KVKK-Compliant B2B Cold Email: The Legal Boundaries

For B2B sales teams in Turkey, cold email remains one of the most scalable outbound channels. But the answer to "Am I allowed to email this person?" doesn't come from a single law. It sits across two separate but overlapping regulations: Law No. 6698 on the Protection of Personal Data (KVKK) and Law No. 6563 on the Regulation of Electronic Commerce, along with the commercial electronic message rules issued under it. Many teams confuse the two. They assume that measures taken for one also satisfy the other, or they operate on half-truths like "B2B doesn't require consent."

In this article, we walk through the legal boundaries that apply when you set up cold email campaigns, where the gray areas lie, and how to manage them operationally, with concrete steps. Let's be clear from the outset: this content is for general information only and does not constitute legal advice. As your campaigns grow in scale, we recommend having your processes reviewed by a data protection lawyer.

Two Separate Legal Layers in Cold Email

When you send a cold email, you're actually carrying out two different activities:

You process personal data. You find a person's name, job title, company and email address, add them to a list, import them into your CRM, enrich the record and store it. This part falls under KVKK.
You send a commercial electronic message. You deliver a message promoting your product or service through an electronic channel. This part falls under Law No. 6563 and the Regulation on Commercial Communication and Commercial Electronic Messages.

This distinction has a critical consequence. Even if your sending is legitimate under commercial message rules, the way you obtained and store the data may still violate KVKK. The reverse is also possible: you might be processing the data in line with KVKK but breach the commercial message rules because you don't offer a way to opt out. A compliant outbound process checks both layers independently.

What Counts as Personal Data?

KVKK protects only data relating to natural persons. Information about legal entities, i.e. companies, does not by itself qualify as personal data. In B2B sales, this distinction plays out as follows:

Generic addresses such as [email protected], [email protected], [email protected] are, as a rule, not personal data as long as they don't identify a specific individual.
Corporate addresses containing a first and last name, such as [email protected], are personal data because they directly identify a specific natural person. The fact that the address uses a corporate domain doesn't change this.
A person's name, job title, LinkedIn profile URL, direct phone number and role at the company are also personal data.

In other words, the attitude "We do B2B, so KVKK doesn't concern us" is wrong. By its very nature, outbound targets not a company but the decision-maker within that company. And that decision-maker is a natural person.

The Merchant and Tradesperson Exemption: What It Covers and What It Doesn't

The core rule of Law No. 6563 is that commercial electronic messages may be sent only with the recipient's prior consent. The legislation makes an important exception to this rule: Commercial electronic messages may be sent to tradespeople and merchants without prior consent. Even in that case, however, the recipient's right to opt out is preserved. The recipient must be able to stop the messages at any time.

The legal basis for B2B cold email in Turkey rests largely on this exemption. Still, it's essential to understand its limits:

The exemption relates to commercial message legislation. It doesn't eliminate your KVKK obligations. Being able to send without consent doesn't mean you can process personal data however you like.
The recipient must be addressed in their capacity as a merchant or tradesperson. Presenting an offer related to the company's needs to a company's purchasing manager fits within this framework. Writing to the same person's personal Gmail address as if they were an individual consumer, however, requires a separate assessment and is a risky area.
Whether a company employee qualifies as a "merchant" can be debatable. Merchant status essentially belongs to the company. While writing to an employee at their corporate address about the company's business is a widely accepted practice, legal interpretations vary. That's why focusing the message content on the company's business needs rather than on the individual is a stronger footing, both legally and from a sales perspective.
Be careful with individual professionals. Self-employed consultants, freelancers or individuals without a company may not hold merchant/tradesperson status. Sending them unsolicited commercial messages may fall outside the exemption.

The practical rule is this: If your target audience is addressed in their corporate capacity, through a corporate channel and in relation to the company's business needs, you can rely on the exemption. For any segment that falls outside this framework, carry out a separate assessment.

Legal Basis Under KVKK: Which Conditions Are You Relying On?

Article 5 of KVKK states that personal data may be processed only if one of certain conditions is met. Obtaining explicit consent for cold email is practically impossible. After all, you're writing precisely to make first contact. That's why B2B outbound usually focuses on two conditions.

1. Data Made Public by the Data Subject

If a person has made their contact details publicly available themselves (for example, on a team page on the company website, a conference speaker profile or a contact address published for business purposes), that data can be processed under certain conditions. But there's a very important limit here: Data made public may only be processed in a way that is compatible with the purpose for which it was made public.

To give some examples:

If a purchasing manager has published their email address on the company website "for supplier applications," writing to them with a relevant supply offer is compatible with that purpose.
If an engineer has shared their email address for technical communication on an open-source project, adding that same address to an unrelated sales campaign list may go beyond the purpose for which it was made public.

The assumption that "any information found on the internet is fair game" doesn't hold up under KVKK.

