Turkey Outbound Calling Compliance: İYS and KVKK (2026)

Türkiye is the cleanest permission regime in this series and the one most often misconfigured. It is clean because a single national system holds the answer to "may I call this person on this channel", and it is misconfigured because teams treat that system as a suppression list to download rather than as a gate to query before each send. This guide follows the instruments as they are written, and says plainly where they are silent.

At a Glance

Who Regulates Outbound Calling in Türkiye

The first surprise for most teams is that the telecoms regulator is not in charge. The regulation on commercial communication is made by the Ministry of Trade and executed by the Minister of Trade. BTK regulates electronic communications generally, and the KVKK authority regulates personal data, but the rules on who you may call and what you must say belong to the Ministry of Trade.

The second surprise is how wide the definition reaches. A commercial electronic message is defined to include data, voice and image content sent for commercial purposes by means such as telephone, call centres, fax, automatic dialling machines, smart voice-recording systems, e-mail and short message service. A predictive dialler campaign is not an edge case in Turkish law; it is named in the definition.

There is no licence. Instead, every natural or legal person wishing to send commercial electronic messages registers with İYS, and each registered service provider and each of its brands is assigned a unique İYS number. İYS itself is the national platform the Ministry of Trade commissioned Türkiye Odalar ve Borsalar Birliği to establish for managing commercial message permissions and complaint processes, and İleti Yönetim Sistemi A.Ş. was formed for that purpose with the Union as its sole shareholder.

The duties reach the outsourced dialler too. An intermediary service provider, meaning the platform or contact centre that actually initiates the send, must not start sending messages belonging to service providers that are not registered with İYS, must check through İYS whether recipients hold consent before starting a send, must not start a send to recipients who carry no İYS consent, and must align its own sending system with İYS. An intermediary also may not collect consent in its own name in order to promote someone else's goods, services or business. E-mail is carved out of those intermediary checking duties by the regulation's article 17/A; voice and SMS are not.

Consent and Opt-Out

The statutory rule is short: commercial electronic messages may be sent to recipients only if their consent has been obtained beforehand. Around that sentence the regulation builds an unusually precise set of formalities.

Consent may be taken in writing, through any electronic communication tool, or through İYS itself. A consent must carry the recipient's positive statement of will, their name and surname and their electronic contact address; a consent taken through İYS carries the statement of will and the contact address. A consent taken on paper requires the signature of the person giving it. A consent taken electronically must be confirmed back to the recipient within 24 hours, with an opportunity to refuse, unless it was taken through İYS.

Three prohibitions define the outer limits. You may not request consent by sending a commercial electronic message to someone's contact address, which closes the permission-request campaign as a tactic. A positive statement of will may not appear pre-selected in the consent text. And consent may not be made a precondition of supplying the goods or service. Where consent is embedded in a contract, it must sit at the end of the document, before the positive statement or the signature, under a heading reading commercial electronic message, with a refusal option, in type of at least twelve points.

The rule that catches the most campaigns is the upload deadline. Consents not taken through İYS must be recorded there by the service provider within three business days, and consents not recorded in İYS are deemed invalid. A signed paper consent in your filing cabinet, never uploaded, is worth nothing. The burden of proving a non-İYS consent lies with the service provider.

There are real carve-outs, and one of them is decisive for collections. Traders and tradesmen may be sent commercial electronic messages without prior consent, although their contact addresses must still be loaded into İYS and checked there for a refusal before sending. Separately, no İYS check applies to messages about changes, use and maintenance of goods or services where the person supplied their details for contact, to notifications on a continuing subscription, membership or partnership, to collection and debt reminders, information updates, purchase and delivery notices and statutory information duties, or to informational messages from capital-markets intermediaries. The catch is stated in the text itself: no goods or service may be encouraged or promoted in such a notification. A debt reminder is outside the consent regime only for as long as nothing is being sold in the same contact.

Do-Not-Call

Türkiye does not run a separate do-not-call list. İYS is defined as the system that enables commercial electronic message consent to be obtained, the right of refusal to be exercised and complaint processes to be managed, so the register of permissions and the register of refusals are one object.

