Where we work · Türkiye
ISO and GRC certification consulting in Türkiye
Achieve ISO and GRC certification in Türkiye with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Dubai office team
- Effivity and Academy included
Sectors that ask for certification in Türkiye
Clients include
ISO and GRC certification in Türkiye at a glance
Personal data in Türkiye falls under Law No. 6698 on the Protection of Personal Data, supervised by the Personal Data Protection Authority in Ankara, the rule most businesses meet first, and a newer Cyber Security Law, No. 7545 of 2025, gives the Cyber Security Presidency audit tasks. Banks answer to the Banking Regulation and Supervision Agency's regulation on information systems, food businesses to the Food Hygiene Regulation's HACCP duty, medical-device makers to the Turkish Medicines and Medical Devices Agency, and public bodies to a Presidential circular on information and communication security. TÜRKAK is the national accreditation body, listed by Global ACI as a mutual recognition signatory, and certificates come from accredited certification bodies, never from Sterling. Demand runs through automotive suppliers, textile and apparel exporters, banks and fintechs, food and beverage processors, medical-device and laboratory businesses, software firms and defence suppliers, and many sit in organised industrial zones, free zones or technoparks. Sterling serves Türkiye from its Dubai office, on-site where the work needs it and remotely otherwise, with 20+ years behind it, 8,100+ client engagements in 60+ countries, and Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in Türkiye
Each page covers who needs the standard in Türkiye, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Türkiye (11)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK) Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu), a public legal entity with administrative and financial autonomy and its headquarters in Ankara; its decision-making body is the Personal Data Protection Board of nine members | Applies to natural and legal persons that process personal data wholly or partly by automated means, or by non-automated means as part of a data filing system. Sets processing principles, conditions for processing and for special categories of personal data, erasure and anonymisation, conditions for transfer and, since the 2024 amendment, a transfer-abroad regime built on adequacy decisions, appropriate safeguards (agreements approved by the Board, binding corporate rules, standard contracts, written commitments) and incidental exceptions. Data controllers must inform data subjects, answer their requests, take technical and organisational security measures and carry out or commission audits to ensure the Law is applied, notify a breach to the data subject and the Board within the shortest time, and register with the Data Controllers' Registry before processing unless the Board grants a derogation. The Board examines complaints and acts on its own initiative. Administrative fines and criminal provisions are set in the Law and are not restated here. The Law creates no certificate of compliance and cites no ISO standard. | |
| Personal Data Protection Authority tools: Data Controllers' Registry (VERBİS), breach notification, standard contract notification and binding corporate rules Personal Data Protection Authority (KVKK) | The Authority's home page links directly to VERBİS (the Data Controllers' Registry), a breach notification form, a complaint module and the standard contract for transfers abroad, and its menu lists binding corporate rules, Board decisions, principle decisions and guides for data controllers. These are the channels through which the Law's registration, breach, complaint and transfer duties are carried out in practice. | |
| Banking Regulation and Supervision Agency (BDDK) Banks | Regulation on Information Systems of Banks and Electronic Banking Services (Bankaların Bilgi Sistemleri ve Elektronik Bankacılık Hizmetleri Hakkında Yönetmelik), issued by BDDK under Banking Law No. 5411, published in the Official Gazette of 15 March 2020, No. 31069, in force from 1 July 2020. It sets minimum procedures for the management of banks' information systems and electronic banking services, and covers cyber incident management, penetration testing, cyber threat intelligence sharing, outsourced services and information systems continuity. It does not name ISO/IEC 27001, ISO/IEC 22301 or any other ISO standard. | |
| Central Bank of the Republic of Türkiye (CBRT) Payment and electronic money institutions | Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (Ödeme ve Menkul Kıymet Mutabakat Sistemleri, Ödeme Hizmetleri ve Elektronik Para Kuruluşları Hakkında Kanun), published in the Official Gazette of 27 June 2013, No. 28690. The CBRT's website carries payment systems and payment services sections. Secondary rules under the Law, and any information-security or card-data expectations in them, are set by the CBRT and should be confirmed there. | |
