Google Cloud updated its Privacy Notice effective date from September 28, 2026 to October 15, 2026 and added a new section addressing Turkish data protection law (KVKK). The new section specifies that Google Cloud EMEA Ltd acts as data controller under KVKK, describes categories of personal data collected, legal grounds for processing (compliance with law, rights protection, legitimate interests), data transfer mechanisms (domestic and cross-border), retention periods (up to 180 days for most operational data, longer for legal/regulatory purposes), and user rights including access, correction, deletion, and compensation for unlawful processing. This establishes explicit compliance framework and procedural transparency for users subject to Turkish data protection law.
Data controllers and businesses using Google Cloud in Turkey: Google Cloud is now explicitly stating how it handles data under Turkish law, and organizations using the service need to ensure their own privacy policies and contracts reflect this.
The updated Privacy Notice now explicitly discloses Google Cloud's data controller role under Turkish law, the legal grounds for processing personal data (compliance with law, rights protection, and legitimate interests), and specific retention periods for operational data (up to 180 days, longer for legal/regulatory purposes). The notice also details user rights under Turkish KVKK law, including rights to access, correct, delete, and request compensation for unlawful processing. Users subject to Turkish data protection law can exercise these rights through Google's Privacy Help Center or via their organization's administrator.
→ Review the updated Privacy Notice to understand your data controller, processing grounds, and retention periods under Turkish KVKK law.
→ If you wish to exercise your rights to access, correct, delete, or request compensation for unlawful processing, contact Google via the Privacy Help Center or your organization's administrator.
Google Cloud EMEA Ltd is designated as data controller under KVKK for Service Data processing.
Processing is authorized under KVKK Articles 5-6 for compliance with law, rights protection, and legitimate interests including service reliability, fraud prevention, and security.
Most operational data retained up to 180 days; longer retention for legal, regulatory, tax, accounting, fraud prevention, security, or dispute resolution purposes.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Google Cloud added a dedicated Turkish data protection compliance section to its Privacy Notice, effective October 15, 2026. The section designates Google Cloud EMEA Ltd as data controller under Turkish KVKK law, specifies processing legal …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-005666.
Google Cloud expanded its acceptable use restrictions to explicitly cover 'AI Agents' in addition to the Services themselves. The updated …
Google Cloud expanded the definition of 'Fee Accrual Period' to include Google Workspace Services (GWS Services) in addition to GCP …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.