The permissions are per channel. İYS presents the citizen with every consent they have given to each service provider for each channel, voice call, short message and e-mail, in one place, and lets them control each and exercise refusal on each. A consent for SMS is not a consent to call.

Refusal is unconditional and free. The recipient may refuse to receive commercial electronic messages at any time without giving any reason, the refusal route must be provided through the same channel the message was sent on, easily and free of charge, and the opportunity to refuse must appear in every commercial electronic message. A refusal invalidates the consent for the channel it was made on.

Two three-business-day clocks then run. The service provider must stop sending to the recipient within three business days of the refusal request reaching it, and must report refusals it receives to İYS within three business days. The recipient may also exercise refusal directly through İYS. Business day is defined to exclude national holidays, public holidays and weekends, which matters when a refusal arrives on a Friday afternoon before a public holiday.

There is no mandated re-scrub interval, because the duty is not periodic. The rule is a check through İYS before each send. Complaints go to the provincial trade directorate through e-Devlet, through İYS or through the Ministry's website and are put through a preliminary examination on İYS first, and an intermediary that started a send must answer an information request through İYS within fifteen days.

Calling Hours and Days

There is no calling-hours rule in this regime, and that is a finding rather than an omission in this guide. A full-text read of the consolidated regulation, whose own amendment table lists exactly two amending regulations, both from 2020, and of Law No. 6563 found no clock window, no day-of-week restriction and no public-holiday restriction for commercial electronic messages. The only occurrences of the word for hour in either text are the 24-hour consent-confirmation deadline and record-keeping fields. The consumer-rights regulation for the electronic communications sector likewise contains no telemarketing calling-hours provision.

What could not be confirmed is whether an hours restriction exists somewhere else, for example in a Ministry of Trade communiqué, a BTK board decision or a sectoral banking or insurance rule. The regulator has not published a public rule in the instruments read here, so confirm the position with the Ministry of Trade and with your sector's regulator before launching, and do not let a vendor quote you a Turkish calling window as though it came from Law 6563.

No frequency cap appears in either instrument either. In the absence of an hours rule and a frequency rule, the practical control is the one the law does give the citizen: an unconditional, free refusal that must be honoured within three business days. Campaigns that irritate produce refusals, refusals invalidate consent per channel, and lost consent in Türkiye is not recoverable by dialling again.

Caller ID and Number Presentation

Türkiye regulates who you say you are rather than what number you present. On a voice call the content must include the trade name for traders, or the first name and surname for tradesmen, and the service provider may add a brand or business name to identify itself further. Where the commercial nature of the message is not clear from its content, a qualifying word such as promotion, campaign or information must be used, and on voice calls it must be stated at the beginning of the conversation. At least one reachable contact route must be given, such as a telephone, fax or SMS number or an e-mail address. Promotions, prize draws and games must be flagged as such, with their validity period and conditions reachable through a dedicated address or a customer-service number.

A reserved number prefix or dedicated range for telemarketing voice calls is not published. No such rule appears in Law 6563, in the consolidated regulation, or in the sector's consumer-rights regulation, and that is a negative from three instruments rather than proof that no board decision creates one. Rules on withheld or spoofed caller ID presentation for commercial calls were likewise not located. The prudent build is to present a consistent, reachable number that matches the trade name your agents and voice agents announce, and to confirm the numbering position with BTK if your architecture depends on it.

Call Recording and Notices

No call-recording notice or consent duty specific to commercial calls appears in Law 6563 or in the regulation. What is certain is that a recording of an identifiable person is personal data, and that KVKK provides that personal data may not be processed without the data subject's explicit consent, subject to the lawful bases the law sets out. A separate duty to inform applies at the moment of collection, and breaching it is fineable in its own right.

There is also no statutory retention period for call recordings in the commercial-message regime. The three-year rule described below applies to consent records and to commercial-message records, and a recording is best treated as falling inside your own justified retention policy under KVKK rather than as covered by that three-year figure. Announce the recording at the start of the call, cover it in the information notice you give under KVKK, and set retention deliberately.