| Presidency of the Republic; Digital Transformation Office Public bodies and critical infrastructure operators | Presidential Circular No. 2019/12 on Information and Communication Security Measures, published in the Official Gazette of 6 July 2019, No. 30823. It lists measures such as storing critical data domestically, limits on cloud storage of public-body data, secure software development and security testing before use, and provides for an Information and Communication Security Guide with graded security levels, prepared under the Digital Transformation Office, which public bodies and critical-infrastructure operators must follow for new information systems and which they must audit at least once a year. It refers to national and international standards generally and names no ISO standard. | |
| Cyber Security Presidency (Siber Güvenlik Başkanlığı) All organisations present in cyberspace; public bodies and critical infrastructure | Cyber Security Law No. 7545 (Siber Güvenlik Kanunu), accepted on 12 March 2025 and published in the Official Gazette of 19 March 2025, No. 32846, in force on publication. It covers public bodies, public professional organisations, natural and legal persons and unincorporated bodies that operate or provide services in cyberspace. The Presidency's tasks include raising the cyber resilience of critical infrastructure and information systems, vulnerability and penetration testing, certification and authorisation of cyber security specialists and companies, cyber security audits with sanctions, and technical criteria for cyber security products and services used by public bodies and critical infrastructure. The Law contemplates implementing regulations, whose current state should be confirmed with the Presidency. | |
| Ministry of Agriculture and Forestry Food and feed businesses | Law No. 5996 on Veterinary Services, Plant Health, Food and Feed (Veteriner Hizmetleri, Bitki Sağlığı, Gıda ve Yem Kanunu), published in the Official Gazette of 13 June 2010, No. 27610, and the Food Hygiene Regulation (Gıda Hijyeni Yönetmeliği), published in the Official Gazette of 17 December 2011, No. 28145. The Regulation requires a food business operator, for stages after primary production, to put in place, apply and maintain procedures based on the HACCP principles, lists the seven HACCP principles and requires documents and records proportionate to the business. | HACCP |
| Turkish Medicines and Medical Devices Agency (TİTCK), under the Ministry of Health Medical devices and in vitro diagnostics | Medical Device Regulation (Tıbbi Cihaz Yönetmeliği) and In Vitro Diagnostic Medical Device Regulation (İn Vitro Tanı Amaçlı Tıbbi Cihaz Yönetmeliği), issued by TİTCK and published in the Official Gazette of 2 June 2021, No. 31499 (repeated issue). TİTCK's website lists medical devices among its areas of activity. How a manufacturer's quality management system is assessed under these regulations is set by the regulations and the conformity assessment route chosen, and should be confirmed with TİTCK. | |
| Ministry of Labour and Social Security Employers in all sectors | Occupational Health and Safety Law No. 6331 (İş Sağlığı ve Güvenliği Kanunu), published in the Official Gazette of 30 June 2012, No. 28339. It is the national framework law for workplace health and safety; the Ministry of Labour and Social Security's website is the place to find its implementing regulations. | |
| Ministry of Energy and Natural Resources; Energy Market Regulatory Authority (EPDK) Emitters and energy users | Climate Law No. 7552 (İklim Kanunu), accepted on 2 July 2025 and published in the Official Gazette of 9 July 2025, No. 32951, in force on publication; it aims at net zero emissions, provides for reducing greenhouse gas emissions and for an Emissions Trading System, and defines allowances and offsetting. Energy Efficiency Law No. 5627 (Enerji Verimliliği Kanunu), published in the Official Gazette of 2 May 2007, No. 26510, is the framework law for energy efficiency. Obligations for a given enterprise sit in the regulations made under these laws. | |
| Turkish Standards Institution (TSE) National standardisation | TSE states that it was founded on 16 October 1954, joined ISO on 26 May 1955 and the IEC on 1 January 1956, and completed its establishment under Law No. 132 of 18 November 1960 with the purpose of preparing standards for materials, products, procedures and services. It describes itself as a public institution with legal personality, managed under private-law provisions and related to the Ministry of Industry and Technology. TSE is named here as the national standards body only. |
Accreditation and recognition
- TÜRKAK (Turkish Accreditation Agency): National accreditation body — Global ACI lists TÜRKAK (Turkish Accreditation Agency, Ankara) as a full member and Global ACI MRA signatory.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Law and the Public Procurement Authority (Public Procurement Authority (Kamu İhale Kurumu, KİK), with tenders published through its electronic public procurement platform (EKAP)): Public Procurement Law No. 4734, published in the Official Gazette of 22 January 2002, No. 24648, lets a contracting authority ask tenderers for qualification documents including documents on production capacity and quality assurance practices, documents on the staff or institutions responsible for quality control, and certificates granted by quality control institutions accredited under international rules that certify conformity with the standards specified in the procurement document. The authority states in the tender documents which of these it requires, so an ISO certificate is a tender-by-tender requirement, not a general one.
