KVKK and B2B Cold Email: What Can You Do?

B2B cold email is not prohibited under KVKK in Turkey. However, an employee's corporate email address that contains their first and last name is personal data. To process it, you need a valid legal basis, a privacy notice provided at first contact and an opt-out mechanism that is easy to use. On top of that, Law No. 6563 on Electronic Commerce (ETK), which governs commercial messages, and the obligations of the Message Management System (İYS) also come into play. A well-designed, targeted and transparent outbound process can operate within this framework. Mass sending to randomly compiled lists, on the other hand, carries both legal and reputational risk.

In this article, we look at what KVKK means in practice for cold email at B2B SaaS outbound teams, which steps can reduce risk and which mistakes come up most often. An important note: this content is for general information only and does not constitute legal advice. We strongly recommend working with a KVKK specialist or a lawyer on your own data processing activities.

Which laws apply to cold email?

The most common mistake with cold email is reducing the issue to a single law. A company sending B2B outbound email in Turkey actually stands at the intersection of two separate sets of rules.

1. Law No. 6698 on the Protection of Personal Data (KVKK): Governs how data belonging to natural persons is collected, for what purpose and on what legal basis it is processed, how long it is retained and to whom it is transferred. For cold email, the core question is: "Do I have the right to process this person's name, job title and email address?"

2. Law No. 6563 on the Regulation of Electronic Commerce (ETK) and the related regulation: Governs the sending of commercial electronic messages. Here the question is different: "Can I send this person a commercial message, and do I need consent?"

On the ETK side, there is an important exception for B2B. The Regulation on Commercial Communication and Commercial Electronic Messages provides that commercial electronic messages may be sent to tradespeople and merchants without obtaining prior consent. Once the recipient exercises their right to opt out, however, the consent provisions apply. In other words, for communication aimed at businesses, a "send first, stop if they opt out" approach is possible under ETK in certain circumstances. Still, two caveats are worth keeping in mind:

• How the merchant exception applies to employees' personal corporate addresses (for example, [email protected]) is open to interpretation.
• The exception under ETK does not remove your obligations under KVKK. Even if you have the right to send the message, the way you process that person's data must separately comply with KVKK.

On the İYS side, service providers sending commercial messages also need to assess their registration and opt-out management obligations based on their own situation. Which obligations bind you may vary depending on your sending volume, channel and recipient profile.

Is a corporate email address personal data?

Short answer: Yes, if it identifies a natural person.

KVKK treats any information relating to an identified or identifiable natural person as personal data. In practice, this definition leads to the following distinction:

• [email protected], [email protected], [email protected]: These are generic addresses belonging to a legal entity and do not identify a specific natural person. The risk under KVKK is low, but ETK rules still apply.
• [email protected], [email protected]: These directly identify a natural person. They are personal data.
• Full name + job title + company + LinkedIn profile: Every row in your prospecting lists is a record that combines multiple pieces of personal data.

The practical consequence of this distinction is this: because the essence of B2B outbound is reaching decision-makers, most of your list will contain personal data. So the "we're B2B, KVKK doesn't concern us" approach does not hold.

Which legal basis can you rely on?

Article 5 of KVKK requires explicit consent or one of the other legal bases listed in the law for personal data to be processed. In the cold email scenario, three options are usually discussed.

Explicit consent

This is the safest route but the one least compatible with the nature of outbound. Obtaining explicit consent in advance from someone you have never contacted is practically impossible. Explicit consent makes more sense in inbound processes, such as webinar registrations, content downloads or demo requests. If you want to strengthen these channels, our article on collecting qualified leads with B2B webinars is a good starting point.

Data made public by the data subject

If a person has made their contact information public themselves, that information may be processed under certain conditions. However, the Personal Data Protection Board's approach is clear: Making data public is limited to the purpose for which it was made public. An email address that someone shared on their company website for "press inquiries" cannot be freely used to send them a sales pitch. For the same reason, compiling information visible on LinkedIn profiles in bulk for marketing purposes should not be considered a safe basis on its own.