Messaging Rules for SMS and WhatsApp

SMS is a first-class channel in this regime rather than an afterthought. Short message service is named in the definition of a commercial electronic message, SMS is one of the three separately managed İYS permissions, and every content duty described above applies to it: the trade name, the qualifying word where the commercial nature is not obvious, at least one reachable contact route, the refusal option in every message, and the refusal honoured through the same channel it arrived on.

E-mail is the one channel the regulation treats differently, disapplying the intermediary checking duties to commercial messages sent by e-mail. Voice and SMS are not carved out, so a contact centre sending SMS on a client's behalf carries the full pre-send İYS check.

WhatsApp and other over-the-top channels are not named in Law 6563 or in the regulation. The definition of a commercial electronic message is written around means such as telephone, call centres, fax, automatic dialling machines, smart voice-recording systems, e-mail and short message service, and how a business messaging channel maps onto that list is not something the instruments answer. Treat the consent, identification and refusal principles as the floor, keep the İYS record for the channels it covers, and confirm the treatment of over-the-top messaging with the Ministry of Trade rather than assuming either answer.

Data Protection and Retention

KVKK, Law No. 6698, was published on 7 April 2016. Explicit consent is the default basis for processing, subject to the lawful bases in the law, and the regulation on commercial messages adds its own rule that prior consent is needed before personal data may be shared with third parties, processed or used for other purposes, a rule that binds İYS itself as well as senders.

Cross-border transfer was rewritten by Law No. 7499 of 2 March 2024, in force 1 June 2024, and now runs on three tiers. The first is an adequacy decision on the destination country, on sectors within it, or on an international organisation; such decisions are taken by the Kurul, published in the Resmî Gazete and reviewed at least once every four years. The second, where there is no adequacy decision, is appropriate safeguards: an agreement between public bodies plus Kurul permission, Kurul-approved binding corporate rules, the Kurul's published standard contract, or a written undertaking plus Kurul permission. The third is a set of derogations available only occasionally, including explicit consent given after being informed of the risks, necessity for a contract with or in the interest of the data subject, overriding public interest, the establishment or defence of a right, protection of life or bodily integrity where the person cannot consent, and transfer from a public register.

If you use the standard contract, note the filing deadline: it must be notified to the Authority by the controller or processor within five business days of signature, and failing to do so is separately fineable. Which countries hold a Turkish adequacy decision is not published in the material reviewed here, so treat every transfer of Turkish personal data out of Türkiye as needing a safeguard until you have read a Kurul decision that says otherwise. For a contact centre that dials Türkiye from another country, this is the single highest-risk item in the file.

Retention in the commercial-message regime is three years, with two different clocks. Consent records are kept for three years from the date the consent ceased to be valid, and other records relating to commercial electronic messages are kept for three years from the record date; both are produced to the Ministry on request. The period was one year before the amendment of 4 January 2020. In a complaint, the burden of proof lies with the service provider and, where relevant, the intermediary service provider.

Penalties and Enforcement

Sending a commercial electronic message without prior consent falls in the base band of TRY 1,000 to 5,000 per breach, as substituted in 2022. Those base figures are revalued annually, and for the period from 1 January 2026 to 31 December 2026 that band is TRY 2,859 to 14,309, set by a Ministry of Trade communiqué published in Resmî Gazete of 25 December 2025, No. 33118. The adjacent bands for 2026 run TRY 2,859 to 28,620, TRY 5,723 to 42,930, TRY 28,620 to 286,206, and TRY 143,102 to 715,516 for the most serious categories.

Two multipliers turn a modest per-breach figure into a real number. Where messages are sent to more than one person at once in breach of the consent rule, the administrative fine may be increased up to tenfold, which on the 2026 figures gives an upper bound of TRY 143,090 for a single non-consented bulk send. And where the same breach is repeated within one year from the date the penalty notice was served, the fine applied is twice the previous one.