- Defence and aerospace programmes (Presidency of Defense Industries (Savunma Sanayii Başkanlığı, SSB)): SSB's website lists national programmes in land, naval and air platforms, unmanned systems, electronic warfare and radar, engines, weapons and cyber security, and has an industrial participation and offset section. Quality and cyber-security requirements for suppliers come from the prime contractor and the programme, so the contract documents are the place to confirm whether AS9100, ISO 9001 or ISO/IEC 27001 is expected.
Economic zones
- Technology development zones (technoparks): software, research and development, design, high-technology products
- Organised industrial zones: manufacturing
- Free zones: export manufacturing, logistics
- Industrial zones: large-scale and integrated industrial investment
Sterling in Türkiye
Sterling delivers in Türkiye from its Dubai office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Türkiye, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Turkish clients ask
Which accreditation should a certification body hold for Türkiye?
Look for accreditation by TÜRKAK, the Turkish Accreditation Agency, which Global ACI lists as a full member and mutual recognition signatory. Its entry shows management systems recognition for ISO 9001 from 2007, ISO 14001 from 2008, ISO/IEC 27001, ISO 22000 and ISO 13485 from 2018, and ISO 45001 and ISO 50001 from 2020. For any other standard, ask the certification body to show its accreditation certificate and scope.
Is Türkiye's personal data protection law in force, and who regulates it?
Yes. Law No. 6698 on the Protection of Personal Data was published in the Official Gazette on 7 April 2016 and has been amended since, including by Law No. 7499 in March 2024. The Personal Data Protection Authority, headquartered in Ankara, regulates it through a nine-member Board and keeps the Data Controllers' Registry. Confirm how it applies to your organisation with your counsel or the Authority.
Are certification audits in Türkiye conducted in Turkish?
Usually in Turkish, unless agreed otherwise. The Constitution states that the language of the Turkish State is Turkish, so many procedures, contracts and shop-floor interviews run in it, while international customers often want key documents in English. Settle the audit language, any interpreter and the language of controlled documents with the certification body at application, and say early which records exist in which language.
Do Turkish public tenders require ISO certificates?
Not as a blanket rule. The Public Procurement Law lets a contracting authority ask tenderers for documents on quality assurance practices and for certificates from accredited quality control institutions showing conformity with the standards named in the tender documents, and each authority decides which to require. Read the qualification section of every tender document before investing in a certificate.
Which rules cover information systems at Turkish banks?
The Banking Regulation and Supervision Agency issued the Regulation on Information Systems of Banks and Electronic Banking Services, published in the Official Gazette on 15 March 2020 and in force from 1 July 2020. It covers information systems management, cyber incident handling, penetration testing and outsourced services, and it names no ISO standard. Banks should confirm current supervisory expectations with the Agency.
What does the Cyber Security Law mean for businesses?
Law No. 7545 was accepted on 12 March 2025 and took effect on publication in the Official Gazette of 19 March 2025. It reaches organisations operating or serving in cyberspace and gives the Cyber Security Presidency tasks that include cyber security audits and technical criteria for products and services used by public bodies and critical infrastructure. Implementing regulations matter, so check their current state with counsel or the Presidency.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, KVKK) — kvkk.gov.tr; mevzuat.gov.tr (accessed 11 Oct 2026)
- Personal Data Protection Authority tools: Data Controllers' Registry (VERBİS), breach notification, standard contract notification and binding corporate rules — kvkk.gov.tr (accessed 11 Oct 2026)
- Regulation on Information Systems of Banks and Electronic Banking Services (Bankaların Bilgi Sistemleri ve Elektronik Bankacılık Hizmetleri Hakkında Yönetmelik), issued by BDDK under Banking Law No. 5411, published in the Official Gazette of 15 March 2020, No. 31069, in force from 1 July 2020. It sets minimum procedures for the management of banks' information systems and electronic banking services, and covers cyber incident management, penetration testing, cyber threat intelligence sharing, outsourced services and information systems continuity. It does not name ISO/IEC 27001, ISO/IEC 22301 or any other ISO standard. — resmigazete.gov.tr (accessed 11 Oct 2026)
- Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions (Ödeme ve Menkul Kıymet Mutabakat Sistemleri, Ödeme Hizmetleri ve Elektronik Para Kuruluşları Hakkında Kanun), published in the Official Gazette of 27 June 2013, No. 28690. The CBRT's website carries payment systems and payment services sections. Secondary rules under the Law, and any information-security or card-data expectations in them, are set by the CBRT and should be confirmed there. — resmigazete.gov.tr; tcmb.gov.tr (accessed 11 Oct 2026)
- Presidential Circular No. 2019/12 on Information and Communication Security Measures, published in the Official Gazette of 6 July 2019, No. 30823. It lists measures such as storing critical data domestically, limits on cloud storage of public-body data, secure software development and security testing before use, and provides for an Information and Communication Security Guide with graded security levels, prepared under the Digital Transformation Office, which public bodies and critical-infrastructure operators must follow for new information systems and which they must audit at least once a year. It refers to national and international standards generally and names no ISO standard. — resmigazete.gov.tr (accessed 11 Oct 2026)
- Cyber Security Law No. 7545 (Siber Güvenlik Kanunu), accepted on 12 March 2025 and published in the Official Gazette of 19 March 2025, No. 32846, in force on publication. It covers public bodies, public professional organisations, natural and legal persons and unincorporated bodies that operate or provide services in cyberspace. The Presidency's tasks include raising the cyber resilience of critical infrastructure and information systems, vulnerability and penetration testing, certification and authorisation of cyber security specialists and companies, cyber security audits with sanctions, and technical criteria for cyber security products and services used by public bodies and critical infrastructure. The Law contemplates implementing regulations, whose current state should be confirmed with the Presidency. — resmigazete.gov.tr (accessed 11 Oct 2026)
- Law No. 5996 on Veterinary Services, Plant Health, Food and Feed (Veteriner Hizmetleri, Bitki Sağlığı, Gıda ve Yem Kanunu), published in the Official Gazette of 13 June 2010, No. 27610, and the Food Hygiene Regulation (Gıda Hijyeni Yönetmeliği), published in the Official Gazette of 17 December 2011, No. 28145. The Regulation requires a food business operator, for stages after primary production, to put in place, apply and maintain procedures based on the HACCP principles, lists the seven HACCP principles and requires documents and records proportionate to the business. — resmigazete.gov.tr (accessed 11 Oct 2026)
- Medical Device Regulation (Tıbbi Cihaz Yönetmeliği) and In Vitro Diagnostic Medical Device Regulation (İn Vitro Tanı Amaçlı Tıbbi Cihaz Yönetmeliği), issued by TİTCK and published in the Official Gazette of 2 June 2021, No. 31499 (repeated issue). TİTCK's website lists medical devices among its areas of activity. How a manufacturer's quality management system is assessed under these regulations is set by the regulations and the conformity assessment route chosen, and should be confirmed with TİTCK. — resmigazete.gov.tr; titck.gov.tr (accessed 11 Oct 2026)
- Occupational Health and Safety Law No. 6331 (İş Sağlığı ve Güvenliği Kanunu), published in the Official Gazette of 30 June 2012, No. 28339. It is the national framework law for workplace health and safety; the Ministry of Labour and Social Security's website is the place to find its implementing regulations. — resmigazete.gov.tr; csgb.gov.tr (accessed 11 Oct 2026)
- Climate Law No. 7552 (İklim Kanunu), accepted on 2 July 2025 and published in the Official Gazette of 9 July 2025, No. 32951, in force on publication; it aims at net zero emissions, provides for reducing greenhouse gas emissions and for an Emissions Trading System, and defines allowances and offsetting. Energy Efficiency Law No. 5627 (Enerji Verimliliği Kanunu), published in the Official Gazette of 2 May 2007, No. 26510, is the framework law for energy efficiency. Obligations for a given enterprise sit in the regulations made under these laws. — resmigazete.gov.tr; enerji.gov.tr (accessed 11 Oct 2026)
- TSE states that it was founded on 16 October 1954, joined ISO on 26 May 1955 and the IEC on 1 January 1956, and completed its establishment under Law No. 132 of 18 November 1960 with the purpose of preparing standards for materials, products, procedures and services. It describes itself as a public institution with legal personality, managed under private-law provisions and related to the Ministry of Industry and Technology. TSE is named here as the national standards body only. — tse.org.tr (accessed 11 Oct 2026)
- TÜRKAK (Turkish Accreditation Agency) — global-aci.org; turkak.org.tr (accessed 11 Oct 2026)
- Public procurement under the Public Procurement Law and the Public Procurement Authority — kik.gov.tr; dosyalar.kik.gov.tr (accessed 11 Oct 2026)
- Defence and aerospace programmes — ssb.gov.tr (accessed 11 Oct 2026)
- Technology development zones (technoparks) — invest.gov.tr; resmigazete.gov.tr
- Organised industrial zones — invest.gov.tr
- Free zones — invest.gov.tr
- Industrial zones — invest.gov.tr
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice