In Whose Hands Is Our Data?

Türkiye’s Cloud Sovereignty Question

Imagine an entrepreneur who launches a small e-commerce business in Türkiye. Products are selling, customer data is flowing, things are going well. But where is that customer data actually stored? On which country’s servers? Subject to which laws? Most entrepreneurs do not know the answer. They simply say “in the cloud” and move on.

This uncertainty, however, is not just a concern for small businesses. The data held by Türkiye’s banks, hospitals, and public institutions also sits “somewhere” in the cloud. And that “somewhere” is often outside Türkiye’s borders — meaning the laws that actually govern that data are not Türkiye’s laws.

Who Holds the Digital Title Deed?

The advantages of cloud computing are undisputed. But that is no longer the real question. The real question is: when institutions use this cloud, how much control can they retain over their own data?

A concrete example: suppose a bank in Türkiye stores customer data with a U.S.-based cloud provider. When the U.S. government requests access to that data under the CLOUD Act, the Turkish bank has few options. Because physical and legal control of the data is not in Türkiye. The issue is no longer “the most affordable cloud”; it has become a question of whose legal system the data is subject to, whose hardware it sits on, and whose software processes it.

The Current Picture in Türkiye

Türkiye is not starting from scratch on this. The Personal Data Protection Law (KVKK) has been in force since 2016, and the 2024 amendments modernized the cross-border data transfer regime. Cybersecurity Law No. 7545 came into force in March 2025. The Banking Regulation and Supervision Agency (BDDK) requires banks to keep their systems within the country. The Digital Transformation Office is developing a certification mechanism for public cloud services. Türk Telekom–TÜBİTAK BİLGEM is developing a domestic cloud platform, and the HIT-30 Program targets more than 30 billion USD in high-technology investment by 2030.

However, these steps are advancing independently of one another. A framework that evaluates cloud services through a holistic sovereignty lens does not yet exist. It is precisely from this need that an eight-dimensional Cloud Sovereignty Objectives (CSO / BEH) framework can be defined.

Cloud Sovereignty Objectives (CSO / BEH)

The table below summarizes the eight fundamental dimensions along which cloud service providers should be evaluated from a digital sovereignty perspective.

Sovereignty Assurance Levels (TEGS)

Each objective is assessed on a five-tier assurance scale. TEGS-0 indicates that no sovereignty assurance is provided, while TEGS-4 indicates that full digital sovereignty has been achieved.

Assessment Weightings

The weight of each sovereignty objective in the overall score is shown below. The highest weight is assigned to supply chain sovereignty, because control over the origin of hardware and software directly affects every other dimension.

Data Sovereignty ≠ Data Localization

Data sovereignty does not simply mean “keeping data within the country.” It means retaining genuine legal, technical, and operational control over the data itself. Data may physically reside in Türkiye, but if encryption keys are held by a company in another country, if source code is not accessible, or if you depend on a foreign provider for security patches, it becomes difficult to speak of sovereignty at all. Making this distinction clearly is a fundamental prerequisite for a sound assessment framework.

The Role of the Domestic Ecosystem

Sovereignty is not achieved merely by building massive data centers. Domestic alternatives across a wide spectrum — from the backup solutions and file sharing platforms institutions use every day, to video surveillance infrastructure and object storage services — are also a critical part of sovereignty. Because what actually determines where data flows is often these “ordinary” looking tools.

As part of this ecosystem, Narbulut offers a broad product portfolio ranging from backup software and object storage to a document collaboration platform and cloud-based video surveillance solutions, enabling institutions to keep their data within Türkiye’s borders and subject to Turkish law. The strengthening of such domestic companies carries strategic value on a par with large infrastructure investments.

Conclusion

The pieces are on the table: the legislation exists, the investment plans exist, domestic companies exist, political will exists. What is missing is a holistic perspective that connects them. The later this perspective takes shape, the more data will have moved beyond Türkiye’s control.

Digital sovereignty is as strategic a matter as independence in the defense industry. Just as a missile shield cannot be borrowed from someone else, neither can data sovereignty. The only difference: the absence of a missile shield is visible to everyone. The absence of data sovereignty is only noticed once it is too late.

Author: Bahri Uludağ – Information Technology Manager