2. Legitimate Interest

KVKK permits data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. This is the most commonly used basis in B2B outbound. To rely on legitimate interest, you need to carry out a balancing test and document it:

What is your interest? Example: "Introducing our route optimization software to operations managers at logistics companies."
Is the processing necessary for that interest? If name, job title, company and corporate email are sufficient, don't collect data such as date of birth, personal social media accounts or home address.
What is the person's reasonable expectation? An operations manager can reasonably expect to receive software offers related to their work. Sending the same person offers related to their hobbies goes beyond that expectation.
How are the person's rights protected? Safeguards such as an opt-out option, a privacy notice and a fast deletion process tip the balance in your favor.

Putting this assessment in writing in a one-page document for each campaign significantly strengthens your position in the event of a complaint or an investigation by the Board.

The Duty to Inform: What to Include in the First Email

Article 10 of KVKK requires the data controller to inform individuals about the data processing activity. If the data was obtained not directly from the person but from another source, the information must be provided within a reasonable period and at the first point of contact. In cold email, this means the first message is a natural moment to provide this notice.

However, turning the email itself into a legal text kills conversion. The practical solution is to add a short notice at the bottom of the message and link to the privacy notice on your website for details. An example structure:

Hi Ayşe,

We often hear that route planning in logistics operations creates an average of several hours of manual work per week. I was curious how your team handles this process. Would you be open to a quick call?

Best regards,

Mert

We obtained your contact details from your company's publicly available sources and process them solely to share our business offer. For details on how your personal data is processed, please see our privacy notice. If you'd prefer not to receive emails like this, simply reply to this message with "unsubscribe."

At a minimum, your privacy notice should include:

The identity of the data controller (company name and contact details)
The purpose for which the data is processed
The source from which and the method by which the data was obtained
The legal basis (legitimate interest and/or data made public)
To whom the data may be transferred (including CRM, email infrastructure and enrichment providers)
The data subject's rights under Article 11 of KVKK and how to submit a request

If you use AI to personalize your message copy, we recommend adding this notice as a fixed footer to the prompt structures described in our guide to writing cold emails with AI. That way, you can be sure the notice appears in every variation.

Opt-Out Rights, İYS and Deadlines

Even if you're sending under the merchant/tradesperson exemption, exercising the right to opt out must be easy and free of charge. The legislation requires sending to stop within three business days of the opt-out request being submitted. Operationally, this means:

Every email must include a clear opt-out method. Replying "unsubscribe," a one-click unsubscribe link, or both can be used.
When an opt-out request comes in, the person must be removed from all sequences and from future campaign lists. Removing them only from the current sequence isn't enough.
A suppression list should be maintained and checked against every new list upload.

The Message Management System (İYS) is the system where consents and opt-outs for commercial electronic messages are managed centrally. Service providers' obligation to register with İYS, and how opt-outs submitted via İYS should be checked for messages sent to merchant/tradesperson recipients, are subject to detailed rules depending on sending volume and channel. Clarify your own situation with your legal advisor. Also make it part of your process to regularly sync opt-out records from İYS into your suppression list.

There's a deadline obligation on the KVKK side as well. When a data subject asks "What data do you hold about me?" or "Delete my data," you must resolve the request within 30 days at the latest. To keep these requests from getting lost in a sales rep's inbox, it's important to route them through a dedicated email address or form and keep a record of them.

Data Sources, Enrichment and Cross-Border Transfers

The issue outbound teams overlook most is that the tools they use are themselves a data processing activity. If you use a B2B data platform to build lead lists, an email verification tool, a CRM and sending infrastructure, personal data passes through each of these systems.

Questions to Ask When Choosing a Source

From which sources, and on what legal basis, does the provider collect data?
Does it have a mechanism for individuals to request deletion or correction of their records?
Does it offer a data processing agreement (DPA)?
In which country are the data stored on servers?

For example, large B2B contact databases like Apollo.io greatly speed up segment-based list building and contact verification. However, the responsibility for using the data the tool provides is yours. You decide which fields you export, how long you keep them and whom you send to.

Cross-Border Transfers

Most sales technology tools are hosted abroad. Article 9 of KVKK reshaped the cross-border transfer regime with an amendment made in 2024. Under the current framework, one of the key safeguards for transfers to countries without an adequacy decision is the standard contracts published by the Board. Once a standard contract is signed, it must be notified to the Authority within five business days.

What you need to do in practice:

Build an inventory of all the sales tools you use (data sources, verification, CRM, sending, automation, AI services).
Note where each one hosts its data.
For those involving cross-border transfers, determine the appropriate transfer mechanism and complete the required contract and notification steps.
Clearly disclose this transfer in your privacy notice.

Especially if you connect multiple tools in your workflows, data can end up copied into five or six different systems without you noticing. As described in our guide to B2B sales automation with n8n, making visible which fields are passed along at each step when designing workflows benefits both compliance and data quality. A self-hosted automation layer also gives you more control over which servers your data travels through.

Data Minimization, Retention and Disposal

Among KVKK's general principles are that data must be relevant, limited and proportionate to the purpose and retained only for as long as necessary. In outbound, these principles can be turned into concrete rules.

