"Is keeping our data in a cloud abroad a risk?" Until a few years ago, that question was mostly on the agenda of banks and public institutions. Today it is on the desks of a wider group of companies. Gartner lists a trend it calls "geopatriation" among its strategic technology trends for 2026, and it forecasts that by 2030 more than 75% of organizations in Europe and the Middle East will move their virtual workloads to solutions designed to reduce geopolitical risk. According to the same forecast, that share was below 5% in 2025.
Spending points in the same direction. Gartner forecasts that worldwide spending on sovereign cloud infrastructure as a service (IaaS) will reach $80 billion in 2026, which is a 35.6% increase over 2025.
In this article, we clarify the concepts, summarize the main outlines of Türkiye's legal framework on the basis of the official texts, and propose a checklist that makes the data-location decision manageable. We addressed the question of which workloads to start with when moving to the cloud separately in our cloud migration article.
Concepts: sovereign cloud, data localization, "geopatriation"
By Gartner's definition, geopatriation is the relocation of company data and applications, because of perceived geopolitical risk, from global public clouds to sovereign clouds, regional cloud providers or the organization's own data centers. According to Gartner, cloud sovereignty was once limited to banks and governments; today it affects a much wider range of organizations.
In practice, three questions need to be kept apart:
- Where does the data sit? Hosting, backup and disaster-recovery locations.
- Who can access the data, and from where? Support teams, subcontractors, management consoles.
- Which law and which oversight apply? The parties to the contract, the applicable legislation, notification obligations.
"Data localization" most often answers only the first question. The sovereignty debate covers all three together. Gartner's statement also stresses that changing providers can give more control over data residency, compliance and governance.
What the data says: where is the spending going?
According to Gartner's February 2026 forecast, the fastest-growing regions for sovereign cloud IaaS spending in 2026 are the Middle East and Africa at 89%, Mature Asia/Pacific at 87% and Europe at 83%. Europe is expected to overtake North America in this spending in 2027.
Two details matter especially for decision makers. First, Gartner estimates that this trend will move 20% of existing workloads from global providers to local providers. Second, 80% of sovereign cloud spending is expected to come from new digital solutions or from legacy workloads still waiting to be moved to the cloud. In other words, the issue is less about hastily moving running systems back and more about making data location a criterion from the start in new decisions.
Gartner states that the main buyers will be public-sector bodies, followed by regulated sectors and critical infrastructure organizations such as energy and telecommunications.
The Türkiye framework: KVKK's cross-border transfer provisions
When personal data is involved in Türkiye, the core text is Article 9 of Law No. 6698 (KVKK, Türkiye's data-protection law). The article was amended by Law No. 7499 of 2 March 2024, which made transfers subject to a tiered structure:
- Adequacy decision: If one of the processing conditions in Articles 5 and 6 of the Law is met and the Personal Data Protection Board (Kurul, "the Board") has issued an adequacy decision on the destination country, sector or international organization, the transfer may be made.
- Appropriate safeguards: If there is no adequacy decision, one of four safeguards is required, provided the data subject has the means to assert their rights; these include binding corporate rules approved by the Board and the standard contract announced by the Board.
- Incidental exceptions: If neither exists, a transfer is possible only in one of the listed situations and only if it is incidental.
After the standard contract is signed, it must be notified to the Personal Data Protection Authority (Kurum, "the Authority") within five business days; Article 18 of the Law provides for an administrative fine for those who fail to make this notification. One of the four standard contracts the Board announced in 2024 was prepared for transfers from a data controller to a data processor, the arrangement commonly encountered in cloud services. In its February 2025 announcement, the Authority reminded that, for contracts also made in a foreign language, the two parties must sign the Turkish text as well.
The implementing regulation published on 10 July 2024 states a point that is critical for cloud decisions in plain terms: the fact that the transfer is carried out by the data processor does not remove the data controller's responsibility for complying with the procedures and safeguards. The Law also requires the same safeguards to be provided for onward transfers of data transferred abroad. For generative AI tools specifically, we covered this topic in our KVKK guide article.
In some sectors, however, localization is a direct rule. The regulation of BDDK (the Turkish Banking Regulation and Supervision Agency) on banks' information systems makes it mandatory for banks to keep their primary and secondary systems in Türkiye and counts the cloud computing services obtained for these systems within the same scope. If you operate in a regulated sector, you also need to check your own sector regulator's rules separately.
A practical path: a checklist for data location
The steps below are a general method derived from the framework in the sources; each organization needs to adapt it to its own data structure and sector.
- Build a data-location map. For each system, write down the primary hosting, backup, disaster-recovery and support-access locations. The question "where is the server?" alone is not enough.
- Classify the data. Personal data, special-category personal data, data subject to sector-specific regulation and trade secrets should be marked as separate categories.
- Record the legal basis for every cross-border flow. Is it an adequacy decision, a standard contract, binding corporate rules or an incidental exception? A flow with an unclear basis is a flow awaiting a decision.
- Set up a standard-contract calendar. The signing date, the five-business-day notification and which party will make it should be assigned to a single responsible person.
- Write sub-processors and onward transfers into the contract. The provider's obligation to notify you of the subcontractors it uses and of region changes should be made clear.
- Prepare an alternative scenario for critical workloads. Decide which systems must run with a local or regional provider based on business criticality and data class. The goal should be not to localize everything but to keep the right workload in the right place.
- Keep the exit plan up to date. How the data will be retrieved when the need to change providers arises should be written down in advance. For those serving the EU market, we summarized the transition rules of the EU Data Act in a separate article.
Conclusion
Where data is kept is no longer just an infrastructure detail; it is a management decision that has to be considered together with the legal basis, supplier risk and business continuity. Gartner's forecasts show that this decision will come onto the agenda of more organizations in the coming years. In Türkiye, KVKK's cross-border transfer regime, renewed in 2024, ties most of the answer to contract and record-keeping discipline.
From Orient Global's perspective, the sound starting point is to map the existing data flows before looking for a new provider.
Why logistics experience matters here. A logistics operation is a network of sites, and its data is spread across one too: warehouse and transport systems, carrier and partner portals, customs and delivery documents, and the backup and support locations behind each of them. The first checklist step, the data-location map, is therefore familiar work for anyone who has designed distribution networks: list every node, what it holds, who can reach it and what happens when it has to be replaced. Steps 5 to 7 have close parallels as well: subcontracted carriers, placing the right stock in the right warehouse, and contingency routing. One of our consultants brings more than 30 years in operations, logistics and supply chain: at a technology distribution company of roughly one billion dollars in scale, he ran logistics, warehousing, technical service and administrative operations end-to-end, building and leading teams of 100+ people and delivering lasting gains through KPI-driven programs. He has also managed nationwide warehouse and transport operations, large-scale distribution networks, and network and capacity planning at leading retail, logistics and distribution organizations. An industrial engineer, he now brings that supply-chain discipline to SMEs through AI and automation. Meet our consultants.
This article is intended for general information purposes and is not a substitute for legal advice.
#interimmanagement #forwarddeployedengineering