one applies?

Board Decision No. 2024/959 dated 4 June 2024 adopted four: SS-1 for controller-to-controller, SS-2 for controller-to-processor, SS-3 for processor-to-processor and SS-4 for processor-to-controller transfers. When an institution issues model calls for purposes it sets itself and the vendor processes only on its instructions, the typical choice is SS-2.

What happens if the standard contract is not notified to the Authority?

Article 18(1)(d) of Law No. 6698 provides an administrative fine, and the range applied for 2026 is TRY 90,308 to TRY 1,806,177. Under Article 18(2), however, that fine applies to natural persons and private law legal entities. Where the act occurs within a public institution, Article 18(4) provides that disciplinary provisions apply to the public officials concerned and the outcome is reported to the Board.

How many contracts are needed for three different foreign model providers?

Because a standard contract is concluded between the data exporter and the data recipient, each foreign provider requires its own contract. Three providers mean three separate contracts and three separate notifications, each with its own five-business-day deadline. When a provider is replaced, a new contract and notification are needed, plus a separate notification for the contract that ended.

How long does Board permission take on the undertaking route?

Neither the Law nor the Regulation prescribes a period for the Board to conclude an undertaking permission application. Transfers cannot begin before permission is granted, and doing so would make the transfer unlawful. According to the Authority's own guide, 10 of the 86 undertaking applications filed between 7 April 2016 and 1 June 2024 were accepted.

Does using a Turkey-hosted model remove these obligations?

It does not trigger the cross-border transfer regime, because when data is processed within Turkey there is no transfer; standard contract selection, notification and Board permission do not arise. The Law's general principles, processing conditions, transparency and data security duties still apply in full. As soon as the institution selects a global model, the Article 9 assessment returns to the institution's responsibility.