For minimization:

The fields sufficient for first contact are usually: first name, last name, job title, company, corporate email and company website.
Don't collect fields like personal mobile number, personal email, age or photo just because they "might come in handy."
When enriching data, focus on signals related to the company rather than the person: industry, headcount, technologies used, news of new investments. These signals are less sensitive and usually more useful for personalization.

A sample retention and disposal policy:

Non-responders: After a set period following the end of the sequence (e.g. 6 months), personal fields are deleted or anonymized. Only company-level information is kept.
Opt-outs: The personal profile is deleted. Only the minimum information needed to avoid emailing them again (e.g. the email address itself) is kept on the suppression list.
Positive responders: The person has now become an opportunity, and the record becomes part of the pipeline process. From this point on, the retention period is determined by the nature of the business relationship.

Making this distinction clear in your CRM is directly tied to defining your pipeline stages correctly. If you clarify stages such as "first contact," "awaiting reply," "opted out" and "qualified opportunity" when defining your sales pipeline stages, it becomes easier to attach a separate retention rule to each stage and automate disposal.

A Step-by-Step KVKK-Compliant Outbound Workflow

Here's a sample workflow that brings together all of the elements above:

Define the target audience: Put the campaign's goal and target segment in writing. Example: "Operations and logistics managers at e-commerce companies in Turkey with 50–500 employees."
Balancing test: Assess on a single page how writing to this segment relates to your legitimate interest and what people's reasonable expectations are.
Source selection: Decide where you'll get the data: company websites, a B2B data platform, or event attendee lists (only if the sharing terms allow it). Store each record's source as a field.
Filtering: Remove personal email domains (gmail.com, hotmail.com, etc.) and individual profiles that may not fall under the merchant/tradesperson exemption from the list.
Suppression check: Check the list against past opt-out records and opt-outs from İYS.
Minimization: Delete unnecessary columns before importing.
Message and footer: Add a fixed privacy notice and opt-out method to the personalized copy.
Sending discipline: Start with a reasonable volume. Warming up with a few dozen sends per domain per day and ramping up gradually is a common practice that reduces both deliverability issues and complaint risk.
Opt-out handling: Set up a rule that automatically detects opt-out replies and removes the person from all sequences. Aim to process them well within the three-business-day limit, ideally the same day.
Data subject requests: Route KVKK requests to a separate channel, log them and respond within 30 days.
Periodic disposal: Run an automation that deletes or anonymizes records whose retention period has expired, on a monthly or quarterly basis.
Documentation: Keep the balancing test, tool inventory, privacy notice and disposal records up to date in a single folder.

Steps 4, 5, 9 and 11 of this workflow can be almost fully automated. As long as they remain manual, they're also the steps most often skipped.

Common Mistakes

Assuming "KVKK doesn't apply to B2B": If a corporate address contains a first and last name, the data is personal.
Mistaking the merchant exemption for a KVKK exemption: The exemption removes the consent requirement, not your data protection obligations.
Removing an opt-out only from the current sequence: If the person receives another email three months later in a different campaign, you'll face both legal and reputational problems.
Buying lists of unknown origin: If you can't explain how the data was collected, you can't explain your legal basis either.
Writing to personal email addresses: This is where the merchant exemption is weakest.
Sending without a privacy notice: A short note and link in the footer is the lowest-cost compliance measure there is.
Keeping data forever: Thousands of records kept with a "maybe we'll reach out again someday" mindset multiply your risk in the event of a data breach.
Ignoring cross-border transfers: Almost every sales technology tool may fall within this scope.

Quick Checklist

Before launching a campaign, you should be able to answer "yes" to all of these questions:

Is the target audience being addressed in their corporate capacity and through a corporate channel?
Has a written legitimate interest balancing test been carried out?
Is the data source of each record known and recorded?
Has the list been checked against suppression and İYS opt-out records?
Have unnecessary data fields been removed?
Does the email include a privacy notice and an easy opt-out method?
Are opt-out requests processed within three business days at the latest?
Is there a process to track the 30-day deadline for KVKK requests?
Has the cross-border transfer status of the tools used been assessed?
Are retention periods defined and is disposal automated?

If you'd rather have your entire outbound operation managed externally instead of building this infrastructure in-house, our group company focused on B2B SaaS companies, SAAS Corner's outbound sales and lead generation service, can take on the process end to end, from list building to sequence management.

Conclusion

KVKK-compliant cold email isn't an obstacle that slows outbound down. When set up correctly, it means cleaner lists, more precise targeting and fewer complaints. In short: on the commercial message side, know the limits of the merchant/tradesperson exemption and fully honor the right to opt out. On the KVKK side, document your legal basis, provide notice in the first email, process only the data you need, check your tools' cross-border transfer status and stick to your retention periods.

Most of these steps can be run through well-built automations without leaving them to human error. Suppression checks, opt-out handling, privacy notice footers and periodic disposal top the list. To make your outbound processes both efficient and compliant, schedule a call with Sales Corner and let's review your workflow together.