Legitimate interest

This is the basis many B2B companies rely on: "Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject." This basis does not apply automatically. It requires you to carry out a balancing test and document it.

How do you carry out a balancing test?

If you are going to rely on legitimate interest, what makes it defensible is the written assessment you prepare in advance. A simple template answers these four questions:

1. What is our interest? Example: "To introduce our accounting automation software to finance directors at manufacturing companies with 50–500 employees."
2. Is the processing necessary, and is there a less intrusive way? Example: "Only first name, last name, job title, company and corporate email are processed. No personal phone numbers, private email addresses or special categories of data are processed."
3. Would the person reasonably expect this communication? For example, it may be considered reasonable for a finance director to receive an email about finance software directly related to their role. Sending the same person an unrelated product, however, goes beyond reasonable expectations.
4. How are the person's rights protected? Example: "A privacy notice is provided in the first email, a one-click or one-word opt-out is offered, anyone who opts out is permanently removed from the list, and data is deleted if there is no engagement within 12 months."

The narrower the target audience this assessment is based on, the stronger it becomes. Sending the same message to a random list of 10,000 people makes the balancing test harder to pass. Sending personalized messages to a segment of 300 people filtered by role and industry, on the other hand, is far more defensible both legally and commercially. This is where compliance and performance pull in the same direction. We reach the same conclusion in our article on how cold email has changed: relevance beats volume.

How do you provide a privacy notice in the first email?

Article 10 of KVKK governs the obligation to inform. According to the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, if the data was not obtained directly from the data subject and will be used for communication purposes, the notice must be provided at the latest at the time of first contact. In cold email, that means your first message.

The notice should include at least the following:

• The identity of the data controller (company name)
• The purpose for which the data is processed
• To whom and for what purpose the data may be transferred
• The method of collection and the legal basis
• The data subject's rights under Article 11 of KVKK

You don't need to paste a long legal text at the bottom of the email for this. A short note and a link to the full text may be sufficient. A sample closing:

"We found your contact details through publicly available professional sources and are reaching out because we believe this may be relevant to your role. You can find our privacy notice explaining how your data is processed at [page on your website]. If you'd prefer we don't contact you again, simply reply 'no' to this email."

These three sentences provide transparency, the source and an opt-out route all at once. In our experience, this kind of honest closing does not lower reply rates. On the contrary, it reduces harsh reactions along the lines of "where did you get my number?"

Why does it matter where you got the data?

In a KVKK investigation or a data subject request, one of the first questions you will be asked is "Where did you obtain this data?" If you can't answer this question clearly, your process is weak.

Common data sources and what to watch out for:

• B2B data platforms: Global data providers publish their own data collection and compliance policies. For example, if you use a prospecting platform like Apollo.io, you should review the provider's data source disclosures, privacy policy and opt-out mechanism. You should also tag the source of every record you pull from the platform in your CRM. The provider being compliant does not remove your obligations as the data controller.
• Company websites and press pages: Pay attention to the purpose for which the data was made public. An "investor relations" contact address may not be appropriate for sales emails.
• Event attendee lists: Always ask what kind of permission the organizer obtained from attendees for this sharing. "We got a list from the trade show" is not a legal basis on its own.
• Purchased ready-made lists: This is the riskiest source. How the data was collected is often unclear, and quality is usually low. We don't recommend them, from either a legal or a deliverability standpoint.

A practical rule: every contact in your CRM should have at least "source," "collection date" and "legal basis" fields. These three fields will save you minutes when a request comes in.

Do tools based abroad create problems under KVKK?

Most of the tools outbound teams use (CRMs, email sequencing tools, data enrichment platforms) host their servers outside Turkey. When you upload data belonging to people in Turkey to these tools, you are making a cross-border data transfer within the meaning of KVKK.

Article 9 of KVKK was revised by an amendment made in 2024. Under the current framework, the most commonly used safeguard for transfers to countries without an adequacy decision is the standard contracts published by the Board. A standard contract must be notified to the Authority within 5 business days of being signed.

What to do in practice:

1. List every tool in your outbound process that touches personal data: CRM, sequencing tool, data provider, email verification service, calendar tool, etc.
2. Check where each one's data center is located and which transfer mechanism it offers.
3. Together with your legal counsel, determine which safeguard will apply to which tool.
4. Clearly state cross-border transfers in your privacy notice.

This is the step most SaaS companies skip, yet it is also the easiest gap to spot.

How do you build a KVKK-compliant cold email process, step by step?

The process below offers a practical framework for a B2B SaaS team building outbound from scratch or looking to fix an existing process.

1. Narrow your ICP. Instead of "all companies in Turkey," choose a defined audience, such as "operations directors at logistics companies with 100–1,000 employees." A narrow target strengthens the legitimate interest argument.
2. Apply data minimization. Collect only the necessary fields: first name, last name, job title, company, corporate email. Don't include fields such as personal mobile numbers, private email addresses or dates of birth in your outbound list.
3. Put the balancing test in writing. Keep the four-question template above as a one-page document for each campaign segment.
4. Prepare a privacy notice and publish it on your website. Add a section specific to outbound: data source, purpose, retention period, transfers and rights.
5. Add a short notice and opt-out line to your email templates. It should be in the first email of every sequence. Reminding recipients of the opt-out route in follow-up emails is also good practice.
6. Create a suppression list. Every address that opts out is permanently added to this list. Whenever a new list is uploaded, it is first checked against this list. This prevents you from emailing the same person again six months later from a different campaign.
7. Design a reasonable sequence. For example, a 3–4 step sequence spaced 2–4 days apart is enough. Emailing someone who doesn't respond 8–10 times both stretches the "reasonable expectation" limit and increases spam complaints.
8. Set a retention period. For example, set a rule such as "outbound contacts with no engagement within 12 months are deleted or anonymized," and tie it to an automated workflow in your CRM.
9. Define your request-handling process. Under KVKK, data subject requests must be answered within 30 days at the latest. Decide in advance who will handle requests, which template will be used to respond and how data will be deleted.
10. Train your team. SDRs should be able to give a standard, honest answer to the question "where did you find this address?" Even a 30-minute internal training session and a one-page checklist make a big difference.

A significant portion of these steps can be managed through automation, such as source tagging, suppression list checks and deleting records whose retention period has expired. We go into detail on how to set this up in our article on automating your lead generation operations.

What should you do when an opt-out request comes in?

Opt-out replies are a natural part of outbound, and when handled correctly, they are the moment where you can reduce risk the most. When a recipient says "Please don't contact me again" or "Where did you get my data? Delete it," follow these steps:

• Stop the sequence the same day. Automated follow-up emails continuing to go out after an opt-out is the most common mistake and the one that generates the most complaints. Make sure the "stop on reply" setting is enabled in your sequencing tool.
• Add the address to your suppression list. If there is a deletion request, delete the person's data from your active lists. Keep only the minimum information needed to avoid contacting them again (for example, the email address itself) on the suppression list, and explain this in your privacy notice.
• Give a clear answer to the source question. A straightforward reply such as "We found your corporate contact details through data platform X" significantly reduces the likelihood of the person filing a complaint.
• Sync across all tools. If the person has been deleted from your CRM but is still in your data enrichment tool, they will show up again in your next list.

Track your opt-out rate as a signal, too. If opt-out and complaint rates are noticeably high in a segment, your targeting or messaging is most likely off. For both compliance and sales efficiency, that segment needs to be rethought.

What are the most common mistakes?