On the data-protection side the statutory base figures under KVKK are a fine of TRY 5,000 to 100,000 for failing the duty to inform, TRY 15,000 to 1,000,000 for failing data-security obligations, TRY 25,000 to 1,000,000 for not complying with a Board decision, TRY 20,000 to 1,000,000 for registry failures, and, added in 2024, TRY 50,000 to 1,000,000 for failing to notify a standard contract. Those amounts are uprated annually by the revaluation rate, but no 2026 KVKK revaluation announcement was located, so the statutory base figures are given here with that caveat and no uprated number should be quoted until the announcement is read. The fines for the first four categories fall on the data controller; the standard-contract fine can fall on a controller or a processor, including natural persons and private-law legal persons. Appeals go to the administrative courts under KVKK Article 18 as amended by Law No. 7499.

What Changed in 2025 and 2026

The regulation itself has not changed since 28 August 2020. Its own amendment table lists exactly two amending regulations, both from 2020, so anyone telling you the Turkish commercial-message rules were rewritten recently is describing something else.

What did change is the price. The Ministry of Trade communiqué published in Resmî Gazete of 25 December 2025, No. 33118, set the administrative fine amounts under article 12 of Law 6563 for calendar year 2026, and those are the figures above. That is the live change a 2026 plan must carry, and it will change again for 2027.

The other standing change is a little older but still the operative framework: the Law No. 7499 amendments to KVKK entered into force on 1 June 2024, replacing the previous undertaking-plus-permission transfer regime with adequacy decisions, standard contracts and binding corporate rules. Whether the Kurul has since issued any adequacy decision, or any principle decision touching telemarketing, could not be confirmed; the most recent listed principle decision concerns biometric data used for attendance tracking rather than marketing. Any 2025 or 2026 BTK board decision on call-centre numbering, caller ID spoofing or nuisance calls was likewise not located.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Türkiye does not ship as a jurisdiction pack, so calling hours, do-not-call handling and consent are configured per tenant. The legal responsibility stays with the service provider.

Türkiye Outbound Compliance Checklist

• Register on İYS before any campaign, and record the İYS number issued to each brand you send under.
• Check İYS for a live consent on the exact channel before every send, and never treat a downloaded list as a substitute.
• Upload every consent taken outside İYS within three business days, because an unrecorded consent is invalid.
• Keep voice, SMS and e-mail permissions separate in your data model, since the citizen manages them separately.
• Never request consent by sending a commercial message to someone's contact address.
• Remove pre-selected consent boxes, and never make consent a precondition of supplying the product.
• Format contract-embedded consent at the end of the document, before the signature, under a commercial electronic message heading, with a refusal option, in at least twelve-point type.
• Load trader and tradesman contacts into İYS and check for refusal, even though prior consent is not required for them.
• Keep debt reminders and service notifications free of any promotion, or they lose the consent exemption.
• State the trade name and declare the purpose at the beginning of every voice call, and give at least one reachable contact route.
• Put a same-channel, free refusal route in every commercial message.
• Stop within three business days of a refusal, and report refusals you receive to İYS within three business days.
• Retain consent records for three years after the consent ceases to be valid, and other message records for three years from the record date.
• Put a safeguard under every transfer of Turkish personal data abroad, and file any standard contract with the Authority within five business days of signature.

Sources

1. Elektronik Ticaretin Düzenlenmesi Hakkında Kanun No. 6563, consolidated text with the article 12 fine table for 2026. mevzuat.gov.tr
2. Ticari İletişim ve Ticari Elektronik İletiler Hakkında Yönetmelik, consolidated text with its amendment table. mevzuat.gov.tr
3. Amending regulation published in Resmî Gazete of 4 January 2020, No. 30998, introducing the İYS duties. resmigazete.gov.tr
4. Kişisel Verilerin Korunması Kanunu No. 6698, consolidated text including article 9 as substituted by Law No. 7499 and article 18 fines. mevzuat.gov.tr
5. Elektronik Haberleşme Sektörüne İlişkin Tüketici Hakları Yönetmeliği, consolidated text, read for the absence of any calling-hours provision. mevzuat.gov.tr
6. İleti Yönetim Sistemi A.Ş., corporate statement on its appointment by the Ministry of Trade and its ownership by Türkiye Odalar ve Borsalar Birliği, accessed 11 September 2026. iys.org.tr
7. İYS frequently asked questions, on managing voice call, SMS and e-mail permissions separately, accessed 11 September 2026. İYS FAQ
8. Ministry of Trade communiqué published in Resmî Gazete of 25 December 2025, No. 33118, setting the Law 6563 administrative fine amounts for 2026, as reproduced in the consolidated Law 6563.
9. Kişisel Verileri Koruma Kurumu, principle decisions index, accessed 11 September 2026. kvkk.gov.tr

