Regulatory Compliance and Investigations Lawyer in Bursa

Many of the legal risks companies face can be prevented by well-designed compliance processes before a dispute arises. From our Bursa office, Neka Legal provides corporate clients, including local subsidiaries of international groups, with preventive legal support across a broad field, from regulatory compliance to internal investigations and public inspections. Our aim is to turn compliance from a file of documents into a management tool embedded in the company’s day-to-day operations.

Main areas of corporate compliance

In our corporate compliance projects, we set up data inventories, policies and internal control mechanisms for compliance with personal data protection legislation, and we establish ethical rules and anti-bribery internal control procedures in line with national and international standards such as the FCPA and the UK Bribery Act. Monitoring sector-specific regulations in industry, energy, environment and technology, and updating operational processes accordingly, is also part of our work. The topics we deal with most often in practice are:

• Personal data protection (KVKK) and data security; for details, see our data protection page
• Occupational health and safety obligations and the prevention of workplace accidents
• Anti-bribery and anti-corruption, gift and hospitality policies
• Competition law compliance and rules on contacts with competitors
• Anti-money laundering obligations (MASAK)
• Sanctions lists and export controls in foreign trade
• Commercial electronic messages and consumer legislation

How is an effective compliance programme built?

1. Risk analysis: A legal risk map is drawn up, taking into account the company’s field of activity, business partners and relations with public authorities.
2. Policies and procedures: Written rules are established, such as a code of ethics and policies on conflicts of interest, gifts and donations.
3. Responsible function: A person or unit responsible for compliance is appointed, with a direct reporting line to the board.
4. Training: Employees receive regular training on the risks specific to their roles.
5. Reporting channel: An ethics hotline is set up so that misconduct can be reported confidentially, and whistleblowers are protected.
6. Audit and update: The programme is audited periodically and updated in line with legislative changes and identified gaps.

Obligations and deadlines frequently encountered in practice

A workplace accident must be reported to the Social Security Institution (SGK) within three working days after the accident (Law No. 5510, Art. 13; Law No. 6331, Art. 14). An occupational disease must also be reported within three working days of becoming known (Law No. 6331, Art. 14). Commercial books and documents must be kept for ten years (Turkish Commercial Code, Art. 82). A personal data breach must be notified to the Personal Data Protection Board within seventy-two hours of becoming aware of it (KVKK, Art. 12 and Board decision). Entities subject to MASAK obligations must report a suspicious transaction within ten working days of the suspicion arising (Law No. 5549, Art. 4 and the Regulation on Measures).

Legal liability of the company and its managers

Under Turkish law, criminal penalties cannot be imposed on legal entities (Turkish Criminal Code, Art. 20); however, this does not mean companies are free of liability. If offences such as bribery, aggravated fraud, bid rigging and money laundering are committed for the benefit of a legal entity, an administrative fine can be imposed on the company (Law on Misdemeanours, Art. 43/A); in some cases, security measures such as revocation of an operating licence and confiscation may also apply (Turkish Criminal Code, Art. 60).

Board members and managers may be personally liable to the company, shareholders and creditors if they breach their duties under the law and the articles of association through their fault (Turkish Commercial Code, Art. 553). A well-designed and documented compliance programme is the most tangible way of showing that managers have fulfilled their duty of care. Where individual criminal liability arises, we work together with our criminal law team.

Public inspections and internal investigations

We prepare companies for, and represent them in, inspections carried out by public bodies such as the Competition Authority, the Banking Regulation and Supervision Agency (BDDK) and the Tax Inspection Board. Preparing an inspection protocol in advance, showing which documents will be provided by whom, who will accompany the inspection team and at what stage the lawyer will be involved, considerably reduces the risk of mistakes in unannounced inspections.

We identify allegations of misconduct, breach of trust or irregularities within the company through internal investigations conducted in confidence; we set up the legal framework for internal ethics hotlines and assess incoming reports within the legal framework. In internal investigations, respecting employees’ personality rights, employment law rules and data protection legislation is decisive for whether the findings can later be used as evidence. If an investigation turns into litigation, we prepare the technical and strategic defence before the administrative and criminal courts.

Training and legal due diligence

To make the compliance culture last, we run tailored training for employees on legal responsibilities, data security and ethical rules. In mergers, acquisitions and new investments, we identify the historical legal risks of the target through legal due diligence, and we periodically review existing contracts for compliance with current legislation and sanctions lists. For other matters relating to company structure, see our corporate law page.

Frequently asked questions

Can companies be criminally punished in Türkiye?

Imprisonment or judicial fines cannot be imposed on companies. However, if certain offences are committed for the company’s benefit, administrative fines and security measures can be applied, and managers may also face personal liability.

Is a compliance programme only necessary for large companies?

No. Data protection, occupational health and safety and competition rules apply to companies of every size. The scope of the programme can be scaled to the company’s size and risk profile.

Does a compliance programme fully release the company from liability?

Not automatically. However, an effective and documented compliance programme prevents infringements and provides important support in any investigation that the company and its managers acted with due care.

Can the findings of an internal investigation be used as evidence in court?

Yes, provided they were obtained by lawful methods. That is why an internal investigation must be conducted properly and documented from the outset.

What should be done during an unannounced public inspection?

The inspection team’s authorisation document should be reviewed, the lawyer informed immediately and the pre-agreed inspection protocol followed. Obstructing the inspection may itself be sanctioned.

Responsible attorney: Kaan Kaplan

This page has been prepared for general information purposes and does not constitute legal advice. Last updated: 6 November 2026.