The three-layer compliance model
Selling from Türkiye to consumers in the EU requires managing three separate compliance layers at the same time: tax (VAT and customs), data (GDPR and e-privacy) and consumer (distance selling and return rules). If one of the layers is missing, the result is either cost (double VAT, penalties) or lost sales (cart abandonment, platform sanctions).
Practical guidance
If the IOSS number is not entered correctly into the shipment data, your customer pays VAT a second time at the door — a wave of returns and complaints becomes inevitable. Test your logistics integration.
Enter the EU market in compliance
From tax registrations to sales copy, our International E-Commerce Focus Area sets up your market entry in a single plan.
The tax layer: IOSS, OSS and deemed supplier
The EU’s e-commerce VAT package has removed the low-value consignment exemption: every imported B2C consignment is subject to VAT. For consignments up to €150, IOSS registration lets you collect VAT at the point of sale, pay it with a single return, and speeds up customs clearance. Note: the customs-duty relief for consignments up to €150 was abolished on 1 July 2026 (Council Regulation (EU) 2026/382); until 1 July 2028 a flat customs duty of €3 per item applies to those consignments. The €150 IOSS threshold for VAT is unchanged. If you hold stock within the EU (e.g. a fulfilment warehouse), local registration in the warehouse country plus OSS for sales to other countries comes into play. For sales through a marketplace, in many scenarios the platform is the party liable for VAT (deemed supplier) — but this affects your pricing and invoicing flow; it does not exempt you from registration.
The data layer: GDPR
Selling to customers in the EU makes GDPR directly applicable: an EU representative under Art. 27, a GDPR-compliant information notice and cookie/consent layer, marketing permissions, and transfer safeguards (standard contractual clauses) for the data flow to your systems in Türkiye. Your KVKK (Turkish Personal Data Protection Law) compliance provides a foundation; however, the gaps with GDPR must be closed.
The consumer layer: distance selling and returns
Under EU rules, the consumer generally has a 14-day right of withdrawal without giving reasons; this period is extended if the prior information is incomplete. Return costs, delivery times and warranty terms must be presented in texts that comply with the language and rules of the target country. Country-specific obligations such as packaging registration (LUCID) for Germany must be added to the checklist.
Market-entry checklist
1) Tax registrations according to the sales model (IOSS/OSS/local); 2) IOSS data-integration testing with the logistics provider; 3) GDPR representative and set of texts; 4) multilingual sales and return policies; 5) marketplace verification documents; 6) country-specific registrations. These six steps must be completed before the first order.
The platform layer: the rules of selling on a marketplace
Selling on EU marketplaces adds a fourth layer: platform compliance. The DSA imposes a seller-verification (KYBC) obligation on marketplaces — the documents evidencing your identity, registry and bank details must be up to date and consistent; inconsistency is the most common technical reason for account suspension. In the event of suspension, the platform is obliged to give reasons and provide an appeal route; the appeal file must be built with orderly evidence and correspondence. On the Turkish side, the ETBİS registration and İYS approval regime of Law No. 6563 (Turkish E-Commerce Law) continue to bind your domestic operation — the two regimes must be combined into a single compliance plan. If you sell connected products, the data-access rules of the Data Act also touch your product contracts.
As you scale: structural decisions
Moving from a few hundred orders a month to thousands brings three structural questions to the fore. Warehousing/fulfilment: holding stock within the EU shortens delivery times but creates a local VAT registration in the warehouse country. Product-safety (GPSR) duties and, for connected products, Data Act duties are independent of the warehouse: they apply to anyone placing the product on the EU market. Incorporation: beyond a certain turnover and return volume, an EU company (usually a GmbH in Germany) becomes advantageous in terms of tax, platform trust and logistics contracts. Brand protection: as sales grow, so does the risk of counterfeiting; EU trademark registration and platform complaint mechanisms must be part of your intellectual property strategy. Each of these decisions is modelled together in the single work plan of our International E-Commerce Focus Area.
The Köksal approach
With our tax team we handle the VAT registrations, with our data team the GDPR/KVKK layer, and with our Germany and United Kingdom Regional Desks the local obligations — all closed off in a single checklist. From marketplace suspension appeals to fulfilment contracts, we build your operation to be resilient at scale.
Conclusion
E-commerce to the EU is a scalable revenue channel when set up well, and an operation that generates returns and penalties when set up badly. Companies that build the tax, data, consumer and platform layers into a single plan see the difference in the first quarter — and do not have to rebuild the structure as they grow.