Frequently Asked Questions

What are the legal calling hours in Türkiye?

The regulator has not published a public rule in the instruments reviewed here. A full read of Law No. 6563, of the consolidated commercial-message regulation whose amendment table lists only two amendments, both from 2020, and of the electronic communications sector's consumer-rights regulation found no clock window, no day-of-week restriction and no public-holiday restriction. Whether an hours rule exists in a Ministry communiqué, a BTK board decision or a sectoral rule could not be confirmed, so confirm before launch rather than assuming a window either way.

What is İYS and do I have to register?

İYS is the national message management system operated by İleti Yönetim Sistemi A.Ş., a company established for that purpose by Türkiye Odalar ve Borsalar Birliği, which is its sole shareholder, after the Ministry of Trade commissioned the Union to build a national platform for commercial message permissions and complaints. Registration is mandatory for every natural or legal person wishing to send commercial electronic messages, and each registered service provider and brand receives a unique İYS number.

Does a consent taken outside İYS count in Türkiye?

Only if you upload it. Consents not taken through İYS must be recorded there by the service provider within three business days, and consents not recorded in İYS are deemed invalid. The burden of proving a consent taken outside İYS lies with the service provider, so a signed paper consent that was never uploaded gives you no defence.

Can I call Turkish businesses without prior consent?

Traders and tradesmen may be sent commercial electronic messages without prior consent under Law No. 6563. The regulation still requires their electronic contact addresses to be recorded in İYS by the service provider and checked there to see whether they have exercised their right of refusal before any message is sent, so the İYS step does not disappear for business contacts.

Do collections calls need consent in Türkiye?

Collection and debt-reminder notifications sit outside the consent duty, along with notifications on a continuing subscription, membership or partnership, information updates, purchase and delivery notices and statutory information duties, and no İYS check applies to them. The condition is written into the text: no goods or service may be encouraged or promoted in such a notification. Put anything promotional in the same contact and the exemption is lost.

How quickly must I honour an opt-out in Türkiye?

Within three business days. The service provider must stop sending commercial electronic messages to the recipient within three business days of the refusal request reaching it, and must separately report refusals it receives to İYS within three business days. Business days exclude national holidays, public holidays and weekends. A refusal made on one channel invalidates the consent for that channel.

What must an agent say at the start of a Turkish commercial call?

The call content must carry the trade name for a trader, or the first name and surname for a tradesman, and may add a brand or business name. Where the commercial nature of the message is not clear from its content, a qualifying word such as promotion, campaign or information must be used, and on a voice call it must be stated at the beginning of the conversation. At least one reachable contact route for the service provider must also be given.

What are the fines for marketing without consent in Türkiye?

The statutory band is TRY 1,000 to 5,000 per breach, revalued for 2026 to TRY 2,859 to 14,309 by a Ministry of Trade communiqué published in Resmî Gazete of 25 December 2025, No. 33118. A bulk send in breach of the consent rule may be increased up to tenfold, giving an upper bound of TRY 143,090 on the 2026 figures, and repeating the same breach within a year of the penalty notice doubles the previous fine. KVKK fines are separate, with statutory base figures from TRY 5,000 to 1,000,000 depending on the duty breached.

Related Reading

• Türkiye outbound dialer overview
• Compliance Autopilot
• Caller-ID Pool Control