A London based company has an IT developer in Istanbul via an Employer of Record (EOR). The EOR takes the employee’s ID and payroll data in Turkey and the UK HR manager needs access to a subset of that data from the UK.
This, of course, raises the question of who is responsible for protecting the employee’s data and what the mechanisms are for the lawful cross-border transfer of that data.
Employee data protection in a Turkey EOR arrangement is going to be entirely dependent on what data actually flows. The EOR, the client company and any HR software providers will all have their own obligations under the Turkish Personal Data Protection Law (KVKK).
The first step is to work out what data is being collected, who has the right to use it and whether any third parties outside Turkey can access it. Then the parties need to assess the appropriate legal basis, transfer mechanism and security measures.
Importance of Employee Data Protection in an Employer of Record Arrangement
An Employer of Record in Turkey will enable you to deal with all the local employment administration (contracts, onboarding, payroll etc). To do that it may be necessary for the EOR to process personal data relating to the employee.
The client company may also have a requirement for certain information in order to manage the employee’s role. So the manager may want to look at the performance records, the finance team may want a summary of the employment cost etc.
These activities don’t require all the parties to have access to the full employee file. There should be a clear data sharing process in place so that each organisation only gets the information it needs and doesn’t have unnecessary access to sensitive records.
What employee data might be processed?
Depending on the role and employment process, employee records may include:
- Name, contact details and ID.
- Employment contract and job information.
- Salary, payroll and bank account details.
- Leave requests and attendance records.
- Performance or training information.
- Work authorisation documentation where applicable.
- Certain health information.
There are certain types of data which do require a higher level of protection. Health data is one such category of personal data under the KVKK and it would not be appropriate to share that with all managers simply because it’s in the HR file.
The right place to start is to work out what data you actually need, who needs access to it and for how long.
Who is responsible for employee data under the KVKK?
KVKK makes a distinction between a data controller and a data processor. The distinction is based on what the organisation actually does rather than what is stated in a service agreement.
A controller determines the purposes and means of the processing. A processor processes personal data on behalf of the controller in accordance with the controller’s instructions.
The EOR’s Role
An EOR may decide how it deals with certain information in the context of its own employment obligations. It may for instance need employee records in order to administer the employment relationship, to prepare payroll or to meet applicable local reporting requirements.
For those activities, the EOR’s role has to be assessed in terms of the decisions it makes and the obligations imposed on it.
The Client Company’s Role
The client company may of course make its own decisions as to which information is used for work allocation, performance management and access to company systems.
For example if the company is collecting performance reviews for its own management purposes it would be appropriate for it to separately consider its obligations in respect of that activity. The EOR’s employment of the individual does not in any way mean that the client company is a processor in respect of all uses of the employee data.
HR Software and Other Providers
A cloud HR platform, a payroll technology provider or an IT support company might well be the one processing the data as a result of instructions from someone else. The role of that entity still has to be considered on the basis of the service that it provides and the decisions that it makes.
An organisation may take on different roles in different circumstances. Assessment should therefore be carried out on a data flow by data flow basis rather than assigning a single static role to each party.
| Local payroll administration | Who decides which records are needed and why? |
| Performance management | Who determines the review process and uses the results? |
| HR platform hosting | Where is the platform hosted, and who can access the data? |
| International reporting | Which data is shared with the overseas company, and for what purpose? |
Identify the Legal Basis for Each Processing Activity
Before any employee data is collected or shared the relevant controller must determine which applicable processing condition exists under the KVKK.
Depending on the circumstances, a condition may relate to a legal obligation, the establishment or performance of a contract, or another ground permitted by law. The appropriate basis depends on the specific data and purpose; it should not be selected as a blanket justification for every HR activity.
Be Careful With Employee Consent
Consent is not always the most appropriate legal basis for processing employment data. Employees may feel unable to refuse a request from an employer, especially if they believe refusal could negatively impact their employment.
Where consent is used, it must meet KVKK requirements. Where consent is used, it must comply with KVKK requirements (i.e., it must be informed, specific, and freely given). The Turkish DPA has noted that, in cases of consent between employer and employee, there will be an imbalance, which must be taken into account when assessing whether the consent is genuinely free. Health data requires a separate assessment under the applicable rules and appropriate protective measures.
When Does Employee Data Move Outside Turkey?
When does employee data move outside of Turkey? Sending a spreadsheet to another country. The parties should examine the full technical and operational setup.
For example:
- An HR platform may store employee records on servers outside of Turkey. Turkey.
- A support team in another country might be able to access the system.
- The client company may import selected employee data into its global HR system. The cross-border transfer must be assessed on a case-by-case basis. Retaining the primary server in Turkey does not necessarily address all international access considerations.
Create a data-flow record for each activity, including the type of data, the data-sending party and data-receiving party, the countries involved, the purpose, and the applicable contractual arrangements.
Turkey amended Article 9 of KVKK in 2024. The curTurkey updated Article 9 of the KVKK in 2024. The current regime provides a number of mechanisms for international transfers depending on the circumstances. In a processable condition under Articles 5 or 6. The parties then need to identify the relevant international transfer route under Article 9.
