Your data becomes an asset through a contract.

The contractual layer of data

Data is an asset that nobody owns in the classical sense and whose value is established by contract. Who may access it, for what purpose it may be used, who owns the derivative products, what happens when the relationship ends — where the answers are not written down, a valuable dataset has no legal protection at all.

Licensing begins with classification. Where a dataset contains personal data, the legal basis and the purpose limitation decide what can be done with it; anonymisation properly carried out frees the dataset, but it has to pass a technical test and a legal one. For mixed datasets we design a field-by-field separation — a core practice of our Data focus area.

From flow map to a living template set

Five steps. Data-flow mapping: which data enters and leaves the company, and through which counterparties. Classification: each flow is labelled personal, anonymised or mixed under the KVKK (Law No. 6698) and the GDPR, because the label decides the contract type. Template architecture: DPAs, sharing agreements and licence models are built as a coherent bilingual set, with a fallback matrix for negotiations. Negotiation support: the counterparty's paper is reviewed against your standard and deviations are priced. Renewal and monitoring: usage rights, audit clauses and the return of data on termination are tracked over the life of the contract. Deliverables: the contract inventory, the template set and the fallback matrix.

Typical data businesses and group flows

Typical clients: SaaS and platform companies whose product is inseparable from data, mobility and IoT businesses monetising telemetry, publishers licensing archives, and Turkish-German groups moving datasets between affiliates. In the group scenario, the intra-group agreements and the transfer instruments under Article 9 of the KVKK are designed as one package with our cross-border data transfer practice; where the dataset carries personal data at scale, the architecture is anchored in the KVKK/GDPR compliance programme.

The ground under these arrangements has filled up quickly. Since 2025 the Data Act has applied a user right of access to the data generated by connected products and related services, fair terms for sharing it, and rules easing the switch between cloud providers; terms imposed unilaterally are open to unfair-terms review. On the personal data layer, the decisive points are the mandatory content of the KVKK/GDPR processing agreements and the instruments relied on for transfers abroad. In Turkish law the investment in a database is supported by the sui generis protection under the Law on Intellectual and Artistic Works (FSEK, No. 5846); for non-personal sets such as sensor and log data, protection is built essentially through contract and the trade secret regime. Which layer applies is marked field by field, for every data set.