These are the mistakes we encounter most often in the field:

• Assuming "KVKK doesn't apply to B2B." A corporate email address that belongs to an individual is personal data.
• Buying ready-made lists of unclear origin. This carries both legal and deliverability risk. Invalid addresses increase your bounce rate and damage your domain's reputation.
• Not providing a privacy notice at all, or only placing it at the bottom of your website. If the data was not obtained from the data subject, the notice must be provided at first contact.
• An opt-out mechanism that doesn't work. Processes with a broken "unsubscribe" link or that keep sending follow-up emails after an opt-out are the fastest way to generate complaints.
• Ignoring cross-border transfers. Every cloud tool you use is a potential transfer.
• Having no retention period. Keeping thousands of contacts in your CRM that were added five years ago and never responded makes no sense from either a sales or a legal perspective.
• Neglecting technical infrastructure. KVKK compliance and deliverability may seem like separate topics, but they draw on the same discipline. A team that doesn't authenticate its domain usually doesn't track its data sources either. We cover the technical side step by step in our article on setting up SPF, DKIM and DMARC to keep outbound emails out of spam.

Does compliance hurt outbound performance?

We hear this question often, especially from SaaS teams under growth pressure. Our observation says the opposite: the principles KVKK requires, namely purpose limitation, data minimization, transparency and respect for the right to opt out, are things a good outbound program needs anyway.

• Narrow, well-defined targeting drives higher reply rates.
• A transparent closing line builds trust and reduces harsh reactions.
• A regularly cleaned CRM lowers your bounce rate and protects your domain reputation.
• Fewer but more relevant follow-ups reduce spam complaints.

For example, picture one team sending a standard message to a general list of 5,000 people, and another writing to a segment of 400 people narrowed by role and industry, with a personalized first line for each. The second team runs a process that is far easier to defend legally and usually lands more qualified meetings as well. If you're curious about the fundamentals of outbound and the path to qualified meetings, take a look at our article on what outbound sales is and how it works in B2B.

For teams struggling to build the data side in-house, outside support is also an option. Sales Corner, a data-driven B2B sales and lead generation company within our group, can handle the operational side of these processes, from defining your target audience to preparing your data.

Frequently asked questions

Is explicit consent required to send B2B cold email?

Not in every case. In addition to explicit consent, KVKK recognizes other legal bases such as legitimate interest. The relevant regulation under ETK allows commercial messages to be sent to tradespeople and merchants without prior consent, but sending must stop if the recipient exercises their right to opt out. However, relying on legitimate interest requires a documented balancing test and a privacy notice in the first email.

Can I use an email address that is publicly available on LinkedIn?

Being publicly available does not mean the data can be processed for any purpose. The Personal Data Protection Board emphasizes that data made public may only be processed in a manner consistent with the purpose for which it was made public. That's why, when using such data, it is important to use narrow targeting, provide a privacy notice at first contact and offer an easy way to opt out.

If a recipient asks for their data to be deleted, how quickly do I need to respond?

Under KVKK, data subject requests must be answered within 30 days at the latest. In practice, however, the healthiest approach is to stop the sequence the same day and add the person to your suppression list. Deletion must be carried out across all systems, including your CRM, sequencing tool and data enrichment platform.

Is using a CRM with servers abroad a KVKK violation?

Not on its own, but it is a cross-border data transfer and requires compliance with the conditions in Article 9 of KVKK. In practice, the most commonly used safeguard is the Board's standard contracts, which must be notified to the Authority within 5 business days of signing. We recommend clarifying with legal counsel which tool will be used under which mechanism.

Conclusion

KVKK does not prohibit B2B cold email, but it makes doing it haphazardly risky. A team that accepts that corporate email addresses are personal data, documents its legal basis, is transparent at first contact, acts on opt-out requests the same day and manages cross-border transfers runs an outbound program that is both legally sound and more effective commercially. Seeing compliance not as an obstacle but as part of a more relevant and more trustworthy prospecting discipline protects both your domain reputation and your brand in the long run.

If you want to design your outbound process to be both results-driven and KVKK-conscious, the SAAS Corner team is here to support you, from defining your target audience to building your sequences. Get in touch with us to review your current process together.

Related Posts

• Keep Outbound Emails Out of Spam: SPF, DKIM, DMARC
• What Is Outbound Sales? How B2B Companies Book Qualified Meetings
• B2B SaaS Content Marketing: Where Do You Start in Turkey?
• B2B SaaS Marketing Budget: What Percentage of Revenue Should It Be?