1. Check for an Applicable Adequacy Decision
An adequacy decision may apply to a country, a sector of a country or an international organisation, depending on the scope of the decision. decisions published by the Turkish Personal Data Protection Board. Do not assume that a destination is covered simply because it is in the European Union or another jurisdiction with a data-protection law.
2. Consider an Appropriate Safeguard
Where the relevant conditions are met, Article 9 Where the relevant conditions are satisfied, Article 9 provides for appropriate safeguards. These will be the standard contracts issued by the Turkish DPA and, in certain circumstances, binding corporate rules or other permitted arrangements. act forms:
- Controller to controller.
- Controller to processor.
- Processor to processor.
- Processor to controller.
Selecting the appropriate contract form depends on the actual roles of the parties involved in the transfer. An EU General Data Protection Regulation (GDPR) standard contractual clause does not, by itself, fulfill the distinct Turkish requirements.
3. Track the Standard Contract Notification
If the parties use a Turkish standard contract under the applicable framework, the Authority must be notified within five business days following completion of the signature.
The parties should determine who will be responsible for making the notification, who will keep the records of submission and who will be responsible for checking the Authority’s current procedural requirements. The contract should also clearly set out the data categories in question, the recipients, the purposes and the safeguards.
4. Treat Occasional-Transfer Exceptions Carefully
KVKK also provides limited mechanisms for certain occasional transfers where the requisite statutory conditions are met. These exceptions should not be relied upon as a general mechanism for dealing with ongoing HR processes.
A weekly payroll export or ongoing access to an employee database would be considered a recurring arrangement. The correct transfer mechanism must be in place to support the actual workflow.
A Practical Example: Employee Data Shared With a UK Company
Think of a UK tech company hiring an employee in Istanbul via an EOR. The EOR will need some information for local employment administration. The UK company will of course want to manage the role and have the employee on its global HR platform.
A practical review could follow these steps:
- Map the records. List the identity, payroll, contract, leave and performance data.
- Identify each purpose. Split out local payroll administration from the client’s performance management and global reporting.
- Assess the parties’ roles. Work out who is the controller and who is the processor for each activity.
- Check the platforms. Work out where they’re hosted, the degree of overseas access, who the support providers are and what the backup arrangements are.
- Limit the shared data. Work out whether the UK company actually needs the individual payroll documents or whether they’ll be content with just an agreed cost report.
- Select and document the transfer route. Review Article 9 and any relevant safeguards in respect of each international flow.
- Inform the employee. Make sure the appropriate privacy notices set out the processing and the recipients.
- Review the configuration when it changes. A new HR platform or HR support provider can bring in another data flow.
This is purely illustrative. The outcome would be determined by the parties’ actual roles, the systems in place, and the contractual arrangements.
Build an EOR Employee Data Protection Checklist
A documented checklist makes it far easier for HR, legal, and IT to manage employee data consistently.
Before Onboarding
Confirm what employee information is required and who is to collect it. Check the relevant privacy notices and agree on which records the client company requires.
At this stage, you also need to identify the HR and payroll systems that will store or access the data. If there is an intention to have international access then you need to assess the transfer route prior to the process commencing.
During Employment
Apply access controls on the basis of job role. A project manager, for instance, may need access to a team member’s work contact and role, whereas more sensitive data, such as payroll or health records, may be appropriately restricted to a smaller group.
Review access when people change roles, when new software is introduced or when an external service provider is added. Maintain a record of who is responsible for responding to employee requests and security incidents.
After Employment Ends
When an employee leaves, close down any access that is no longer required and identify what records need to be kept for a relevant legal or business purpose.
Retention should be based on the type of record and the relevant legal or business requirement. A one-size-fits-all approach of ‘delete it all immediately’ or ‘retain it all forever’ is not the right answer in most cases.
Questions to Ask Your EOR Provider
Before sharing employee information, ask your EOR partner:
- Which types of employee data will be collected and for what purposes?
- Which information will be passed to our company?
- Where are the relevant HR and Payroll systems hosted?
- Can support teams or sub-contractors outside of Turkey access the records?
- How have the parties’ controller and processor status been assessed?
- What international transfer arrangements apply to recurring data flows?
- Who are we to maintain the employee notices and deal with the data subject requests?
- How are access, retention and incident responsibilities documented?
These questions serve to move the discussion from a broad level of ‘KVKK compliance‘ to a very specific look at the actual employee data flow.
Managing Turkey EOR Arrangements: Considerations for Practice
International hiring involves the employment, payroll and HR teams in a number of jurisdictions. It’s important to have a clear understanding of the flow of employee data at the very beginning of the arrangement.
A Turkey-based Employer of Record service supports local employment administration, including contracts, onboarding, and payroll. When planning the hiring process, organizations should determine which information is required, the systems in use, and any international access requirements.
Organizations planning to hire employees in Turkey should carefully assess their EOR requirements and the information necessary for their employment arrangements.
